* [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready
@ 2026-09-18 20:21 dt
2026-09-18 20:22 ` [PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable dt
` (4 more replies)
0 siblings, 5 replies; 8+ messages in thread
From: dt @ 2026-09-18 20:21 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth@vger.kernel.org
From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
A late stream-ready event can reach bap_resume_complete() after Release
has queued Disable. It then replies to Release with an Acquire payload
and drops the Disable request ID. Client disconnection can subsequently
free the owner while the Disable callback still refers to it.
Only complete pending Acquire/TryAcquire requests from this path. Leave
Release and its request ID for the Disable callback or cancellation.
---
Based on master ebbb4ee31. The new resume test fails all three pause
variants on that base with malformed Release replies and a Disable
cleanup crash. With the series: 7 targeted functional tests and all 697
BAP unit tests pass. The tests check transport lifecycle, not audio data.
profiles/audio/transport.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/profiles/audio/transport.c b/profiles/audio/transport.c
index e3f3df50e..02c5c7ac0 100644
--- a/profiles/audio/transport.c
+++ b/profiles/audio/transport.c
@@ -1952,8 +1952,16 @@ static void bap_resume_complete(struct media_transport *transport)
if (!owner)
return;
- if (owner->pending)
+ if (owner->pending) {
+ const char *member;
+
+ member = dbus_message_get_member(owner->pending->msg);
+ /* A late ready event must not complete a pending Release. */
+ if (strcmp(member, "Acquire") && strcmp(member, "TryAcquire"))
+ return;
+
owner->pending->id = 0;
+ }
if (transport->fd < 0) {
media_transport_remove_owner(transport);
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
@ 2026-09-18 20:22 ` dt
2026-09-18 20:24 ` [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire dt
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: dt @ 2026-09-18 20:22 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth@vger.kernel.org
From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
When reacquiring a transport, the stream can reach Enabling before its
previous CIS finishes disconnecting. Once teardown completes, IO
recreation accepts only QoS, while CIS enabling requires existing IO.
The pending Acquire consequently stalls.
Allow deferred IO recreation in Enabling too. Keep the existing CIG-busy
checks and recreate all IO before enabling CISes.
---
Additional local A/B: hold the userspace disconnect callback for one
active CIS for 500 ms, then reacquire about 118 ms after Release replies.
With patch 1 in both builds, the old predicate leaves both Acquires
unanswered until the client's 26-second timeout; this patch completes
both in about 374 ms, after deferred cleanup.
The delay fixture is not included here. It delays userspace cleanup,
not the HCI event; the regular regression does not force this ordering.
profiles/audio/bap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 5771c9ae0..308e0fd05 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -2576,12 +2576,17 @@ static void update_cig_setup_io(void *data, void *match_data)
struct update_cig_data *info = match_data;
struct bt_bap_stream *stream = setup->stream;
struct bt_bap_qos *qos = bt_bap_stream_get_qos(stream);
+ uint8_t state;
if (qos && qos->ucast.cig_id != info->cig)
return;
if (!setup->want_io || !stream || setup->io || setup->closing)
return;
- if (bt_bap_stream_get_state(stream) != BT_BAP_STREAM_STATE_QOS)
+
+ /* Enable may complete while the previous IO is still disconnecting. */
+ state = bt_bap_stream_get_state(stream);
+ if (state != BT_BAP_STREAM_STATE_QOS &&
+ state != BT_BAP_STREAM_STATE_ENABLING)
return;
DBG("%p", setup);
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
2026-09-18 20:22 ` [PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable dt
@ 2026-09-18 20:24 ` dt
2026-09-18 21:44 ` Luiz Augusto von Dentz
2026-09-18 23:30 ` [BlueZ,1/3] transport: Preserve Release on late BAP ready bluez.test.bot
` (2 subsequent siblings)
4 siblings, 1 reply; 8+ messages in thread
From: dt @ 2026-09-18 20:24 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth@vger.kernel.org
From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
Acquire both unicast transports, close their sockets and release them
through the same D-Bus owner. Require an empty Release reply so a late
ready callback cannot pass unnoticed by returning an Acquire payload.
Repeat three times with immediate, 100 ms and one-second reacquisition.
Check Acquire reply types and active transport states. Close returned
FDs even when a reply is malformed.
---
doc/functional-bap.rst | 20 +++++++
test/functional/test_bap.py | 102 ++++++++++++++++++++++++++++++++++++
2 files changed, 122 insertions(+)
diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
index 60c38c5ed..96e398a43 100644
--- a/doc/functional-bap.rst
+++ b/doc/functional-bap.rst
@@ -105,6 +105,26 @@ test_bap_unicast_transport_acquire
be established, as `bluetoothd` sets up the ISO listener on its own
when the stream is enabled.
+test_bap_unicast_transport_resume[0|0.1|1.0]
+------------------------------------------
+
+:Setup: As above, with both transports already created.
+
+:Steps:
+ 1. Acquire both transports through one D-Bus connection.
+ 2. Close both acquired sockets and call ``MediaTransport1.Release``
+ for both transports without waiting between requests.
+ 3. After both replies, reacquire immediately or after 0.1 or 1 second.
+ 4. Repeat the release/reacquire cycle three times.
+
+:Expected: Each ``Release`` succeeds with an empty reply. Every ``Acquire``
+ returns an FD and MTUs, and both transports become active again.
+
+:Notes: D-Bus is used directly to check the Release reply signature and
+ close the client sockets before releasing the transports. A late ready
+ callback must not answer a pending Release with an Acquire payload.
+ These tests do not force ISO disconnection to overlap the next Enable.
+
test_bap_unicast_reconfigure_metadata[empty|media]
------------------------------------------------
diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
index 7bd59777b..76b2c9f6e 100644
--- a/test/functional/test_bap.py
+++ b/test/functional/test_bap.py
@@ -4,7 +4,9 @@
Tests for BAP (LE Audio) using bluetoothctl in VM instances
"""
+import os
import threading
+import time
import warnings
import dbus
@@ -276,6 +278,106 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
)
+def resume_transports(paths, delay):
+ """Release and reacquire all CIS in a CIG through the same D-Bus owner."""
+ bus = None
+ interfaces = []
+ fds = {}
+
+ @mainloop_wrap
+ def setup():
+ nonlocal bus, interfaces
+ bus = get_dbus(private=True)
+ interfaces = [
+ dbus.Interface(
+ bus.get_object("org.bluez", path, introspect=False),
+ "org.bluez.MediaTransport1",
+ )
+ for path in paths
+ ]
+
+ def operation(method):
+ done = threading.Event()
+ replies = []
+ errors = []
+
+ def finished(index, error=None, values=()):
+ replies.append(index)
+ if error is not None:
+ errors.append((paths[index], str(error)))
+ elif method == "Acquire" and tuple(type(value) for value in values) == (
+ dbus.types.UnixFd,
+ dbus.UInt16,
+ dbus.UInt16,
+ ):
+ fds[index] = values[0].take()
+ elif method == "Acquire" or values:
+ # Release has an empty reply: a late ready callback must not
+ # answer it with an Acquire payload. Dispose of any stray FDs.
+ for value in values:
+ if isinstance(value, dbus.types.UnixFd):
+ os.close(value.take())
+ errors.append((paths[index], f"invalid {method} reply"))
+ if len(replies) == len(paths):
+ done.set()
+
+ @mainloop_wrap
+ def submit():
+ for index, interface in enumerate(interfaces):
+ if method == "Release":
+ os.close(fds.pop(index))
+ getattr(interface, method)(
+ reply_handler=lambda *values, i=index: finished(i, values=values),
+ error_handler=lambda error, i=index: finished(i, error=error),
+ timeout=DEFAULT_TIMEOUT,
+ )
+
+ submit()
+ assert done.wait(DEFAULT_TIMEOUT + 1), f"{method} did not complete"
+ assert not errors, (method, errors)
+
+ @mainloop_wrap
+ def check_active():
+ objects = dbus.Interface(
+ bus.get_object("org.bluez", "/"),
+ "org.freedesktop.DBus.ObjectManager",
+ ).GetManagedObjects()
+ for path in paths:
+ assert objects[path]["org.bluez.MediaTransport1"]["State"] == "active"
+
+ @mainloop_wrap
+ def cleanup():
+ for fd in fds.values():
+ os.close(fd)
+ fds.clear()
+ if bus is not None:
+ bus.close()
+
+ try:
+ setup()
+ operation("Acquire")
+ check_active()
+ for _ in range(3):
+ # Close the client sockets before Release, then reacquire as soon
+ # as both replies arrive (or after a short playback pause).
+ operation("Release")
+ if delay:
+ time.sleep(delay)
+ operation("Acquire")
+ check_active()
+ finally:
+ cleanup()
+
+
+@unicast_host_config
+@pytest.mark.parametrize("delay", [0, 0.1, 1.0])
+def test_bap_unicast_transport_resume(unicast_hosts, delay):
+ host0, host1, initiator, acceptor = unicast_hosts
+ transports = expect_transports(initiator)
+ expect_transports(acceptor)
+ host0.call(resume_transports, transports, delay)
+
+
def clear_remote_transports(remote):
"""Release the peer ASEs while retaining the connected GATT session."""
done = threading.Event()
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire
2026-09-18 20:24 ` [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire dt
@ 2026-09-18 21:44 ` Luiz Augusto von Dentz
2026-09-19 10:06 ` dt
0 siblings, 1 reply; 8+ messages in thread
From: Luiz Augusto von Dentz @ 2026-09-18 21:44 UTC (permalink / raw)
To: dt; +Cc: linux-bluetooth@vger.kernel.org
Hi,
On Fri, Sep 18, 2026 at 4:24 PM dt <derektern@proton.me> wrote:
>
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> Acquire both unicast transports, close their sockets and release them
> through the same D-Bus owner. Require an empty Release reply so a late
> ready callback cannot pass unnoticed by returning an Acquire payload.
>
> Repeat three times with immediate, 100 ms and one-second reacquisition.
> Check Acquire reply types and active transport states. Close returned
> FDs even when a reply is malformed.
I don't think this is valid behavior, though; successive
Release/Acquire calls should wait for the reply not just enqueue.
Applications have the state to track if the transport is ready to be
called again.
> ---
> doc/functional-bap.rst | 20 +++++++
> test/functional/test_bap.py | 102 ++++++++++++++++++++++++++++++++++++
> 2 files changed, 122 insertions(+)
>
> diff --git a/doc/functional-bap.rst b/doc/functional-bap.rst
> index 60c38c5ed..96e398a43 100644
> --- a/doc/functional-bap.rst
> +++ b/doc/functional-bap.rst
> @@ -105,6 +105,26 @@ test_bap_unicast_transport_acquire
> be established, as `bluetoothd` sets up the ISO listener on its own
> when the stream is enabled.
>
> +test_bap_unicast_transport_resume[0|0.1|1.0]
> +------------------------------------------
> +
> +:Setup: As above, with both transports already created.
> +
> +:Steps:
> + 1. Acquire both transports through one D-Bus connection.
> + 2. Close both acquired sockets and call ``MediaTransport1.Release``
> + for both transports without waiting between requests.
> + 3. After both replies, reacquire immediately or after 0.1 or 1 second.
> + 4. Repeat the release/reacquire cycle three times.
> +
> +:Expected: Each ``Release`` succeeds with an empty reply. Every ``Acquire``
> + returns an FD and MTUs, and both transports become active again.
> +
> +:Notes: D-Bus is used directly to check the Release reply signature and
> + close the client sockets before releasing the transports. A late ready
> + callback must not answer a pending Release with an Acquire payload.
> + These tests do not force ISO disconnection to overlap the next Enable.
> +
> test_bap_unicast_reconfigure_metadata[empty|media]
> ------------------------------------------------
>
> diff --git a/test/functional/test_bap.py b/test/functional/test_bap.py
> index 7bd59777b..76b2c9f6e 100644
> --- a/test/functional/test_bap.py
> +++ b/test/functional/test_bap.py
> @@ -4,7 +4,9 @@
> Tests for BAP (LE Audio) using bluetoothctl in VM instances
> """
>
> +import os
> import threading
> +import time
> import warnings
>
> import dbus
> @@ -276,6 +278,106 @@ def test_bap_unicast_transport_acquire(unicast_hosts):
> )
>
>
> +def resume_transports(paths, delay):
> + """Release and reacquire all CIS in a CIG through the same D-Bus owner."""
> + bus = None
> + interfaces = []
> + fds = {}
> +
> + @mainloop_wrap
> + def setup():
> + nonlocal bus, interfaces
> + bus = get_dbus(private=True)
> + interfaces = [
> + dbus.Interface(
> + bus.get_object("org.bluez", path, introspect=False),
> + "org.bluez.MediaTransport1",
> + )
> + for path in paths
> + ]
> +
> + def operation(method):
> + done = threading.Event()
> + replies = []
> + errors = []
> +
> + def finished(index, error=None, values=()):
> + replies.append(index)
> + if error is not None:
> + errors.append((paths[index], str(error)))
> + elif method == "Acquire" and tuple(type(value) for value in values) == (
> + dbus.types.UnixFd,
> + dbus.UInt16,
> + dbus.UInt16,
> + ):
> + fds[index] = values[0].take()
> + elif method == "Acquire" or values:
> + # Release has an empty reply: a late ready callback must not
> + # answer it with an Acquire payload. Dispose of any stray FDs.
> + for value in values:
> + if isinstance(value, dbus.types.UnixFd):
> + os.close(value.take())
> + errors.append((paths[index], f"invalid {method} reply"))
> + if len(replies) == len(paths):
> + done.set()
> +
> + @mainloop_wrap
> + def submit():
> + for index, interface in enumerate(interfaces):
> + if method == "Release":
> + os.close(fds.pop(index))
> + getattr(interface, method)(
> + reply_handler=lambda *values, i=index: finished(i, values=values),
> + error_handler=lambda error, i=index: finished(i, error=error),
> + timeout=DEFAULT_TIMEOUT,
> + )
> +
> + submit()
> + assert done.wait(DEFAULT_TIMEOUT + 1), f"{method} did not complete"
> + assert not errors, (method, errors)
> +
> + @mainloop_wrap
> + def check_active():
> + objects = dbus.Interface(
> + bus.get_object("org.bluez", "/"),
> + "org.freedesktop.DBus.ObjectManager",
> + ).GetManagedObjects()
> + for path in paths:
> + assert objects[path]["org.bluez.MediaTransport1"]["State"] == "active"
> +
> + @mainloop_wrap
> + def cleanup():
> + for fd in fds.values():
> + os.close(fd)
> + fds.clear()
> + if bus is not None:
> + bus.close()
> +
> + try:
> + setup()
> + operation("Acquire")
> + check_active()
> + for _ in range(3):
> + # Close the client sockets before Release, then reacquire as soon
> + # as both replies arrive (or after a short playback pause).
> + operation("Release")
> + if delay:
> + time.sleep(delay)
> + operation("Acquire")
> + check_active()
> + finally:
> + cleanup()
> +
> +
> +@unicast_host_config
> +@pytest.mark.parametrize("delay", [0, 0.1, 1.0])
> +def test_bap_unicast_transport_resume(unicast_hosts, delay):
> + host0, host1, initiator, acceptor = unicast_hosts
> + transports = expect_transports(initiator)
> + expect_transports(acceptor)
> + host0.call(resume_transports, transports, delay)
> +
> +
> def clear_remote_transports(remote):
> """Release the peer ASEs while retaining the connected GATT session."""
> done = threading.Event()
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: [BlueZ,1/3] transport: Preserve Release on late BAP ready
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
2026-09-18 20:22 ` [PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable dt
2026-09-18 20:24 ` [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire dt
@ 2026-09-18 23:30 ` bluez.test.bot
2026-10-04 0:02 ` bluez.test.bot
2026-10-07 18:40 ` [PATCH BlueZ 1/3] " patchwork-bot+bluetooth
4 siblings, 0 replies; 8+ messages in thread
From: bluez.test.bot @ 2026-09-18 23:30 UTC (permalink / raw)
To: linux-bluetooth, derektern
[-- Attachment #1: Type: text/plain, Size: 102714 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1168994/
---Test result---
Test Summary:
CheckPatch PASS 1.52 seconds
GitLint PASS 1.05 seconds
BuildEll PASS 19.42 seconds
BluezMake PASS 378.51 seconds
MakeCheck PASS 14.42 seconds
MakeDistcheck PASS 139.73 seconds
CheckValgrind PASS 231.37 seconds
CheckSmatch PASS 291.87 seconds
bluezmakeextell PASS 93.73 seconds
TestFunctional FAIL 1160.90 seconds
IncrementalBuild PASS 389.01 seconds
ScanBuild PASS 1123.01 seconds
Details
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-sc]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789772617-52.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 52]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7ff3f90f6900 (LWP 52)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007ff3f9851b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007ff3f98348ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140732163359280, 22, 140685836934096, 0, 140732163359216, 140685853779478, 140685824090112, 4096, 0, 11967753019344251904, 140685828272152}}, sa_flags = -88616960, sa_restorer = 0x16}
#5 0x00007ff3fa45ca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007ff3fa582c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007ff3fa55793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffec29b0366) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7ff3f890e000 '=' <repeats 65 times>, "\n==52==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d63f85e040b at pc 0x7ff3fa50c445 bp 0x7ffec29b1860 sp 0x7ffec29b1008\n"..., capacity_bytes_ = 4096, size_ = 3838}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007ff3fa556e02 in __asan::ReportGenericError (pc=140685853377605, bp=140732163364960, sp=sp@entry=140732163362824, addr=addr@entry=137868322145291, is_write=is_write@entry=false, access_size=6, fatal=false, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, signal = {siginfo = 0xffffffff00000002, context = 0x7d63f85e040b, addr = 0, pc = 0, sp = 11476152616506, bp = 137868322145291, is_memory_access = 11, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = false}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, second_free_stack = 0xffffffff00000002, addr_description = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 136287755599648, delete_alignment = 140732163360752}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, free_stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, dealloc_stack = 0xffffffff00000002, alloc_type = 4166910987, dealloc_type = 32099, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (__asan::kShadowKindHigh | unknown: 0x38), shadow_byte = 6 '\006'}, heap = {addr = 0, alloc_tid = 11476152616506, free_tid = 137868322145291, alloc_stack_id = 11, free_stack_id = 0, chunk_access = {bad_addr = 137868322145280, offset = 752, chunk_begin = 140732163383304, chunk_size = 136287755599648, user_requested_alignment = 2032, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11476152616506, offset = 137868322145291, frame_pc = 11, access_size = 137868322145280, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11476152616506, size = 137868322145291, size_with_redzone = 11, name = 0x7d63f85e0400 "p\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140732163383304, gcc_location = 0x7bf3f7427f20, odr_indicator = 140732163360752}, {beg = 140685852674847, size = 1, size_with_redzone = 136287755599648, name = 0x7ffec29b1040 "P\020\233\302\376\177", module_name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 140685828423888, gcc_location = 0x1ec29b0850, odr_indicator = 140732163360800}, {beg = 3, size = 140685853632016, size_with_redzone = 140685840362383, name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", module_name = 0x7ffec29b1300 "\244\024\233\302\376\177", has_dynamic_init = 140732163360992, gcc_location = 0x2, odr_indicator = 140685854347200}, {beg = 136700091526384, size = 140732163360944, size_with_redzone = 140685852698424, name = 0x3e <error: Cannot access memory at address 0x3e>, module_name = 0x7c53f8656cf0 "\003\021", has_dynamic_init = 140685828423888, gcc_location = 0x7ffec29b08d0, odr_indicator = 136700091526400}}, reg_sites = {81, 0, 3264942400, 32766}, access_size = 140685853377605, size = 96 '`'}, wild = {addr = 0, access_size = 11476152616506}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137868322145291, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, count = 137868322145291, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137868322145291}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137868322145291}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, size = 137868322145291, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, alignment = 137868322145291}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, user_size = 137868322145291, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, requested_size = 137868322145291}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, length1 = 137868322145291, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11476152616506, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11476152616506, alloc_tid = 137868322145291, free_tid = 11, alloc_stack_id = 4166910976, free_stack_id = 32099, chunk_access = {bad_addr = 752, offset = 140732163383304, chunk_begin = 136287755599648, chunk_size = 140732163360752, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 11476152616506, tid = 137868322145291, offset = 11, frame_pc = 137868322145280, access_size = 752, frame_descr = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>}, global = {addr = 11476152616506, static kMaxGlobals = 4, globals = {{beg = 137868322145291, size = 11, size_with_redzone = 137868322145280, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>, has_dynamic_init = 136287755599648, gcc_location = 0x7ffec29b07f0, odr_indicator = 140685852674847}, {beg = 1, size = 136287755599648, size_with_redzone = 140732163362880, name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 132113958992, gcc_location = 0x7ffec29b0820, odr_indicator = 3}, {beg = 140685853632016, size = 140685840362383, size_with_redzone = 94447249290699, name = 0x7ffec29b1300 "\244\024\233\302\376\177", module_name = 0x7ffec29b08e0 "\030", has_dynamic_init = 2, gcc_location = 0x7ff3fa5f8fc0 <__asan::instance>, odr_indicator = 136700091526384}, {beg = 140732163360944, size = 140685852698424, size_with_redzone = 62, name = 0x7c53f8656cf0 "\003\021", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 140732163360976, gcc_location = 0x7c53f8656d00, odr_indicator = 81}}, reg_sites = {3264942400, 32766, 4199597125, 32755}, access_size = 140732163364960, size = 8 '\b'}, wild = {addr = 11476152616506, access_size = 137868322145291}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140685854058391, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140685854058391, alloc_tid = 140685854375168, free_tid = 140732163364512, alloc_stack_id = 4199851474, free_stack_id = 32755, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732163362432, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 2}}, stack = {addr = 140685854058391, tid = 140685854375168, offset = 140732163364512, frame_pc = 140685853631954, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140685854058391, static kMaxGlobals = 4, globals = {{beg = 140685854375168, size = 140732163364512, size_with_redzone = 140685853631954, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732163362432, gcc_location = 0x3, odr_indicator = 140685853632016}, {beg = 140685840362383, size = 94447249290699, size_with_redzone = 140732163365216, name = 0x7ffec29b0f00 " \017\233\302\376\177", module_name = 0x7ff3fa5f2f78 "\001", has_dynamic_init = 140732163362624, gcc_location = 0x55e636d285a0, odr_indicator = 140685832317112}, {beg = 65535, size = 140732163362544, size_with_redzone = 140685853463385, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf3f764d200 "\0166\340E", has_dynamic_init = 140732163362592, gcc_location = 0x7ff3fa46d74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732163362592}, {beg = 140685853888381, size = 140732163362624, size_with_redzone = 140685853732198, name = 0x7ffec29b0fc0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140685854347200, gcc_location = 0x7c33f86498c0, odr_indicator = 140732163362704}}, reg_sites = {4198917944, 32755, 40, 0}, access_size = 140685853837853, size = 208 '\320'}, wild = {addr = 140685854058391, access_size = 140685854375168}}}}, function = 0x7ffec29b0fb0 "`\030\233\302\376\177"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, addr_description = {data = {kind = 4166910987, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11476152616506, alloc_stack_id = 4166910987, free_stack_id = 32099, chunk_access = {bad_addr = 11, offset = 137868322145280, chunk_begin = 752, chunk_size = 140732163383304, user_requested_alignment = 3872, access_type = 3, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 11476152616506, frame_pc = 137868322145291, access_size = 11, frame_descr = 0x7d63f85e0400 "p\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11476152616506, size_with_redzone = 137868322145291, name = 0xb <error: Cannot access memory at address 0xb>, module_name = 0x7d63f85e0400 "p\n", has_dynamic_init = 752, gcc_location = 0x7ffec29b6008, odr_indicator = 136287755599648}, {beg = 140732163360752, size = 140685852674847, size_with_redzone = 1, name = 0x7bf3f7427f20 "\300me\370S|", module_name = 0x7ffec29b1040 "P\020\233\302\376\177", has_dynamic_init = 140685853631954, gcc_location = 0x7ff3f8d400d0, odr_indicator = 132113958992}, {beg = 140732163360800, size = 3, size_with_redzone = 140685853632016, name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", module_name = 0x55e636be75cb <bt_log_vprintf+171> "\205\300\017\210=\001", has_dynamic_init = 140732163363584, gcc_location = 0x7ffec29b08e0, odr_indicator = 2}, {beg = 140685854347200, size = 136700091526384, size_with_redzone = 140732163360944, name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x3e <error: Cannot access memory at address 0x3e>, has_dynamic_init = 136700091526384, gcc_location = 0x7ff3f8d400d0, odr_indicator = 140732163360976}}, reg_sites = {4167396608, 31827, 81, 0}, access_size = 140732163363136, size = 69 'E'}, wild = {addr = 0, access_size = 0}}}}, size = 140732163364960}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, beg = 137868322145291, end = 0, old_mid = 0, new_mid = 11476152616506}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, storage_beg = 137868322145291, storage_end = 0, old_container_beg = 0, old_container_end = 11476152616506, new_container_beg = 137868322145291, new_container_end = 11}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, stack = 0xffffffff00000002, old_storage_beg = 137868322145291, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11476152616506}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, global1 = {beg = 18446744069414584322, size = 137868322145291, size_with_redzone = 0, name = 0x0, module_name = 0xa700000063a <error: Cannot access memory at address 0xa700000063a>, has_dynamic_init = 137868322145291, gcc_location = 0xb, odr_indicator = 137868322145280}, global2 = {beg = 752, size = 140732163383304, size_with_redzone = 136287755599648, name = 0x7ffec29b07f0 "@\020\233\302\376\177", module_name = 0x7ff3fa460b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47> "H\205\300t\f\311\303f.\017\037\204", has_dynamic_init = 1, gcc_location = 0x7bf3f7427f20, odr_indicator = 140732163362880}, stack_id1 = 4199851474, stack_id2 = 32755}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, pc = 18446744069414584322, bp = 137868322145291, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11476152616506, kind = (__asan::kShadowKindGap | __asan::kShadowKindHigh | unknown: 0x8), shadow_byte = 4 '\004'}, heap = {addr = 11476152616506, alloc_tid = 137868322145291, free_tid = 11, alloc_stack_id = 4166910976, free_stack_id = 32099, chunk_access = {bad_addr = 752, offset = 140732163383304, chunk_begin = 136287755599648, chunk_size = 140732163360752, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 11476152616506, tid = 137868322145291, offset = 11, frame_pc = 137868322145280, access_size = 752, frame_descr = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>}, global = {addr = 11476152616506, static kMaxGlobals = 4, globals = {{beg = 137868322145291, size = 11, size_with_redzone = 137868322145280, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffec29b6008 <error: Cannot access memory at address 0x7ffec29b6008>, has_dynamic_init = 136287755599648, gcc_location = 0x7ffec29b07f0, odr_indicator = 140685852674847}, {beg = 1, size = 136287755599648, size_with_redzone = 140732163362880, name = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 132113958992, gcc_location = 0x7ffec29b0820, odr_indicator = 3}, {beg = 140685853632016, size = 140685840362383, size_with_redzone = 94447249290699, name = 0x7ffec29b1300 "\244\024\233\302\376\177", module_name = 0x7ffec29b08e0 "\030", has_dynamic_init = 2, gcc_location = 0x7ff3fa5f8fc0 <__asan::instance>, odr_indicator = 136700091526384}, {beg = 140732163360944, size = 140685852698424, size_with_redzone = 62, name = 0x7c53f8656cf0 "\003\021", module_name = 0x7ff3f8d400d0 "", has_dynamic_init = 140732163360976, gcc_location = 0x7c53f8656d00, odr_indicator = 81}}, reg_sites = {3264942400, 32766, 4199597125, 32755}, access_size = 140732163364960, size = 8 '\b'}, wild = {addr = 11476152616506, access_size = 137868322145291}}}}, addr2_description = {data = {kind = 6, {shadow = {addr = 140685854058391, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140685854058391, alloc_tid = 140685854375168, free_tid = 140732163364512, alloc_stack_id = 4199851474, free_stack_id = 32755, chunk_access = {bad_addr = 8315162673665959470, offset = 130735371371, chunk_begin = 140732163362432, chunk_size = 3, user_requested_alignment = 1552, access_type = 2, alloc_type = 2}}, stack = {addr = 140685854058391, tid = 140685854375168, offset = 140732163364512, frame_pc = 140685853631954, access_size = 8315162673665959470, frame_descr = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>}, global = {addr = 140685854058391, static kMaxGlobals = 4, globals = {{beg = 140685854375168, size = 140732163364512, size_with_redzone = 140685853631954, name = 0x736564656572662e <error: Cannot access memory at address 0x736564656572662e>, module_name = 0x1e706f746b <error: Cannot access memory at address 0x1e706f746b>, has_dynamic_init = 140732163362432, gcc_location = 0x3, odr_indicator = 140685853632016}, {beg = 140685840362383, size = 94447249290699, size_with_redzone = 140732163365216, name = 0x7ffec29b0f00 " \017\233\302\376\177", module_name = 0x7ff3fa5f2f78 "\001", has_dynamic_init = 140732163362624, gcc_location = 0x55e636d285a0, odr_indicator = 140685832317112}, {beg = 65535, size = 140732163362544, size_with_redzone = 140685853463385, name = 0x40 <error: Cannot access memory at address 0x40>, module_name = 0x7bf3f764d200 "\0166\340E", has_dynamic_init = 140732163362592, gcc_location = 0x7ff3fa46d74a <__asan_stack_malloc_0(__sanitizer::uptr)+234>, odr_indicator = 140732163362592}, {beg = 140685853888381, size = 140732163362624, size_with_redzone = 140685853732198, name = 0x7ffec29b0fc0 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140685854347200, gcc_location = 0x7c33f86498c0, odr_indicator = 140732163362704}}, reg_sites = {4198917944, 32755, 40, 0}, access_size = 140685853837853, size = 208 '\320'}, wild = {addr = 140685854058391, access_size = 140685854375168}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137868322145291, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137868322145291, tid = 0, offset = 0, frame_pc = 11476152616506, access_size = 137868322145291, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137868322145291, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11476152616506, name = 0x7d63f85e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137868322145280, gcc_location = 0x2f0, odr_indicator = 140732163383304}, {beg = 136287755599648, size = 140732163360752, size_with_redzone = 140685852674847, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf3f7427f20 "\300me\370S|", has_dynamic_init = 140732163362880, gcc_location = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140685828423888}, {beg = 132113958992, size = 140732163360800, size_with_redzone = 3, name = 0x7ff3fa54a610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94447249290699, gcc_location = 0x7ffec29b1300, odr_indicator = 140732163360992}, {beg = 2, size = 140685854347200, size_with_redzone = 136700091526384, name = 0x7ffec29b08b0 "`\030\233\302\376\177", module_name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c53f8656cf0, odr_indicator = 140685828423888}}, reg_sites = {3264940240, 32766, 4167396608, 31827}, access_size = 81, size = 64 '@'}, wild = {addr = 137868322145291, access_size = 0}}}}, pc = 140685853377605, bp = 140732163364960, sp = 140732163362824, access_size = 6, bug_descr = 0x7ff3fa5b2797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 48, descr = "6-byte-read-heap-use-after-free\000\376\177\000\000\002\000\000\000bluetoothd[5\000l\237\225\366\377\025\246nal] org0\016\233\302\376\177\000\000\340\003\233\302\376\177\000\000.L\223\371\363\177\000\000\001\000\000\000\000\000\000\000=\000\000\000\000\000\000\000`\f\233\302\376\177\000\000\211-\212\371\363\177\000\000\034\004\233\302\376\177\000\000\034\004\233\302\376\177\000\000\034\f\233\302\376\177\000\000N\000\000\000\000\000\000\000\006\000\000\000\363\177\000\000\002\000\000\000bluetoothd[52]: [signal] org.fre"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137868322145291, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137868322145291, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1594, free_stack_id = 2672, chunk_access = {bad_addr = 137868322145291, offset = 11, chunk_begin = 137868322145280, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137868322145291, tid = 0, offset = 0, frame_pc = 11476152616506, access_size = 137868322145291, frame_descr = 0xb <error: Cannot access memory at address 0xb>}, global = {addr = 137868322145291, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11476152616506, name = 0x7d63f85e040b "B", module_name = 0xb <error: Cannot access memory at address 0xb>, has_dynamic_init = 137868322145280, gcc_location = 0x2f0, odr_indicator = 140732163383304}, {beg = 136287755599648, size = 140732163360752, size_with_redzone = 140685852674847, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7bf3f7427f20 "\300me\370S|", has_dynamic_init = 140732163362880, gcc_location = 0x7ff3fa54a5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 140685828423888}, {beg = 132113958992, size = 140732163360800, size_with_redzone = 3, name = 0x7ff3fa54a610 <___interceptor_malloc(__sanitizer::uptr)+192> "D\213\215\314\367\377\377E\205\311tTH\211m\330A\203\371\001t*E\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\350\"\004\001", module_name = 0x7ff3f98a2b8f <__vasprintf_internal+255> "I\211\004$H\205\300t(H\213\265\330\376\377\377L\211\352H\211\307\350\366\032\371\377H\211\301\353\212\350\254\346\n", has_dynamic_init = 94447249290699, gcc_location = 0x7ffec29b1300, odr_indicator = 140732163360992}, {beg = 2, size = 140685854347200, size_with_redzone = 136700091526384, name = 0x7ffec29b08b0 "`\030\233\302\376\177", module_name = 0x7ff3fa466738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 62, gcc_location = 0x7c53f8656cf0, odr_indicator = 140685828423888}}, reg_sites = {3264940240, 32766, 4167396608, 31827}, access_size = 81, size = 64 '@'}, wild = {addr = 137868322145291, access_size = 0}}}}, pc = 140685853377605, bp = 140732163364960, sp = 140732163362824, access_size = 6, bug_descr = 0x7ff3fa5b2797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007ff3fa556f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140732163364960, sp=sp@entry=140732163362824, addr=addr@entry=137868322145291, is_write=is_write@entry=false, access_size=access_size@entry=6, exp=<optimized out>, fatal=false) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007ff3fa50c468 in MemcmpInterceptorCommon (ctx=ctx@entry=0x7ffec29b1870, real_fn=<optimized out>, a1=a1@entry=0x7d63f85e040b, a2=a2@entry=0x7bf3f738a3a0, size=size@entry=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:848
bp = 140732163364960
pc = <optimized out>
local_stack = 137524724760640
sp = 140732163362824
_ctx = 0x7ffec29b1870
suppressed = <optimized out>
__offset = 137868322145291
__size = 6
__bad = <optimized out>
result = <optimized out>
#11 0x00007ff3fa50c835 in ___interceptor_memcmp (a1=0x7d63f85e040b, a2=0x7bf3f738a3a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:880
ctx = 0x7ffec29b1870
_ctx = {interceptor_name = 0x7ff3fa5b66b6 "memcmp"}
#12 ___interceptor_memcmp (a1=0x7d63f85e040b, a2=0x7bf3f738a3a0, size=6) at ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:875
ctx = <optimized out>
_ctx = <optimized out>
#13 0x000055e636acb098 in bacmp (ba1=0x7d63f85e040b, ba2=0x7bf3f738a3a0) at ./lib/bluetooth/bluetooth.h:438
No locals.
#14 device_addr_type_cmp (a=0x7d63f85e0400, b=0x7bf3f738a3a0) at src/device.c:5657
dev = 0x7d63f85e0400
addr = 0x7bf3f738a3a0
cmp = <optimized out>
#15 0x00007ff3fa2864c2 in g_slist_find_custom () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#16 0x000055e636a4a754 in btd_adapter_find_device (adapter=<optimized out>, dst=dst@entry=0x7c33f8623cd8, bdaddr_type=1 '\001') at src/adapter.c:1055
addr = <optimized out>
device = <optimized out>
list = <optimized out>
#17 0x000055e6369ecc67 in att_disconnected (err=<optimized out>, user_data=0x7c33f8623cd0) at src/gatt-database.c:335
state = 0x7c33f8623cd0
device = <optimized out>
__func__ = "att_disconnected"
#18 0x000055e636a03b94 in btd_gatt_database_att_disconnected (database=<optimized out>, device=<optimized out>) at src/gatt-database.c:4238
server = <optimized out>
att = <optimized out>
state = <optimized out>
addr = <optimized out>
type = <optimized out>
__func__ = "btd_gatt_database_att_disconnected"
#19 0x000055e636aad146 in gatt_server_cleanup (device=device@entry=0x7d63f85e0080) at src/device.c:842
No locals.
#20 0x000055e636ac183c in attio_cleanup (device=0x7d63f85e0080) at src/device.c:862
No locals.
#21 0x000055e636ac1e87 in device_free (user_data=0x7d63f85e0080) at src/device.c:918
device = 0x7d63f85e0080
__func__ = "device_free"
#22 0x000055e636b3fa9a in remove_interface (data=0x7c63f85eb000, name=name@entry=0x55e636d4ca60 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7c53f85fe380
#23 0x000055e636b4265c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#24 0x000055e636a7d213 in adapter_remove (adapter=adapter@entry=0x7d23f85e0200) at src/adapter.c:7307
l = 0x7c13f860b410 = {0x7d63f85e0080}
db = <optimized out>
ranging_manager = <optimized out>
__func__ = "adapter_remove"
#25 0x000055e636a7dda8 in adapter_cleanup () at src/adapter.c:11263
adapter = 0x7d23f85e0200
#26 0x000055e63682f320 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1723
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on setup with "pytest_bluezenv.rpc.RemoteTimeoutError: Connection recv timed out"
FAIL functional.test_bap::test_bap_unicast_set_transport_created[hosts8-vm3-legacy]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts8.0-bluetoothd-1789772636-72.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 72]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7fc5b7756900 (LWP 72)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007fc5b7eb1b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007fc5b7e948ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140730930043632, 140730930043920, 140730930043776, 22, 140487167826896, 0, 140730930043712, 140487184672278, 140487154982912, 4096, 0, 16872763790977827072, 140487159164952}}, sa_flags = -1189228544, sa_restorer = 0x16}
#5 0x00007fc5b8abca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007fc5b8be2c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007fc5b8bb793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffe79181cb6) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7fc5b6f6e000 '=' <repeats 65 times>, "\n==72==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d35b6be0208 at pc 0x562fd2ac7efc bp 0x7ffe79182930 sp 0x7ffe79182920\n"..., capacity_bytes_ = 4096, size_ = 3419}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007fc5b8bb6e02 in __asan::ReportGenericError (pc=94763397971708, bp=140730930047280, sp=sp@entry=140730930047264, addr=137669652644360, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, signal = {siginfo = 0x7ffe00000002, context = 0x7d35b6be0208, addr = 0, pc = 0, sp = 11016591115764, bp = 137669652644360, is_memory_access = 136, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 128}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, second_free_stack = 0x7ffe00000002, addr_description = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140487183567647, delete_alignment = 1}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, free_stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, dealloc_stack = 0x7ffe00000002, alloc_type = 3065905672, dealloc_type = 32053, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xf4), shadow_byte = 5 '\005'}, heap = {addr = 0, alloc_tid = 11016591115764, free_tid = 137669652644360, alloc_stack_id = 392, free_stack_id = 0, chunk_access = {bad_addr = 137669652643968, offset = 752, chunk_begin = 140730930061320, chunk_size = 140487183567647, user_requested_alignment = 1, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 11016591115764, offset = 137669652644360, frame_pc = 392, access_size = 137669652643968, frame_descr = 0x2f0 <error: Cannot access memory at address 0x2f0>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 11016591115764, size = 137669652644360, size_with_redzone = 392, name = 0x7d35b6be0080 "\005\n", module_name = 0x2f0 <error: Cannot access memory at address 0x2f0>, has_dynamic_init = 140730930061320, gcc_location = 0x7fc5b8ac0b1f <__asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*)+47>, odr_indicator = 1}, {beg = 136913738547648, size = 140730930047360, size_with_redzone = 140487184524754, name = 0x3 <error: Cannot access memory at address 0x3>, module_name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, has_dynamic_init = 140730930045280, gcc_location = 0x2, odr_indicator = 140487184524816}, {beg = 94763398530806, size = 140730930045456, size_with_redzone = 7, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7be5b6ce8120 "\003\021", has_dynamic_init = 140730930045408, gcc_location = 0x7fc5b8bc2d66 <__sanitizer::RunFreeHooks(void*)+86>, odr_indicator = 140730930045504}, {beg = 6, size = 140487185240000, size_with_redzone = 136913738626352, name = 0x7ffe79182210 "\b", module_name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 120, gcc_location = 0x7c85b6c17530, odr_indicator = 140730930045440}}, reg_sites = {3086565742, 32709, 0, 0}, access_size = 94763397971708, size = 48 '0'}, wild = {addr = 0, access_size = 11016591115764}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137669652644360, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, count = 137669652644360, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137669652644360}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137669652644360}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, size = 137669652644360, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, alignment = 137669652644360}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, user_size = 137669652644360, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, requested_size = 137669652644360}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, length1 = 137669652644360, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11016591115764, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11016591115764, alloc_tid = 137669652644360, free_tid = 392, alloc_stack_id = 3065905280, free_stack_id = 32053, chunk_access = {bad_addr = 752, offset = 140730930061320, chunk_begin = 140487183567647, chunk_size = 1, user_requested_alignment = 448, access_type = 0, alloc_type = 1}}, stack = {addr = 11016591115764, tid = 137669652644360, offset = 392, frame_pc = 137669652643968, access_size = 752, frame_descr = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>}, global = {addr = 11016591115764, static kMaxGlobals = 4, globals = {{beg = 137669652644360, size = 392, size_with_redzone = 137669652643968, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>, has_dynamic_init = 140487183567647, gcc_location = 0x1, odr_indicator = 136913738547648}, {beg = 140730930047360, size = 140487184524754, size_with_redzone = 3, name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, module_name = 0x7ffe79182160 "\020\246\272\270\305\177", has_dynamic_init = 2, gcc_location = 0x7fc5b8baa610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94763398530806}, {beg = 140730930045456, size = 7, size_with_redzone = 140487185240000, name = 0x7be5b6ce8120 "\003\021", module_name = 0x7ffe791821e0 "", has_dynamic_init = 140487184624998, gcc_location = 0x7ffe79182240, odr_indicator = 6}, {beg = 140487185240000, size = 136913738626352, size_with_redzone = 140730930045456, name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136913738626352, gcc_location = 0x7ffe79182200, odr_indicator = 140487171850606}}, reg_sites = {0, 0, 3534520060, 22063}, access_size = 140730930047280, size = 32 ' '}, wild = {addr = 11016591115764, access_size = 137669652644360}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140487184951191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140487184951191, alloc_tid = 140487181532416, free_tid = 140730930046928, alloc_stack_id = 3099027667, free_stack_id = 32709, chunk_access = {bad_addr = 140730930046928, offset = 3096402488, chunk_begin = 140730930047024, chunk_size = 140487181467222, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140487184951191, tid = 140487181532416, offset = 140730930046928, frame_pc = 140487184312531, access_size = 140730930046928, frame_descr = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>}, global = {addr = 140487184951191, static kMaxGlobals = 4, globals = {{beg = 140487181532416, size = 140730930046928, size_with_redzone = 140487184312531, name = 0x7ffe791827d0 "\200\001\276\266\325|", module_name = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>, has_dynamic_init = 140730930047024, gcc_location = 0x7fc5b88bfe56, odr_indicator = 137257335783808}, {beg = 140487181467172, size = 140730930046976, size_with_redzone = 6866423646880, name = 0x21 <error: Cannot access memory at address 0x21>, module_name = 0x2ee7c224 <error: Cannot access memory at address 0x2ee7c224>, has_dynamic_init = 140730930047008, gcc_location = 0x7c25b6be0aa0, odr_indicator = 140730930047040}, {beg = 136913738626368, size = 137257335783808, size_with_redzone = 136363983054992, name = 0x562fd2ca87c0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fc5b8924dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136913738626368, gcc_location = 0x7fc5b8924dce, odr_indicator = 94763399940032}, {beg = 0, size = 140730930047136, size_with_redzone = 140487181880782, name = 0x7cc5b6be0c40 "\001", module_name = 0x7c05b6bf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136363982685400}}, reg_sites = {3066374312, 31749, 3066004720, 31749}, access_size = 94763399941902, size = 144 '\220'}, wild = {addr = 140487184951191, access_size = 140487181532416}}}}, function = 0xea281945ac4e8100 <error: Cannot access memory at address 0xea281945ac4e8100>}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, addr_description = {data = {kind = 3065905672, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 11016591115764, alloc_stack_id = 3065905672, free_stack_id = 32053, chunk_access = {bad_addr = 392, offset = 137669652643968, chunk_begin = 752, chunk_size = 140730930061320, user_requested_alignment = 2847, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 0, offset = 11016591115764, frame_pc = 137669652644360, access_size = 392, frame_descr = 0x7d35b6be0080 "\005\n"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 11016591115764, size_with_redzone = 137669652644360, name = 0x188 <error: Cannot access memory at address 0x188>, module_name = 0x7d35b6be0080 "\005\n", has_dynamic_init = 752, gcc_location = 0x7ffe79186008, odr_indicator = 140487183567647}, {beg = 1, size = 136913738547648, size_with_redzone = 140730930047360, name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", module_name = 0x3 <error: Cannot access memory at address 0x3>, has_dynamic_init = 131923050496, gcc_location = 0x7ffe79182160, odr_indicator = 2}, {beg = 140487184524816, size = 94763398530806, size_with_redzone = 140730930045456, name = 0x7 <error: Cannot access memory at address 0x7>, module_name = 0x7fc5b8c58fc0 <__asan::instance> "", has_dynamic_init = 136226544714016, gcc_location = 0x7ffe791821e0, odr_indicator = 140487184624998}, {beg = 140730930045504, size = 6, size_with_redzone = 140487185240000, name = 0x7c85b6c17530 "\003\021", module_name = 0x7ffe79182210 "\b", has_dynamic_init = 140487183591224, gcc_location = 0x78, odr_indicator = 136913738626352}}, reg_sites = {2031624704, 32766, 3086565742, 32709}, access_size = 0, size = 252 '\374'}, wild = {addr = 0, access_size = 0}}}}, size = 140730930047280}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, beg = 137669652644360, end = 0, old_mid = 0, new_mid = 11016591115764}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, storage_beg = 137669652644360, storage_end = 0, old_container_beg = 0, old_container_end = 11016591115764, new_container_beg = 137669652644360, new_container_end = 392}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, stack = 0x7ffe00000002, old_storage_beg = 137669652644360, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 11016591115764}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, global1 = {beg = 140728898420738, size = 137669652644360, size_with_redzone = 0, name = 0x0, module_name = 0xa05000005f4 <error: Cannot access memory at address 0xa05000005f4>, has_dynamic_init = 137669652644360, gcc_location = 0x188, odr_indicator = 137669652643968}, global2 = {beg = 752, size = 140730930061320, size_with_redzone = 140487183567647, name = 0x1 <error: Cannot access memory at address 0x1>, module_name = 0x7c85b6c041c0 "\200\a\276\2665}", has_dynamic_init = 140730930047360, gcc_location = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130>, odr_indicator = 3}, stack_id1 = 3074031616, stack_id2 = 30}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, pc = 140728898420738, bp = 137669652644360, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 11016591115764, kind = (unknown: 0x8), shadow_byte = 2 '\002'}, heap = {addr = 11016591115764, alloc_tid = 137669652644360, free_tid = 392, alloc_stack_id = 3065905280, free_stack_id = 32053, chunk_access = {bad_addr = 752, offset = 140730930061320, chunk_begin = 140487183567647, chunk_size = 1, user_requested_alignment = 448, access_type = 0, alloc_type = 1}}, stack = {addr = 11016591115764, tid = 137669652644360, offset = 392, frame_pc = 137669652643968, access_size = 752, frame_descr = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>}, global = {addr = 11016591115764, static kMaxGlobals = 4, globals = {{beg = 137669652644360, size = 392, size_with_redzone = 137669652643968, name = 0x2f0 <error: Cannot access memory at address 0x2f0>, module_name = 0x7ffe79186008 <error: Cannot access memory at address 0x7ffe79186008>, has_dynamic_init = 140487183567647, gcc_location = 0x1, odr_indicator = 136913738547648}, {beg = 140730930047360, size = 140487184524754, size_with_redzone = 3, name = 0x1eb73a0000 <error: Cannot access memory at address 0x1eb73a0000>, module_name = 0x7ffe79182160 "\020\246\272\270\305\177", has_dynamic_init = 2, gcc_location = 0x7fc5b8baa610 <___interceptor_malloc(__sanitizer::uptr)+192>, odr_indicator = 94763398530806}, {beg = 140730930045456, size = 7, size_with_redzone = 140487185240000, name = 0x7be5b6ce8120 "\003\021", module_name = 0x7ffe791821e0 "", has_dynamic_init = 140487184624998, gcc_location = 0x7ffe79182240, odr_indicator = 6}, {beg = 140487185240000, size = 136913738626352, size_with_redzone = 140730930045456, name = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x78 <error: Cannot access memory at address 0x78>, has_dynamic_init = 136913738626352, gcc_location = 0x7ffe79182200, odr_indicator = 140487171850606}}, reg_sites = {0, 0, 3534520060, 22063}, access_size = 140730930047280, size = 32 ' '}, wild = {addr = 11016591115764, access_size = 137669652644360}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140487184951191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140487184951191, alloc_tid = 140487181532416, free_tid = 140730930046928, alloc_stack_id = 3099027667, free_stack_id = 32709, chunk_access = {bad_addr = 140730930046928, offset = 3096402488, chunk_begin = 140730930047024, chunk_size = 140487181467222, user_requested_alignment = 384, access_type = 0, alloc_type = 0}}, stack = {addr = 140487184951191, tid = 140487181532416, offset = 140730930046928, frame_pc = 140487184312531, access_size = 140730930046928, frame_descr = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>}, global = {addr = 140487184951191, static kMaxGlobals = 4, globals = {{beg = 140487181532416, size = 140730930046928, size_with_redzone = 140487184312531, name = 0x7ffe791827d0 "\200\001\276\266\325|", module_name = 0xb88f5a38 <error: Cannot access memory at address 0xb88f5a38>, has_dynamic_init = 140730930047024, gcc_location = 0x7fc5b88bfe56, odr_indicator = 137257335783808}, {beg = 140487181467172, size = 140730930046976, size_with_redzone = 6866423646880, name = 0x21 <error: Cannot access memory at address 0x21>, module_name = 0x2ee7c224 <error: Cannot access memory at address 0x2ee7c224>, has_dynamic_init = 140730930047008, gcc_location = 0x7c25b6be0aa0, odr_indicator = 140730930047040}, {beg = 136913738626368, size = 137257335783808, size_with_redzone = 136363983054992, name = 0x562fd2ca87c0 <watch_destroy> "\363\017\036\372SH\211\373H\203\354\020H\205\377\017\2049\002", module_name = 0x7fc5b8924dce "I\211\305L9\360tJH\205\300tUH\213E\310dH+\004%(", has_dynamic_init = 136913738626368, gcc_location = 0x7fc5b8924dce, odr_indicator = 94763399940032}, {beg = 0, size = 140730930047136, size_with_redzone = 140487181880782, name = 0x7cc5b6be0c40 "\001", module_name = 0x7c05b6bf84d0 "\002", has_dynamic_init = 44, gcc_location = 0x0, odr_indicator = 136363982685400}}, reg_sites = {3066374312, 31749, 3066004720, 31749}, access_size = 94763399941902, size = 144 '\220'}, wild = {addr = 140487184951191, access_size = 140487181532416}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137669652644360, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137669652644360, tid = 0, offset = 0, frame_pc = 11016591115764, access_size = 137669652644360, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137669652644360, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11016591115764, name = 0x7d35b6be0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137669652643968, gcc_location = 0x2f0, odr_indicator = 140730930061320}, {beg = 140487183567647, size = 1, size_with_redzone = 136913738547648, name = 0x7ffe79182980 "0\002\227\322/V", module_name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eb73a0000, odr_indicator = 140730930045280}, {beg = 2, size = 140487184524816, size_with_redzone = 94763398530806, name = 0x7ffe79182210 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140487185240000, gcc_location = 0x7be5b6ce8120, odr_indicator = 140730930045408}, {beg = 140487184624998, size = 140730930045504, size_with_redzone = 6, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7c85b6c17530 "\003\021", has_dynamic_init = 140730930045456, gcc_location = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3066131760, 31877, 2031624704, 32766}, access_size = 140487171850606, size = 0 '\000'}, wild = {addr = 137669652644360, access_size = 0}}}}, pc = 94763397971708, bp = 140730930047280, sp = 140730930047264, access_size = 8, bug_descr = 0x7fc5b8c12797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\305{\000\000\377\000\000\000\000\000\000\000\240\367\331\322/V\000\000f-\274\270\305\177\000\000\240\035\030y\376\177\000\000\002\000\000\000\000\000\000\000\300\217\305\270\305\177\000\000\020\n\277\266E|\000\000p\035\030y\376\177\000\0008g\254\270\305\177\000\000^\000\000\000\000\000\000\000\020\n\277\266E|\000\000\320\000:\267\305\177\000\000\220\035\030y\376\177\000\000 \n\277\266E|\000\000q\000\000\000\000\000\000\000\000&\030y\376\177\000\000^\000\000\000\000\000\000\000\300%\030y\376\177\000\000\301\223\272\270\305\177\000\000\"\032\323\322/V\000\000\270\377\377\377"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137669652644360, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137669652644360, alloc_tid = 0, free_tid = 0, alloc_stack_id = 1524, free_stack_id = 2565, chunk_access = {bad_addr = 137669652644360, offset = 392, chunk_begin = 137669652643968, chunk_size = 752, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137669652644360, tid = 0, offset = 0, frame_pc = 11016591115764, access_size = 137669652644360, frame_descr = 0x188 <error: Cannot access memory at address 0x188>}, global = {addr = 137669652644360, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 11016591115764, name = 0x7d35b6be0208 "", module_name = 0x188 <error: Cannot access memory at address 0x188>, has_dynamic_init = 137669652643968, gcc_location = 0x2f0, odr_indicator = 140730930061320}, {beg = 140487183567647, size = 1, size_with_redzone = 136913738547648, name = 0x7ffe79182980 "0\002\227\322/V", module_name = 0x7fc5b8baa5d2 <___interceptor_malloc(__sanitizer::uptr)+130> "H\213U\350dH+\024%(", has_dynamic_init = 3, gcc_location = 0x1eb73a0000, odr_indicator = 140730930045280}, {beg = 2, size = 140487184524816, size_with_redzone = 94763398530806, name = 0x7ffe79182210 "\b", module_name = 0x7 <error: Cannot access memory at address 0x7>, has_dynamic_init = 140487185240000, gcc_location = 0x7be5b6ce8120, odr_indicator = 140730930045408}, {beg = 140487184624998, size = 140730930045504, size_with_redzone = 6, name = 0x7fc5b8c58fc0 <__asan::instance> "", module_name = 0x7c85b6c17530 "\003\021", has_dynamic_init = 140730930045456, gcc_location = 0x7fc5b8ac6738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 120}}, reg_sites = {3066131760, 31877, 2031624704, 32766}, access_size = 140487171850606, size = 0 '\000'}, wild = {addr = 137669652644360, access_size = 0}}}}, pc = 94763397971708, bp = 140730930047280, sp = 140730930047264, access_size = 8, bug_descr = 0x7fc5b8c12797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007fc5b8bb6f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140730930047280, sp=sp@entry=140730930047264, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007fc5b8bb83f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
bp = 140730930047280
pc = <optimized out>
local_stack = 140730930047392
sp = 140730930047264
#11 0x0000562fd2ac7efc in device_get_adapter (device=<optimized out>) at src/device.c:6917
No locals.
#12 0x0000562fd297026f in find_cig_session (data=0x7c85b6c0b9c0, match_data=0x7bc5b5a83fb0) at profiles/audio/bap.c:2500
session = 0x7c85b6c0b9c0
info = 0x7bc5b5a83fb0
#13 0x0000562fd2b4f0d1 in queue_find (queue=<optimized out>, function=function@entry=0x562fd2970230 <find_cig_session>, match_data=match_data@entry=0x7bc5b5a83fb0) at src/shared/queue.c:230
entry = 0x7be5b6c9ccf0
#14 0x0000562fd2976d34 in find_cig_enumerate (data=0x7c85b6c041c0) at profiles/audio/bap.c:2539
info = <optimized out>
#15 bap_update_cigs_cb (user_data=0x7c85b6c041c0) at profiles/audio/bap.c:2693
data = 0x7c85b6c041c0
cigs = <optimized out>
unset = <optimized out>
#16 0x00007fc5b88c2b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#17 0x00007fc5b88c41d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#18 0x00007fc5b88c4577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#19 0x0000562fd2caafe9 in mainloop_run () at src/shared/mainloop-glib.c:65
No locals.
#20 0x0000562fd2cab91b in mainloop_run_with_signal (func=func@entry=0x562fd2b10a30 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
data = 0x7bf5b6be3490
io = 0x7c05b6bf9b10
ret = <optimized out>
#21 0x0000562fd28292fb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
https://github.com/bluez/bluez/pull/2550
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire
2026-09-18 21:44 ` Luiz Augusto von Dentz
@ 2026-09-19 10:06 ` dt
0 siblings, 0 replies; 8+ messages in thread
From: dt @ 2026-09-19 10:06 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth@vger.kernel.org
The test waits for both Acquire replies before Release, and both Release replies before reacquiring (done.wait() in operation()). Only requests for the two distinct CIS paths run concurrently, matching the existing acquisition test.
Did you mean Releases on different CIS paths should also be serialized?
All three new resume variants passed CI. The failures were in the existing coordinated-set setup/teardown cases; I am tracking those separately.
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: [BlueZ,1/3] transport: Preserve Release on late BAP ready
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
` (2 preceding siblings ...)
2026-09-18 23:30 ` [BlueZ,1/3] transport: Preserve Release on late BAP ready bluez.test.bot
@ 2026-10-04 0:02 ` bluez.test.bot
2026-10-07 18:40 ` [PATCH BlueZ 1/3] " patchwork-bot+bluetooth
4 siblings, 0 replies; 8+ messages in thread
From: bluez.test.bot @ 2026-10-04 0:02 UTC (permalink / raw)
To: linux-bluetooth, derektern
[-- Attachment #1: Type: text/plain, Size: 697 bytes --]
This is an automated email and please do not reply to this email.
Dear Submitter,
This series was picked up by the CI more than 2 weeks ago and the pull
request created for it is still open, which means the series was never
applied to the tree.
Series: [BlueZ,1/3] transport: Preserve Release on late BAP ready
Pull Request: https://github.com/bluez/bluez/pull/2550
Created: 2026-09-18 22:25:01+00:00
The pull request has been closed and no further action is taken on this
series.
If the change should still be considered, it must be resent to the Linux
Bluetooth mailing list (linux-bluetooth@vger.kernel.org) so that it is
picked up again.
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
` (3 preceding siblings ...)
2026-10-04 0:02 ` bluez.test.bot
@ 2026-10-07 18:40 ` patchwork-bot+bluetooth
4 siblings, 0 replies; 8+ messages in thread
From: patchwork-bot+bluetooth @ 2026-10-07 18:40 UTC (permalink / raw)
To: dt; +Cc: luiz.dentz, linux-bluetooth
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Fri, 18 Sep 2026 20:21:51 +0000 you wrote:
> From: Derek Tern <1263187-dt@users.noreply.gitlab.freedesktop.org>
>
> A late stream-ready event can reach bap_resume_complete() after Release
> has queued Disable. It then replies to Release with an Acquire payload
> and drops the Disable request ID. Client disconnection can subsequently
> free the owner while the Disable callback still refers to it.
>
> [...]
Here is the summary with links:
- [BlueZ,1/3] transport: Preserve Release on late BAP ready
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=d852faf0b1d1
- [BlueZ,2/3] bap: Recreate stream IO after an early Enable
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=47f783ff5ba4
- [BlueZ,3/3] test: Cover BAP transport release and reacquire
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-10-07 18:40 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-18 20:21 [PATCH BlueZ 1/3] transport: Preserve Release on late BAP ready dt
2026-09-18 20:22 ` [PATCH BlueZ 2/3] bap: Recreate stream IO after an early Enable dt
2026-09-18 20:24 ` [PATCH BlueZ 3/3] test: Cover BAP transport release and reacquire dt
2026-09-18 21:44 ` Luiz Augusto von Dentz
2026-09-19 10:06 ` dt
2026-09-18 23:30 ` [BlueZ,1/3] transport: Preserve Release on late BAP ready bluez.test.bot
2026-10-04 0:02 ` bluez.test.bot
2026-10-07 18:40 ` [PATCH BlueZ 1/3] " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox