* [PATCH v3] avdtp: Fix use-after-free in connection_lost
@ 2026-11-04 7:32 Jinwang Li
2026-11-04 9:04 ` [v3] " bluez.test.bot
0 siblings, 1 reply; 2+ messages in thread
From: Jinwang Li @ 2026-11-04 7:32 UTC (permalink / raw)
To: linux-bluetooth
Cc: cheng.jiang, quic_chezhou, wei.deng, shuai.zhang, mengshi.wu,
jinwang.li, xiuzhuo.shang
A sink may start reverse discovery when processing a remote stream
configuration. If the signaling channel disconnects after the stream is
configured and discovery holds the last setup reference, stream cleanup
frees that setup before the pending discovery callback runs, causing a
use-after-free.
Complete discovery with the disconnect error before releasing streams
so the callback runs while its setup is still valid.
Assisted-by: Claude:claude-sonnet-5
---
Changes for V3:
- Update commit message.
- V2 link
https://lore.kernel.org/all/20261016071408.2961576-1-jinwang.li@oss.qualcomm.com/
Changes for V2:
- Rebased the patch.
- V1 link
https://lore.kernel.org/all/20260807095809.2584501-1-jinwang.li@oss.qualcomm.com/
profiles/audio/avdtp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
index 30f80a0c2..5ebc0c5cc 100644
--- a/profiles/audio/avdtp.c
+++ b/profiles/audio/avdtp.c
@@ -1159,11 +1159,11 @@ static void connection_lost(struct avdtp *session, int err)
ba2str(device_get_address(session->device), address);
DBG("Disconnected from %s", address);
+ finalize_discovery(session, err);
+
g_slist_foreach(session->streams, (GFunc) release_stream, session);
session->streams = NULL;
- finalize_discovery(session, err);
-
avdtp_set_state(session, AVDTP_SESSION_STATE_DISCONNECTED);
avdtp_unref(session);
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [v3] avdtp: Fix use-after-free in connection_lost
2026-11-04 7:32 [PATCH v3] avdtp: Fix use-after-free in connection_lost Jinwang Li
@ 2026-11-04 9:04 ` bluez.test.bot
0 siblings, 0 replies; 2+ messages in thread
From: bluez.test.bot @ 2026-11-04 9:04 UTC (permalink / raw)
To: linux-bluetooth, jinwang.li
[-- Attachment #1: Type: text/plain, Size: 54977 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1201415/
---Test result---
Test Summary:
CheckPatch PASS 1.53 seconds
GitLint PASS 1.28 seconds
BuildEll PASS 20.57 seconds
BluezMake PASS 311.79 seconds
MakeCheck PASS 3.50 seconds
MakeDistcheck PASS 146.85 seconds
CheckValgrind PASS 158.52 seconds
CheckSmatch PASS 299.56 seconds
bluezmakeextell PASS 100.26 seconds
TestFunctional FAIL 1216.28 seconds
IncrementalBuild PASS 309.68 seconds
ScanBuild PASS 1159.26 seconds
Details
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bearer::test_bearer_le_conn_update[hosts14-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts14.1-bluetoothd-1793781362-188.core
/usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
[New LWP 188]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
Thread 1 (Thread 0x7f690f5da900 (LWP 188)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {4412750543122677053}}
ret = <optimized out>
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
No locals.
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
No locals.
#3 0x00007f690fd35b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#4 0x00007f690fd188ec in __GI_abort () at ./stdlib/abort.c:77
act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140728754406064, 140728754406352, 140728754406208, 22, 140089210706896, 0, 140728754406144, 140089227552278, 140089202057216, 4096, 0, 15361662896003236096, 140089200934936}}, sa_flags = 285609984, sa_restorer = 0x16}
#5 0x00007f6910940a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
No locals.
#6 0x00007f6910a66c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
No locals.
#7 0x00007f6910a3b93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffdf76a8476) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7b69098aa000 '=' <repeats 65 times>, "\n==188==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c790eae1720 at pc 0x55e78a2e37dd bp 0x7ffdf76a90f0 sp 0x7ffdf76a90e0"..., capacity_bytes_ = 8192, size_ = 4282}, <No data fields>}}
buffer_copy = <optimized out>
l = <optimized out>
#8 0x00007f6910a3ae02 in __asan::ReportGenericError (pc=94452944091101, bp=140728754409712, sp=sp@entry=140728754409696, addr=136859379177248, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, signal = {siginfo = 0xd52f970300000002, context = 0x7c790eae1720, addr = 0, pc = 0, sp = 6146098201032, bp = 136859379177248, is_memory_access = 96, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 192}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, second_free_stack = 0xd52f970300000002, addr_description = {addr = 136859379177248, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1431, chunk_access = {bad_addr = 136859379177248, offset = 96, chunk_begin = 136859379177152, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xd52f970300000002, addr_description = {addr = 136859379177248, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1431, chunk_access = {bad_addr = 136859379177248, offset = 96, chunk_begin = 136859379177152, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140089197877648, delete_alignment = 140728754407808}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xd52f970300000002, addr_description = {data = {kind = 246290208, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6146098201032, alloc_stack_id = 246290208, free_stack_id = 31865, chunk_access = {bad_addr = 96, offset = 136859379177152, chunk_begin = 232, chunk_size = 140724603478024, user_requested_alignment = 2448, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6146098201032, frame_pc = 136859379177248, access_size = 96, frame_descr = 0x7c790eae16c0 "\227\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6146098201032, size_with_redzone = 136859379177248, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7c790eae16c0 "\227\005", has_dynamic_init = 232, gcc_location = 0x7ffd00006008, odr_indicator = 140089197877648}, {beg = 140728754407808, size = 2, size_with_redzone = 140089228120000, name = 0x7c490eae0b90 "\003\021", module_name = 0x7ffdf76a8950 "\240\221j\367\375\177", has_dynamic_init = 140089226471224, gcc_location = 0x98, odr_indicator = 136653220744080}, {beg = 140089202196688, size = 140728754407792, size_with_redzone = 136653220744096, name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 135691128131616, gcc_location = 0x7ffdf76a91a0, odr_indicator = 140089227400129}, {beg = 140728754407792, size = 129116202626, size_with_redzone = 140728754407808, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7f6910a2d400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94452943039240, gcc_location = 0x7ffdf76a9180, odr_indicator = 140728754409616}}, reg_sites = {267390432, 32617, 266214243, 32617}, access_size = 1, size = 221 '\335'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, dealloc_stack = 0xd52f970300000002, alloc_type = 246290208, dealloc_type = 31865, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xc8), shadow_byte = 1 '\001'}, heap = {addr = 0, alloc_tid = 6146098201032, free_tid = 136859379177248, alloc_stack_id = 96, free_stack_id = 0, chunk_access = {bad_addr = 136859379177152, offset = 232, chunk_begin = 140724603478024, chunk_size = 140089197877648, user_requested_alignment = 2432, access_type = 0, alloc_type = 2}}, stack = {addr = 0, tid = 6146098201032, offset = 136859379177248, frame_pc = 96, access_size = 136859379177152, frame_descr = 0xe8 <error: Cannot access memory at address 0xe8>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 6146098201032, size = 136859379177248, size_with_redzone = 96, name = 0x7c790eae16c0 "\227\005", module_name = 0xe8 <error: Cannot access memory at address 0xe8>, has_dynamic_init = 140724603478024, gcc_location = 0x7f690ee05990, odr_indicator = 140728754407808}, {beg = 2, size = 140089228120000, size_with_redzone = 136653220744080, name = 0x7ffdf76a8950 "\240\221j\367\375\177", module_name = 0x7f691094a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 152, gcc_location = 0x7c490eae0b90, odr_indicator = 140089202196688}, {beg = 140728754407792, size = 136653220744096, size_with_redzone = 94452943127056, name = 0x7ffdf76a9280 "", module_name = 0x7b690d7dd020 "", has_dynamic_init = 140728754409888, gcc_location = 0x7f6910a2d3c1 <___interceptor_free(void*)+113>, odr_indicator = 140728754407792}, {beg = 129116202626, size = 140728754407808, size_with_redzone = 2, name = 0x7f6910a2d400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", module_name = 0x55e78a1e2b08 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", has_dynamic_init = 140728754409856, gcc_location = 0x7ffdf76a9090, odr_indicator = 140089215684064}}, reg_sites = {266214243, 32617, 1, 0}, access_size = 94452944091101, size = 240 '\360'}, wild = {addr = 0, access_size = 6146098201032}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, addr_description = {data = {kind = 246290208, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6146098201032, alloc_stack_id = 246290208, free_stack_id = 31865, chunk_access = {bad_addr = 96, offset = 136859379177152, chunk_begin = 232, chunk_size = 140724603478024, user_requested_alignment = 2448, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6146098201032, frame_pc = 136859379177248, access_size = 96, frame_descr = 0x7c790eae16c0 "\227\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6146098201032, size_with_redzone = 136859379177248, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7c790eae16c0 "\227\005", has_dynamic_init = 232, gcc_location = 0x7ffd00006008, odr_indicator = 140089197877648}, {beg = 140728754407808, size = 2, size_with_redzone = 140089228120000, name = 0x7c490eae0b90 "\003\021", module_name = 0x7ffdf76a8950 "\240\221j\367\375\177", has_dynamic_init = 140089226471224, gcc_location = 0x98, odr_indicator = 136653220744080}, {beg = 140089202196688, size = 140728754407792, size_with_redzone = 136653220744096, name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 135691128131616, gcc_location = 0x7ffdf76a91a0, odr_indicator = 140089227400129}, {beg = 140728754407792, size = 129116202626, size_with_redzone = 140728754407808, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7f6910a2d400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94452943039240, gcc_location = 0x7ffdf76a9180, odr_indicator = 140728754409616}}, reg_sites = {267390432, 32617, 266214243, 32617}, access_size = 1, size = 221 '\335'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, addr_description = {data = {kind = 246290208, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6146098201032, alloc_stack_id = 246290208, free_stack_id = 31865, chunk_access = {bad_addr = 96, offset = 136859379177152, chunk_begin = 232, chunk_size = 140724603478024, user_requested_alignment = 2448, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6146098201032, frame_pc = 136859379177248, access_size = 96, frame_descr = 0x7c790eae16c0 "\227\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6146098201032, size_with_redzone = 136859379177248, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7c790eae16c0 "\227\005", has_dynamic_init = 232, gcc_location = 0x7ffd00006008, odr_indicator = 140089197877648}, {beg = 140728754407808, size = 2, size_with_redzone = 140089228120000, name = 0x7c490eae0b90 "\003\021", module_name = 0x7ffdf76a8950 "\240\221j\367\375\177", has_dynamic_init = 140089226471224, gcc_location = 0x98, odr_indicator = 136653220744080}, {beg = 140089202196688, size = 140728754407792, size_with_redzone = 136653220744096, name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 135691128131616, gcc_location = 0x7ffdf76a91a0, odr_indicator = 140089227400129}, {beg = 140728754407792, size = 129116202626, size_with_redzone = 140728754407808, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7f6910a2d400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94452943039240, gcc_location = 0x7ffdf76a9180, odr_indicator = 140728754409616}}, reg_sites = {267390432, 32617, 266214243, 32617}, access_size = 1, size = 221 '\335'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, count = 136859379177248, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, count = 136859379177248, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, size = 136859379177248}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, alignment = 136859379177248}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, size = 136859379177248, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, alignment = 136859379177248}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, user_size = 136859379177248, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, requested_size = 136859379177248}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, length1 = 136859379177248, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6146098201032, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6146098201032, alloc_tid = 136859379177248, free_tid = 96, alloc_stack_id = 246290112, free_stack_id = 31865, chunk_access = {bad_addr = 232, offset = 140724603478024, chunk_begin = 140089197877648, chunk_size = 140728754407808, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6146098201032, tid = 136859379177248, offset = 96, frame_pc = 136859379177152, access_size = 232, frame_descr = 0x7ffd00006008 <error: Cannot access memory at address 0x7ffd00006008>}, global = {addr = 6146098201032, static kMaxGlobals = 4, globals = {{beg = 136859379177248, size = 96, size_with_redzone = 136859379177152, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffd00006008 <error: Cannot access memory at address 0x7ffd00006008>, has_dynamic_init = 140089197877648, gcc_location = 0x7ffdf76a8980, odr_indicator = 2}, {beg = 140089228120000, size = 136653220744080, size_with_redzone = 140728754407760, name = 0x7f691094a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x98 <error: Cannot access memory at address 0x98>, has_dynamic_init = 136653220744080, gcc_location = 0x7f690f2240d0, odr_indicator = 140728754407792}, {beg = 136653220744096, size = 94452943127056, size_with_redzone = 140728754410112, name = 0x7b690d7dd020 "", module_name = 0x7ffdf76a91a0 "\200\t\256\016\331|", has_dynamic_init = 140089227400129, gcc_location = 0x7ffdf76a8970, odr_indicator = 129116202626}, {beg = 140728754407808, size = 2, size_with_redzone = 140089227400192, name = 0x55e78a1e2b08 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffdf76a9180 " \320}\ri{", has_dynamic_init = 140728754409616, gcc_location = 0x7f690ff00de0 <_nl_C_locobj>, odr_indicator = 140089214507875}}, reg_sites = {1, 0, 2318284765, 21991}, access_size = 140728754409712, size = 224 '\340'}, wild = {addr = 6146098201032, access_size = 136859379177248}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140089227831191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140089227831191, alloc_tid = 140728754437376, free_tid = 140728754409352, alloc_stack_id = 2878488832, free_stack_id = 3576665859, chunk_access = {bad_addr = 140728754409552, offset = 140089227661181, chunk_begin = 136172184425752, chunk_size = 140089228095352, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140089227831191, tid = 140728754437376, offset = 140728754409352, frame_pc = 15361662896003236096, access_size = 140728754409552, frame_descr = 0x7f6910a6cf7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140089227831191, static kMaxGlobals = 4, globals = {{beg = 140728754437376, size = 140728754409352, size_with_redzone = 15361662896003236096, name = 0x7ffdf76a9050 "H\024\256\016i|", module_name = 0x7f6910a6cf7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136172184425752, gcc_location = 0x7f6910ad6f78, odr_indicator = 65535}, {beg = 15361662896003236096, size = 140089206089912, size_with_redzone = 140089228095352, name = 0x7bc90eae7fd0 "", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 136103464959904, gcc_location = 0x7bc90eae7fc8, odr_indicator = 136103464959952}, {beg = 94452944015524, size = 64, size_with_redzone = 16961391016452, name = 0x7be90eae1620 "@\024\256\016i|", module_name = 0x7b690d7dd0c0 "\0166\340E", has_dynamic_init = 135828587102576, gcc_location = 0x55e78a2db062 <bt_att_chan_cancel+402>, odr_indicator = 10}, {beg = 136103464959952, size = 10, size_with_redzone = 94452944057128, name = 0x7c690eae1440 "", module_name = 0x7b690d7dd120 "", has_dynamic_init = 16961391016472, gcc_location = 0x7ffdf76a9060, odr_indicator = 136790659699784}}, reg_sites = {4150956672, 32765, 257796280, 32617}, access_size = 136515781791744, size = 144 '\220'}, wild = {addr = 140089227831191, access_size = 140728754437376}}}}, function = 0x7f6910a05359 <___interceptor___tls_get_addr(void*)+89> "L\211\360H\213]\360L\213u\370\311\303f.\017\037\204"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, addr_description = {data = {kind = 246290208, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6146098201032, alloc_stack_id = 246290208, free_stack_id = 31865, chunk_access = {bad_addr = 96, offset = 136859379177152, chunk_begin = 232, chunk_size = 140724603478024, user_requested_alignment = 2448, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6146098201032, frame_pc = 136859379177248, access_size = 96, frame_descr = 0x7c790eae16c0 "\227\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6146098201032, size_with_redzone = 136859379177248, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7c790eae16c0 "\227\005", has_dynamic_init = 232, gcc_location = 0x7ffd00006008, odr_indicator = 140089197877648}, {beg = 140728754407808, size = 2, size_with_redzone = 140089228120000, name = 0x7c490eae0b90 "\003\021", module_name = 0x7ffdf76a8950 "\240\221j\367\375\177", has_dynamic_init = 140089226471224, gcc_location = 0x98, odr_indicator = 136653220744080}, {beg = 140089202196688, size = 140728754407792, size_with_redzone = 136653220744096, name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 135691128131616, gcc_location = 0x7ffdf76a91a0, odr_indicator = 140089227400129}, {beg = 140728754407792, size = 129116202626, size_with_redzone = 140728754407808, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7f6910a2d400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94452943039240, gcc_location = 0x7ffdf76a9180, odr_indicator = 140728754409616}}, reg_sites = {267390432, 32617, 266214243, 32617}, access_size = 1, size = 221 '\335'}, wild = {addr = 0, access_size = 0}}}}, size = 140728754409712}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, beg = 136859379177248, end = 0, old_mid = 0, new_mid = 6146098201032}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, storage_beg = 136859379177248, storage_end = 0, old_container_beg = 0, old_container_end = 6146098201032, new_container_beg = 136859379177248, new_container_end = 96}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, stack = 0xd52f970300000002, old_storage_beg = 136859379177248, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 6146098201032}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, global1 = {beg = 15361662893124747266, size = 136859379177248, size_with_redzone = 0, name = 0x0, module_name = 0x597000001c8 <error: Cannot access memory at address 0x597000001c8>, has_dynamic_init = 136859379177248, gcc_location = 0x60, odr_indicator = 136859379177152}, global2 = {beg = 232, size = 140724603478024, size_with_redzone = 140089197877648, name = 0x7ffdf76a8980 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140089228120000, gcc_location = 0x7c490eae0b90, odr_indicator = 140728754407760}, stack_id1 = 278177592, stack_id2 = 32617}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, pc = 15361662893124747266, bp = 136859379177248, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6146098201032, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6146098201032, alloc_tid = 136859379177248, free_tid = 96, alloc_stack_id = 246290112, free_stack_id = 31865, chunk_access = {bad_addr = 232, offset = 140724603478024, chunk_begin = 140089197877648, chunk_size = 140728754407808, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6146098201032, tid = 136859379177248, offset = 96, frame_pc = 136859379177152, access_size = 232, frame_descr = 0x7ffd00006008 <error: Cannot access memory at address 0x7ffd00006008>}, global = {addr = 6146098201032, static kMaxGlobals = 4, globals = {{beg = 136859379177248, size = 96, size_with_redzone = 136859379177152, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffd00006008 <error: Cannot access memory at address 0x7ffd00006008>, has_dynamic_init = 140089197877648, gcc_location = 0x7ffdf76a8980, odr_indicator = 2}, {beg = 140089228120000, size = 136653220744080, size_with_redzone = 140728754407760, name = 0x7f691094a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0x98 <error: Cannot access memory at address 0x98>, has_dynamic_init = 136653220744080, gcc_location = 0x7f690f2240d0, odr_indicator = 140728754407792}, {beg = 136653220744096, size = 94452943127056, size_with_redzone = 140728754410112, name = 0x7b690d7dd020 "", module_name = 0x7ffdf76a91a0 "\200\t\256\016\331|", has_dynamic_init = 140089227400129, gcc_location = 0x7ffdf76a8970, odr_indicator = 129116202626}, {beg = 140728754407808, size = 2, size_with_redzone = 140089227400192, name = 0x55e78a1e2b08 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffdf76a9180 " \320}\ri{", has_dynamic_init = 140728754409616, gcc_location = 0x7f690ff00de0 <_nl_C_locobj>, odr_indicator = 140089214507875}}, reg_sites = {1, 0, 2318284765, 21991}, access_size = 140728754409712, size = 224 '\340'}, wild = {addr = 6146098201032, access_size = 136859379177248}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140089227831191, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140089227831191, alloc_tid = 140728754437376, free_tid = 140728754409352, alloc_stack_id = 2878488832, free_stack_id = 3576665859, chunk_access = {bad_addr = 140728754409552, offset = 140089227661181, chunk_begin = 136172184425752, chunk_size = 140089228095352, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140089227831191, tid = 140728754437376, offset = 140728754409352, frame_pc = 15361662896003236096, access_size = 140728754409552, frame_descr = 0x7f6910a6cf7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140089227831191, static kMaxGlobals = 4, globals = {{beg = 140728754437376, size = 140728754409352, size_with_redzone = 15361662896003236096, name = 0x7ffdf76a9050 "H\024\256\016i|", module_name = 0x7f6910a6cf7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136172184425752, gcc_location = 0x7f6910ad6f78, odr_indicator = 65535}, {beg = 15361662896003236096, size = 140089206089912, size_with_redzone = 140089228095352, name = 0x7bc90eae7fd0 "", module_name = 0x7ffdf76a9280 "", has_dynamic_init = 136103464959904, gcc_location = 0x7bc90eae7fc8, odr_indicator = 136103464959952}, {beg = 94452944015524, size = 64, size_with_redzone = 16961391016452, name = 0x7be90eae1620 "@\024\256\016i|", module_name = 0x7b690d7dd0c0 "\0166\340E", has_dynamic_init = 135828587102576, gcc_location = 0x55e78a2db062 <bt_att_chan_cancel+402>, odr_indicator = 10}, {beg = 136103464959952, size = 10, size_with_redzone = 94452944057128, name = 0x7c690eae1440 "", module_name = 0x7b690d7dd120 "", has_dynamic_init = 16961391016472, gcc_location = 0x7ffdf76a9060, odr_indicator = 136790659699784}}, reg_sites = {4150956672, 32765, 257796280, 32617}, access_size = 136515781791744, size = 144 '\220'}, wild = {addr = 140089227831191, access_size = 140728754437376}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136859379177248, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136859379177248, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1431, chunk_access = {bad_addr = 136859379177248, offset = 96, chunk_begin = 136859379177152, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136859379177248, tid = 0, offset = 0, frame_pc = 6146098201032, access_size = 136859379177248, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 136859379177248, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6146098201032, name = 0x7c790eae1720 "\240\025\256\016\351{", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 136859379177152, gcc_location = 0xe8, odr_indicator = 140724603478024}, {beg = 140089197877648, size = 140728754407808, size_with_redzone = 2, name = 0x7f6910adcfc0 <__asan::instance> "", module_name = 0x7c490eae0b90 "\003\021", has_dynamic_init = 140728754407760, gcc_location = 0x7f691094a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 152}, {beg = 136653220744080, size = 140089202196688, size_with_redzone = 140728754407792, name = 0x7c490eae0ba0 "\231\005", module_name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140728754410112, gcc_location = 0x7b690d7dd020, odr_indicator = 140728754409888}, {beg = 140089227400129, size = 140728754407792, size_with_redzone = 129116202626, name = 0x7ffdf76a8980 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140089227400192, gcc_location = 0x55e78a1e2b08 <gatt_server_cleanup+200>, odr_indicator = 140728754409856}}, reg_sites = {4150956176, 32765, 267390432, 32617}, access_size = 140089214507875, size = 1 '\001'}, wild = {addr = 136859379177248, access_size = 0}}}}, pc = 94452944091101, bp = 140728754409712, sp = 140728754409696, access_size = 8, bug_descr = 0x7f6910a96797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000}\017\000\000\305l\244\020i\177\000\000`\200\256\016\311{\000\000:\000\000\000\000\000\000\000@\200\256\016\311{\000\000P\200\256\016\311{\000\000`\205j\367\375\177\000\000\005\314\230\020i\177\000\000\020\346\242\020i\177\000\000\000@\"\017i\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000\347\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\256\016\311{\000\000\240\205j\367\375\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000\260\352\366\375\177\000\000:\000\000\000\000\000\000\000\240L\217\ri{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 136859379177248, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 136859379177248, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1431, chunk_access = {bad_addr = 136859379177248, offset = 96, chunk_begin = 136859379177152, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 136859379177248, tid = 0, offset = 0, frame_pc = 6146098201032, access_size = 136859379177248, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 136859379177248, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6146098201032, name = 0x7c790eae1720 "\240\025\256\016\351{", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 136859379177152, gcc_location = 0xe8, odr_indicator = 140724603478024}, {beg = 140089197877648, size = 140728754407808, size_with_redzone = 2, name = 0x7f6910adcfc0 <__asan::instance> "", module_name = 0x7c490eae0b90 "\003\021", has_dynamic_init = 140728754407760, gcc_location = 0x7f691094a738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 152}, {beg = 136653220744080, size = 140089202196688, size_with_redzone = 140728754407792, name = 0x7c490eae0ba0 "\231\005", module_name = 0x55e78a1f8210 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140728754410112, gcc_location = 0x7b690d7dd020, odr_indicator = 140728754409888}, {beg = 140089227400129, size = 140728754407792, size_with_redzone = 129116202626, name = 0x7ffdf76a8980 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140089227400192, gcc_location = 0x55e78a1e2b08 <gatt_server_cleanup+200>, odr_indicator = 140728754409856}}, reg_sites = {4150956176, 32765, 267390432, 32617}, access_size = 140089214507875, size = 1 '\001'}, wild = {addr = 136859379177248, access_size = 0}}}}, pc = 94452944091101, bp = 140728754409712, sp = 140728754409696, access_size = 8, bug_descr = 0x7f6910a96797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
#9 0x00007f6910a3af8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140728754409712, sp=sp@entry=140728754409696, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
in_report = <optimized out>
error = <optimized out>
enable_fp = <optimized out>
#10 0x00007f6910a3c3f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
bp = 140728754409712
pc = <optimized out>
local_stack = 140728754410112
sp = 140728754409696
#11 0x000055e78a2e37dd in discovery_op_free (op=0x7be90eae16a0) at src/shared/gatt-client.c:407
No locals.
#12 0x000055e78a40cdaa in bt_gatt_request_unref (req=0x7be90eae20a0) at src/shared/gatt-helpers.c:577
No locals.
#13 bt_gatt_request_unref (req=0x7be90eae20a0) at src/shared/gatt-helpers.c:566
No locals.
#14 0x000055e78a2d10a4 in cancel_att_send_op (data=0x7bc90eae7fa0) at src/shared/att.c:226
op = 0x7bc90eae7fa0
#15 0x000055e78a2dbde9 in bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1951
chan = 0x7be90eae1620
entry = 0x7b890eaf4170
#16 bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1932
entry = <optimized out>
chan = <optimized out>
#17 0x000055e78a2dcbd0 in bt_att_unref (att=0x7c690eae1440) at src/shared/att.c:1350
No locals.
#18 bt_att_unref (att=0x7c690eae1440) at src/shared/att.c:1341
No locals.
#19 0x000055e78a1f7e7f in attio_cleanup (device=device@entry=0x7cd90eae0780) at src/device.c:873
No locals.
#20 0x000055e78a1f83b7 in device_free (user_data=0x7cd90eae0780) at src/device.c:918
device = 0x7cd90eae0780
__func__ = "device_free"
#21 0x000055e78a2790da in remove_interface (data=0x7bd90eae5500, name=name@entry=0x55e78a49a740 "org.bluez.Device1") at gdbus/object.c:742
iface = 0x7bc90eae6260
#22 0x000055e78a27bc9c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
data = <optimized out>
#23 0x000055e78a1ae01b in remove_temporary_devices (adapter=adapter@entry=0x7c990eae0200) at src/adapter.c:826
dev = 0x7cd90eae0780
l = <optimized out>
next = 0x0
#24 0x000055e78a1af37a in adapter_shutdown () at src/adapter.c:11503
adapter = 0x7c990eae0200
list = 0x7b990eae38e0 = {0x7c990eae0200}
__func__ = "adapter_shutdown"
#25 0x000055e78a24fdac in signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1485
terminated = false
#26 signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1472
terminated = false
#27 0x000055e78a40133e in signal_read (io=<optimized out>, user_data=0x7b990eae3490) at src/shared/mainloop-notify.c:145
data = <optimized out>
si = <optimized out>
result = <optimized out>
fd = <optimized out>
#28 0x000055e78a3fe235 in watch_callback (channel=<optimized out>, cond=<optimized out>, user_data=<optimized out>) at src/shared/io-glib.c:173
watch = <optimized out>
result = <optimized out>
destroy = <optimized out>
#29 0x00007f6910746b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#30 0x00007f69107481d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#31 0x00007f6910748577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#32 0x000055e78a401199 in mainloop_run () at src/shared/mainloop-glib.c:65
No locals.
#33 0x000055e78a401acb in mainloop_run_with_signal (func=func@entry=0x55e78a24fd30 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
data = 0x7b990eae3490
io = 0x7ba90eaf9510
ret = <optimized out>
#34 0x000055e789f8121b in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1713
context = <optimized out>
err = <optimized out>
sdp_mtu = 0
sdp_flags = <optimized out>
gdbus_flags = <optimized out>
__func__ = "main""
https://github.com/bluez/bluez/pull/2758
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-04 9:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-04 7:32 [PATCH v3] avdtp: Fix use-after-free in connection_lost Jinwang Li
2026-11-04 9:04 ` [v3] " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox