[PATCH BlueZ v1 0/8] Fix handling of malformed GATT PDUs

[PATCH BlueZ v1 0/8] Fix handling of malformed GATT PDUs

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes several places where GATT PDUs received from the peer are
used without proper validation:

 - Read By Type responses with an invalid Attribute Data Length could
   cause a division by zero and out-of-bounds reads during discovery.
 - Notifications and indications shorter than a handle wrapped the
   value length to 65534, passing data past the received buffer to the
   registered handlers.
 - Read Multiple Variable Length opcodes were missing from the ATT
   tables, so the server never responded to the request, and the
   client response parser did not advance past each value.
 - Database Hash and Extended Properties values were read without
   checking their length.

The Read By Type, notification and Read Multiple Variable Length fixes
come with unit tests reproducing the problem.

Luiz Augusto von Dentz (8):
  shared/gatt: Validate Read By Type responses
  unit/test-gatt: Add malformed Read By Type response tests
  shared/gatt-client: Fix handling of short notifications
  unit/test-gatt: Add short notification test
  shared/att: Add Read Multiple Variable Length opcodes
  shared/gatt-client: Fix parsing Read Multiple Variable Length response
  shared/gatt-client: Check value lengths before reading them
  unit/test-gatt: Add Read Multiple Variable Length tests

 src/shared/att.c          |   3 +
 src/shared/gatt-client.c  |  23 +++-
 src/shared/gatt-helpers.c |   7 +-
 unit/test-gatt.c          | 258 +++++++++++++++++++++++++++++++++++++-
 4 files changed, 278 insertions(+), 13 deletions(-)

-- 
2.56.0

[PATCH BlueZ v1 1/8] shared/gatt: Validate Read By Type responses

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

read_by_type_cb used the peer-provided Attribute Data Length without
validation, causing a division by zero when it was 0 and out-of-bounds
reads when it was shorter than a handle or the PDU itself. Reject such
responses as the other discovery handlers do.

Also check the iterator result and value length before reading the
Server Features value.

Closes: https://github.com/bluez/bluez/issues/2746
Fixes: d21412b96048 ("shared/gatt: Implement "Characteristic Discovery" procedures.")
Fixes: 76d63c91b27a ("shared/gatt-client: Add support for EATT features")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c  | 6 ++++--
 src/shared/gatt-helpers.c | 7 ++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 836a59a8c990..09bd9c971ee5 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1565,8 +1565,10 @@ static void db_server_feat_read(bool success, uint8_t att_ecode,
 	if (!result)
 		return;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+						&len, &value) || !len)
+		return;
 
 	DBG(client, "Server Features found: handle 0x%04x "
 				"length 0x%04x value 0x%02x", handle, len,
diff --git a/src/shared/gatt-helpers.c b/src/shared/gatt-helpers.c
index b3d5d8f1a483..e3281ec17758 100644
--- a/src/shared/gatt-helpers.c
+++ b/src/shared/gatt-helpers.c
@@ -1299,14 +1299,15 @@ static void read_by_type_cb(uint8_t opcode, const void *pdu,
 		goto done;
 	}
 
-	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu) {
+	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu || length < 3) {
 		success = false;
 		att_ecode = 0;
 		goto done;
 	}
 
-	data_length = ((uint8_t *) pdu)[0];
-	if (((length - 1) % data_length)) {
+	data_length = ((const uint8_t *) pdu)[0];
+	if (data_length < 2 || data_length > length - 1U ||
+					(length - 1) % data_length) {
 		success = false;
 		att_ecode = 0;
 		goto done;
-- 
2.56.0

[PATCH BlueZ v1 2/8] unit/test-gatt: Add malformed Read By Type response tests

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add tests for Read By Type responses with invalid Attribute Data Length,
truncated data, empty values and an empty Server Features value.

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index 6d6d0c73ed40..26768e1aca82 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -2064,6 +2064,18 @@ static const struct test_step test_read_by_type_6 = {
 	.expected_att_ecode = 0x0c,
 };
 
+static const struct test_step test_read_by_type_malformed = {
+	.handle = 0x0001,
+	.end_handle = 0xffff,
+};
+
+static const struct test_step test_read_by_type_empty = {
+	.handle = 0x0001,
+	.end_handle = 0xffff,
+	.expected_att_ecode = 0x0a,
+	.value = read_data_1,
+};
+
 static void multiple_read_cb(bool success, uint8_t att_ecode,
 					const uint8_t *value, uint16_t length,
 					void *user_data)
@@ -2146,6 +2158,7 @@ static void read_by_type_cb(bool success, uint8_t att_ecode,
 	struct bt_gatt_iter iter;
 
 	g_assert(att_ecode == step->expected_att_ecode);
+	g_assert(success == !!step->value);
 
 	if (success) {
 		uint16_t length, handle;
@@ -2957,6 +2970,81 @@ int main(int argc, char *argv[])
 			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
 			raw_pdu(0x01, 0x08, 0x0b, 0x00, 0x0c));
 
+	define_test_att("/read-by-type/zero-data-length", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x00, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/short-data-length", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x01, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/missing-data", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x12));
+
+	define_test_att("/read-by-type/short-handle", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x02, 0x0a));
+
+	define_test_att("/read-by-type/oversized-data-length",
+			test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x04, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/truncated-data", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x03, 0x0a, 0x00, 0x01, 0x0b));
+
+	define_test_att("/read-by-type/empty-value", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_empty,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x02, 0x0a, 0x00),
+			raw_pdu(0x08, 0x0b, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x01, 0x08, 0x0b, 0x00, 0x0a));
+
+	define_test_client("/read-by-type/empty-server-features", test_client,
+			service_db_1, NULL,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x3a, 0x2b),
+			raw_pdu(0x09, 0x02, 0xff, 0xff),
+			raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x11, 0x06, 0x01, 0x00, 0x04, 0x00, 0x01,
+					0x18),
+			raw_pdu(0x10, 0x05, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x11, 0x06, 0x05, 0x00, 0x08, 0x00, 0x0d,
+					0x18),
+			raw_pdu(0x10, 0x09, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x01, 0x10, 0x09, 0x00, 0x0a),
+			raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),
+			raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),
+			raw_pdu(0x08, 0x01, 0x00, 0x08, 0x00, 0x02, 0x28),
+			raw_pdu(0x01, 0x08, 0x01, 0x00, 0x0a),
+			raw_pdu(0x08, 0x01, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x09, 0x07, 0x02, 0x00, 0x02, 0x03, 0x00,
+					0x00, 0x2a),
+			raw_pdu(0x08, 0x03, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x09, 0x07, 0x06, 0x00, 0x0a, 0x07, 0x00,
+					0x29, 0x2a),
+			raw_pdu(0x08, 0x07, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x01, 0x08, 0x07, 0x00, 0x0a),
+			raw_pdu(0x04, 0x04, 0x00, 0x04, 0x00),
+			raw_pdu(0x05, 0x01, 0x04, 0x00, 0x01, 0x29),
+			raw_pdu(0x04, 0x08, 0x00, 0x08, 0x00),
+			raw_pdu(0x05, 0x01, 0x08, 0x00, 0x01, 0x29));
+
 	define_test_server("/TP/GAR/SR/BV-03-C/small", test_server, ts_small_db,
 			NULL,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

[PATCH BlueZ v1 3/8] shared/gatt-client: Fix handling of short notifications

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A Handle Value Notification or Indication shorter than a handle made
notify_cb read the handle past the PDU and wrap the value length to
65534, passing a value larger than the received buffer to the
registered handlers. Ignore such PDUs.

Fixes: 151582e6a343 ("shared/gatt-client: Handle incoming not/ind PDUs.")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 09bd9c971ee5..2b6da611b9f1 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2299,6 +2299,9 @@ static void notify_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 			pdu += data.len;
 		}
 	} else {
+		if (length < 2)
+			goto done;
+
 		data.handle = get_le16(pdu);
 		length -= 2;
 		pdu += 2;
-- 
2.56.0

[PATCH BlueZ v1 4/8] unit/test-gatt: Add short notification test

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index 26768e1aca82..d032e7598f9b 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -2334,6 +2334,41 @@ static const struct test_step test_notification_1 = {
 	.length = 0x03,
 };
 
+static void notification_short_cb(uint16_t value_handle,
+					const uint8_t *value, uint16_t length,
+					void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+	static int count;
+
+	g_assert_cmpint(value_handle, ==, step->handle);
+	g_assert_cmpint(length, ==, step->length);
+	g_assert(memcmp(value, step->value, length) == 0);
+
+	if (++count == 2) {
+		count = 0;
+		context_quit(context);
+	}
+}
+
+static void test_notification_short(struct context *context)
+{
+	const struct test_step *step = context->data->step;
+
+	g_assert(bt_gatt_client_register_notify(context->client, step->handle,
+						notification_register_cb,
+						notification_short_cb, context,
+						NULL));
+}
+
+static const struct test_step test_notification_short_1 = {
+	.handle = 0x0003,
+	.func = test_notification_short,
+	.value = read_data_1,
+	.length = 0x03,
+};
+
 static void test_server_notification(struct context *context)
 {
 	const struct test_step *step = context->data->step;
@@ -3481,6 +3516,21 @@ int main(int argc, char *argv[])
 			raw_pdu(),
 			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03));
 
+	define_test_client("/robustness/notify-short", test_client,
+			ts_small_db, &test_notification_short_1,
+			CLIENT_INIT_PDUS,
+			SMALL_DB_DISCOVERY_PDUS,
+			raw_pdu(0x12, 0x04, 0x00, 0x01, 0x00),
+			raw_pdu(0x13),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03),
+			raw_pdu(),
+			raw_pdu(0x1B),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03));
+
 	define_test_server("/TP/GAN/SR/BV-01-C", test_server, ts_small_db,
 			&test_notification_server_1,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

[PATCH BlueZ v1 5/8] shared/att: Add Read Multiple Variable Length opcodes

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

READ_MULT_VL_REQ/RSP were missing from the opcode type and
request/response tables, so bt_att_send rejected the response and the
server never answered the request, leaving the peer to time out. The
client could not send the request either.

Fixes: 3c5088f040ac ("shared/gatt-server: Add support for Read Multiple Variable Length")
Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/att.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/att.c b/src/shared/att.c
index e49743b5a764..3055f291f8f1 100644
--- a/src/shared/att.c
+++ b/src/shared/att.c
@@ -129,6 +129,8 @@ static const struct {
 	{ BT_ATT_OP_READ_BLOB_RSP,		ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_READ_MULT_REQ,		ATT_OP_TYPE_REQ },
 	{ BT_ATT_OP_READ_MULT_RSP,		ATT_OP_TYPE_RSP },
+	{ BT_ATT_OP_READ_MULT_VL_REQ,		ATT_OP_TYPE_REQ },
+	{ BT_ATT_OP_READ_MULT_VL_RSP,		ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_REQ,	ATT_OP_TYPE_REQ },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_RSP,	ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_WRITE_REQ,			ATT_OP_TYPE_REQ },
@@ -172,6 +174,7 @@ static const struct {
 	{ BT_ATT_OP_READ_REQ,			BT_ATT_OP_READ_RSP },
 	{ BT_ATT_OP_READ_BLOB_REQ,		BT_ATT_OP_READ_BLOB_RSP },
 	{ BT_ATT_OP_READ_MULT_REQ,		BT_ATT_OP_READ_MULT_RSP },
+	{ BT_ATT_OP_READ_MULT_VL_REQ,		BT_ATT_OP_READ_MULT_VL_RSP },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_REQ,	BT_ATT_OP_READ_BY_GRP_TYPE_RSP },
 	{ BT_ATT_OP_WRITE_REQ,			BT_ATT_OP_WRITE_RSP },
 	{ BT_ATT_OP_PREP_WRITE_REQ,		BT_ATT_OP_PREP_WRITE_RSP },
-- 
2.56.0

[PATCH BlueZ v1 6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The Length Value Tuple loop never advanced past each value, and a
length exceeding the remaining data grew the remaining length instead
of truncating the value, passing data past the end of the PDU to the
callback.

Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 2b6da611b9f1..6902903e7b02 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2942,9 +2942,12 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		 * current ATT_MTU.
 		 */
 		if (len > length)
-			length = len;
+			len = length;
 
 		op->callback(success, att_ecode, pdu, len, op->user_data);
+
+		length -= len;
+		pdu += len;
 	}
 }
 
-- 
2.56.0

[PATCH BlueZ v1 7/8] shared/gatt-client: Check value lengths before reading them

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Check the iterator result when reading the Database Hash and avoid
reading the Extended Properties value when the response is empty.

Fixes: 0f67d5e2f19f ("shared/gatt-client: Read database hash if available")
Fixes: 6b3f0f3ab935 ("gatt-client: Read extended props on service discovery")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 6902903e7b02..ad3bacbb56af 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -887,7 +887,8 @@ static void ext_prop_read_cb(bool success, uint8_t att_ecode,
 	if (!success)
 		goto done;
 
-	DBG(client, "Ext. prop value: 0x%04x", (uint16_t)value[0]);
+	DBG(client, "Ext. prop value: 0x%04x",
+				length ? (uint16_t)value[0] : 0);
 
 	desc_attr = queue_pop_head(op->ext_prop_desc);
 	if (!desc_attr)
@@ -1475,8 +1476,10 @@ static void db_hash_read_cb(bool success, uint8_t att_ecode,
 	if (!success)
 		goto discover;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+							&len, &value))
+		goto discover;
 
 	DBG(client, "DB Hash found: handle 0x%04x length 0x%04x",
 							handle, len);
-- 
2.56.0

[PATCH BlueZ v1 8/8] unit/test-gatt: Add Read Multiple Variable Length tests

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add client tests, using EATT client features, for regular and truncated
responses and a server test for the response.

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 120 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 116 insertions(+), 4 deletions(-)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index d032e7598f9b..2d654299852d 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -119,6 +119,29 @@ struct context {
 		MTU_EXCHANGE_CLIENT_PDUS,				\
 		READ_SERVER_FEAT_PDUS
 
+#define EATT_CLIENT_INIT_PDUS						\
+		MTU_EXCHANGE_CLIENT_PDUS,				\
+		raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x3a, 0x2b),	\
+		raw_pdu(0x09, 0x03, 0x03, 0x00, 0x01),			\
+		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),	\
+		raw_pdu(0x11, 0x06, 0x01, 0x00, 0x05, 0x00, 0x01, 0x18),\
+		raw_pdu(0x08, 0x04, 0x00, 0xff, 0xff, 0x3a, 0x2b),	\
+		raw_pdu(0x01, 0x08, 0x04, 0x00, 0x0a),			\
+		raw_pdu(0x10, 0x06, 0x00, 0xff, 0xff, 0x00, 0x28),	\
+		raw_pdu(0x01, 0x10, 0x06, 0x00, 0x0a),			\
+		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),	\
+		raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),			\
+		raw_pdu(0x08, 0x01, 0x00, 0x05, 0x00, 0x02, 0x28),	\
+		raw_pdu(0x01, 0x08, 0x01, 0x00, 0x0a),			\
+		raw_pdu(0x08, 0x01, 0x00, 0x05, 0x00, 0x03, 0x28),	\
+		raw_pdu(0x09, 0x07, 0x02, 0x00, 0x02, 0x03, 0x00, 0x3a,	\
+				0x2b, 0x04, 0x00, 0x0a, 0x05, 0x00, 0x29,\
+				0x2b),					\
+		raw_pdu(0x08, 0x05, 0x00, 0x05, 0x00, 0x03, 0x28),	\
+		raw_pdu(0x01, 0x08, 0x05, 0x00, 0x0a),			\
+		raw_pdu(0x12, 0x05, 0x00, 0x07),			\
+		raw_pdu(0x13)
+
 #define SERVICE_DATA_1_PDUS						\
 		CLIENT_INIT_PDUS,					\
 		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),	\
@@ -328,6 +351,7 @@ struct test_step {
 	uint8_t expected_att_ecode;
 	const uint8_t *value;
 	uint16_t length;
+	uint8_t features;
 };
 
 static void destroy_context(struct context *context)
@@ -624,7 +648,7 @@ static void client_ready_cb(bool success, uint8_t att_ecode, void *user_data)
 
 	g_assert(success);
 
-	if (!context->data->source_db) {
+	if (!context->data->source_db && !context->data->step) {
 		context_quit(context);
 		return;
 	}
@@ -632,8 +656,10 @@ static void client_ready_cb(bool success, uint8_t att_ecode, void *user_data)
 	g_assert(context->client);
 	g_assert(context->client_db);
 
-	gatt_db_foreach_service(context->client_db, NULL, match_services,
-						context->data->source_db);
+	if (context->data->source_db)
+		gatt_db_foreach_service(context->client_db, NULL,
+					match_services,
+					context->data->source_db);
 
 	if (context->data->step) {
 		const struct test_step *step = context->data->step;
@@ -653,6 +679,7 @@ static struct context *create_context(uint16_t mtu, gconstpointer data)
 {
 	struct context *context = g_new0(struct context, 1);
 	const struct test_data *test_data = data;
+	const struct test_step *step;
 	GIOChannel *channel;
 	int err, sv[2];
 
@@ -680,11 +707,14 @@ static struct context *create_context(uint16_t mtu, gconstpointer data)
 						"bt_gatt_server:", NULL);
 		break;
 	case CLIENT:
+		step = test_data->step;
+
 		context->client_db = gatt_db_new();
 		g_assert(context->client_db);
 
 		context->client = bt_gatt_client_new(context->client_db,
-							context->att, mtu, 0);
+						context->att, mtu,
+						step ? step->features : 0);
 		g_assert(context->client);
 
 		bt_gatt_client_set_debug(context->client, print_debug,
@@ -2149,6 +2179,67 @@ static const struct test_step test_multiple_read_6 = {
 	.expected_att_ecode = 0x0c
 };
 
+static void multiple_read_vl_cb(bool success, uint8_t att_ecode,
+					const uint8_t *value, uint16_t length,
+					void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+	static uint16_t offset;
+
+	g_assert(success);
+	g_assert_cmpint(offset + 2 + length, <=, step->length);
+	g_assert_cmpint(get_le16(step->value + offset), ==, length);
+	g_assert(memcmp(value, step->value + offset + 2, length) == 0);
+
+	offset += 2 + length;
+	if (offset == step->length) {
+		offset = 0;
+		context_quit(context);
+	}
+}
+
+static void test_multiple_read_vl(struct context *context)
+{
+	const struct test_step *step = context->data->step;
+	uint16_t handles[2];
+
+	handles[0] = step->handle;
+	handles[1] = step->end_handle;
+
+	g_assert(bt_gatt_client_read_multiple(context->client, handles, 2,
+						multiple_read_vl_cb, context,
+						NULL));
+}
+
+static const uint8_t read_mult_vl_data_1[] = {
+	0x02, 0x00, 0x01, 0x02,
+	0x03, 0x00, 0x03, 0x04, 0x05
+};
+
+static const struct test_step test_multiple_read_vl_1 = {
+	.handle = 0x0003,
+	.end_handle = 0x0005,
+	.func = test_multiple_read_vl,
+	.value = read_mult_vl_data_1,
+	.length = sizeof(read_mult_vl_data_1),
+	.features = BT_GATT_CHRC_CLI_FEAT_EATT,
+};
+
+static const uint8_t read_mult_vl_data_2[] = {
+	0x02, 0x00, 0x01, 0x02,
+	0x01, 0x00, 0x03
+};
+
+static const struct test_step test_multiple_read_vl_2 = {
+	.handle = 0x0003,
+	.end_handle = 0x0005,
+	.func = test_multiple_read_vl,
+	.value = read_mult_vl_data_2,
+	.length = sizeof(read_mult_vl_data_2),
+	.features = BT_GATT_CHRC_CLI_FEAT_EATT,
+};
+
 static void read_by_type_cb(bool success, uint8_t att_ecode,
 						struct bt_gatt_result *result,
 						void *user_data)
@@ -3378,6 +3469,20 @@ int main(int argc, char *argv[])
 			raw_pdu(0x0e, 0x03, 0x00, 0x07, 0x00),
 			raw_pdu(0x0f, 0x01, 0x02, 0x03));
 
+	define_test_client("/robustness/read-multiple-vl", test_client,
+			NULL, &test_multiple_read_vl_1,
+			EATT_CLIENT_INIT_PDUS,
+			raw_pdu(0x20, 0x03, 0x00, 0x05, 0x00),
+			raw_pdu(0x21, 0x02, 0x00, 0x01, 0x02, 0x03, 0x00,
+					0x03, 0x04, 0x05));
+
+	define_test_client("/robustness/read-multiple-vl-truncated",
+			test_client, NULL, &test_multiple_read_vl_2,
+			EATT_CLIENT_INIT_PDUS,
+			raw_pdu(0x20, 0x03, 0x00, 0x05, 0x00),
+			raw_pdu(0x21, 0x02, 0x00, 0x01, 0x02, 0x03, 0x00,
+					0x03));
+
 	define_test_client("/TP/GAR/CL/BI-22-C", test_client, service_db_1,
 			&test_multiple_read_6,
 			SERVICE_DATA_1_PDUS,
@@ -3390,6 +3495,13 @@ int main(int argc, char *argv[])
 			raw_pdu(0x0e, 0x15, 0xF0, 0x03, 0x00),
 			raw_pdu(0x0f, 0x09, 'B', 'l', 'u', 'e', 'Z'));
 
+	define_test_server("/robustness/read-multiple-vl/server",
+			test_server, ts_small_db, NULL,
+			raw_pdu(0x03, 0x00, 0x02),
+			raw_pdu(0x20, 0x15, 0xF0, 0x03, 0x00),
+			raw_pdu(0x21, 0x01, 0x00, 0x09, 0x05, 0x00, 'B', 'l',
+					'u', 'e', 'Z'));
+
 	define_test_server("/TP/GAR/SR/BV-05-C/large-1", test_server,
 			ts_large_db_1, NULL,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

RE: Fix handling of malformed GATT PDUs

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 56534 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1203587/

---Test result---

Test Summary:
CheckPatch                    PASS      4.29 seconds
GitLint                       FAIL      3.23 seconds
BuildEll                      PASS      21.09 seconds
BluezMake                     PASS      316.54 seconds
MakeCheck                     PASS      14.98 seconds
MakeDistcheck                 PASS      159.02 seconds
CheckValgrind                 PASS      361.88 seconds
CheckSmatch                   WARNING   309.85 seconds
bluezmakeextell               PASS      104.44 seconds
TestFunctional                FAIL      1292.58 seconds
IncrementalBuild              PASS      455.41 seconds
ScanBuild                     PASS      1207.27 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v1,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

1: T1 Title exceeds max length (85>80): "[BlueZ,v1,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bearer::test_bearer_le_conn_update[hosts14-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts14.1-bluetoothd-1793920035-190.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 190]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7fd912ca6900 (LWP 190)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007fd913401b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007fd9133e48ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 140737438815152, 140737438815440, 140737438815296, 22, 140570304502736, 0, 140737438815232, 140570321348118, 140570290610176, 4096, 0, 6775025475302540032, 140570294788120}}, sa_flags = 343068672, sa_restorer = 0x16}
        #5  0x00007fd91400ca0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007fd914132c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007fd91410793c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffffd0c1576) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7bd90cf70000 '=' <repeats 65 times>, "\n==190==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ce9121e1720 at pc 0x562ab9ea5bcd bp 0x7ffffd0c21f0 sp 0x7ffffd0c21e0"..., capacity_bytes_ = 8192, size_ = 4282}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007fd914106e02 in __asan::ReportGenericError (pc=94741507759053, bp=140737438818800, sp=sp@entry=140737438818784, addr=137340473186080, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, signal = {siginfo = 0x5e05b9c600000002, context = 0x7ce9121e1720, addr = 0, pc = 0, sp = 6124623364552, bp = 137340473186080, is_memory_access = 96, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 192}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, second_free_stack = 0x5e05b9c600000002, addr_description = {addr = 137340473186080, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1426, chunk_access = {bad_addr = 137340473186080, offset = 96, chunk_begin = 137340473185984, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0x5e05b9c600000002, addr_description = {addr = 137340473186080, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1426, chunk_access = {bad_addr = 137340473186080, offset = 96, chunk_begin = 137340473185984, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140570291886400, delete_alignment = 140737438816896}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0x5e05b9c600000002, addr_description = {data = {kind = 303961888, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6124623364552, alloc_stack_id = 303961888, free_stack_id = 31977, chunk_access = {bad_addr = 96, offset = 137340473185984, chunk_begin = 232, chunk_size = 140733193412616, user_requested_alignment = 2368, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6124623364552, frame_pc = 137340473186080, access_size = 96, frame_descr = 0x7ce9121e16c0 "\222\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6124623364552, size_with_redzone = 137340473186080, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7ce9121e16c0 "\222\005", has_dynamic_init = 232, gcc_location = 0x7fff00006008, odr_indicator = 140570291886400}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321915840, name = 0x7cb9121e0b90 "\003\021", module_name = 0x7ffffd0c1a50 "\240\"\f\375\377\177", has_dynamic_init = 140570320267064, gcc_location = 0xa0, odr_indicator = 137134314752912}, {beg = 140570294919376, size = 140737438816880, size_with_redzone = 137134314752928, name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136172222140704, gcc_location = 0x7ffffd0c22a0, odr_indicator = 140570321195969}, {beg = 140737438816880, size = 129173661314, size_with_redzone = 140737438816896, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7fd9140f9400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94741506707048, gcc_location = 0x7ffffd0c2280, odr_indicator = 140737438818704}}, reg_sites = {324849120, 32729, 323672931, 32729}, access_size = 1, size = 205 '\315'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, dealloc_stack = 0x5e05b9c600000002, alloc_type = 303961888, dealloc_type = 31977, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xc8), shadow_byte = 1 '\001'}, heap = {addr = 0, alloc_tid = 6124623364552, free_tid = 137340473186080, alloc_stack_id = 96, free_stack_id = 0, chunk_access = {bad_addr = 137340473185984, offset = 232, chunk_begin = 140733193412616, chunk_size = 140570291886400, user_requested_alignment = 2688, access_type = 1, alloc_type = 0}}, stack = {addr = 0, tid = 6124623364552, offset = 137340473186080, frame_pc = 96, access_size = 137340473185984, frame_descr = 0xe8 <error: Cannot access memory at address 0xe8>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 6124623364552, size = 137340473186080, size_with_redzone = 96, name = 0x7ce9121e16c0 "\222\005", module_name = 0xe8 <error: Cannot access memory at address 0xe8>, has_dynamic_init = 140733193412616, gcc_location = 0x7fd912505940, odr_indicator = 140737438816896}, {beg = 2, size = 140570321915840, size_with_redzone = 137134314752912, name = 0x7ffffd0c1a50 "\240\"\f\375\377\177", module_name = 0x7fd914016738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 160, gcc_location = 0x7cb9121e0b90, odr_indicator = 140570294919376}, {beg = 140737438816880, size = 137134314752928, size_with_redzone = 94741506794864, name = 0x7ffffd0c2380 "", module_name = 0x7bd910edd120 "pU\036\022I|", has_dynamic_init = 140737438818976, gcc_location = 0x7fd9140f93c1 <___interceptor_free(void*)+113>, odr_indicator = 140737438816880}, {beg = 129173661314, size = 140737438816896, size_with_redzone = 2, name = 0x7fd9140f9400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", module_name = 0x562ab9da4e68 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", has_dynamic_init = 140737438818944, gcc_location = 0x7ffffd0c2190, odr_indicator = 140570309479904}}, reg_sites = {323672931, 32729, 1, 0}, access_size = 94741507759053, size = 240 '\360'}, wild = {addr = 0, access_size = 6124623364552}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, addr_description = {data = {kind = 303961888, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6124623364552, alloc_stack_id = 303961888, free_stack_id = 31977, chunk_access = {bad_addr = 96, offset = 137340473185984, chunk_begin = 232, chunk_size = 140733193412616, user_requested_alignment = 2368, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6124623364552, frame_pc = 137340473186080, access_size = 96, frame_descr = 0x7ce9121e16c0 "\222\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6124623364552, size_with_redzone = 137340473186080, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7ce9121e16c0 "\222\005", has_dynamic_init = 232, gcc_location = 0x7fff00006008, odr_indicator = 140570291886400}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321915840, name = 0x7cb9121e0b90 "\003\021", module_name = 0x7ffffd0c1a50 "\240\"\f\375\377\177", has_dynamic_init = 140570320267064, gcc_location = 0xa0, odr_indicator = 137134314752912}, {beg = 140570294919376, size = 140737438816880, size_with_redzone = 137134314752928, name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136172222140704, gcc_location = 0x7ffffd0c22a0, odr_indicator = 140570321195969}, {beg = 140737438816880, size = 129173661314, size_with_redzone = 140737438816896, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7fd9140f9400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94741506707048, gcc_location = 0x7ffffd0c2280, odr_indicator = 140737438818704}}, reg_sites = {324849120, 32729, 323672931, 32729}, access_size = 1, size = 205 '\315'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, addr_description = {data = {kind = 303961888, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6124623364552, alloc_stack_id = 303961888, free_stack_id = 31977, chunk_access = {bad_addr = 96, offset = 137340473185984, chunk_begin = 232, chunk_size = 140733193412616, user_requested_alignment = 2368, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6124623364552, frame_pc = 137340473186080, access_size = 96, frame_descr = 0x7ce9121e16c0 "\222\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6124623364552, size_with_redzone = 137340473186080, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7ce9121e16c0 "\222\005", has_dynamic_init = 232, gcc_location = 0x7fff00006008, odr_indicator = 140570291886400}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321915840, name = 0x7cb9121e0b90 "\003\021", module_name = 0x7ffffd0c1a50 "\240\"\f\375\377\177", has_dynamic_init = 140570320267064, gcc_location = 0xa0, odr_indicator = 137134314752912}, {beg = 140570294919376, size = 140737438816880, size_with_redzone = 137134314752928, name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136172222140704, gcc_location = 0x7ffffd0c22a0, odr_indicator = 140570321195969}, {beg = 140737438816880, size = 129173661314, size_with_redzone = 140737438816896, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7fd9140f9400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94741506707048, gcc_location = 0x7ffffd0c2280, odr_indicator = 140737438818704}}, reg_sites = {324849120, 32729, 323672931, 32729}, access_size = 1, size = 205 '\315'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, count = 137340473186080, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, count = 137340473186080, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, size = 137340473186080}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, alignment = 137340473186080}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, size = 137340473186080, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, alignment = 137340473186080}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, user_size = 137340473186080, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, requested_size = 137340473186080}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, length1 = 137340473186080, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6124623364552, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6124623364552, alloc_tid = 137340473186080, free_tid = 96, alloc_stack_id = 303961792, free_stack_id = 31977, chunk_access = {bad_addr = 232, offset = 140733193412616, chunk_begin = 140570291886400, chunk_size = 140737438816896, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6124623364552, tid = 137340473186080, offset = 96, frame_pc = 137340473185984, access_size = 232, frame_descr = 0x7fff00006008 <error: Cannot access memory at address 0x7fff00006008>}, global = {addr = 6124623364552, static kMaxGlobals = 4, globals = {{beg = 137340473186080, size = 96, size_with_redzone = 137340473185984, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7fff00006008 <error: Cannot access memory at address 0x7fff00006008>, has_dynamic_init = 140570291886400, gcc_location = 0x7ffffd0c1a80, odr_indicator = 2}, {beg = 140570321915840, size = 137134314752912, size_with_redzone = 140737438816848, name = 0x7fd914016738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137134314752912, gcc_location = 0x7fd9127ea0d0, odr_indicator = 140737438816880}, {beg = 137134314752928, size = 94741506794864, size_with_redzone = 140737438819200, name = 0x7bd910edd120 "pU\036\022I|", module_name = 0x7ffffd0c22a0 "\200\t\036\022I}", has_dynamic_init = 140570321195969, gcc_location = 0x7ffffd0c1a70, odr_indicator = 129173661314}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321196032, name = 0x562ab9da4e68 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffffd0c2280 " \321\355\020\331{", has_dynamic_init = 140737438818704, gcc_location = 0x7fd9135ccde0 <_nl_C_locobj>, odr_indicator = 140570308303715}}, reg_sites = {1, 0, 3119143885, 22058}, access_size = 140737438818800, size = 224 '\340'}, wild = {addr = 6124623364552, access_size = 137340473186080}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140570321627031, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140570321627031, alloc_tid = 140737438874880, free_tid = 140737438818440, alloc_stack_id = 799097600, free_stack_id = 1577433542, chunk_access = {bad_addr = 140737438818640, offset = 140570321457021, chunk_begin = 136653278434696, chunk_size = 140570321891192, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140570321627031, tid = 140737438874880, offset = 140737438818440, frame_pc = 6775025475302540032, access_size = 140737438818640, frame_descr = 0x7fd914138f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140570321627031, static kMaxGlobals = 4, globals = {{beg = 140737438874880, size = 140737438818440, size_with_redzone = 6775025475302540032, name = 0x7ffffd0c2150 "H\024\036\022\331|", module_name = 0x7fd914138f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136653278434696, gcc_location = 0x7fd9141a2f78, odr_indicator = 65535}, {beg = 6775025475302540032, size = 140570299885752, size_with_redzone = 140570321891192, name = 0x7c39121e7070 "", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136584558964800, gcc_location = 0x7c39121e7068, odr_indicator = 136584558964848}, {beg = 94741507683476, size = 64, size_with_redzone = 17021527767588, name = 0x7c59121e1620 "@\024\036\022\331|", module_name = 0x7bd910edd1c0 "\0166\340E", has_dynamic_init = 136309681111504, gcc_location = 0x562ab9e9d452 <bt_att_chan_cancel+402>, odr_indicator = 10}, {beg = 136584558964848, size = 10, size_with_redzone = 94741507725080, name = 0x7cd9121e1440 "", module_name = 0x7bd910edd220 "", has_dynamic_init = 17021527767608, gcc_location = 0x7ffffd0c2160, odr_indicator = 137271753708616}}, reg_sites = {4245431168, 32767, 315254968, 32729}, access_size = 136996875800576, size = 144 '\220'}, wild = {addr = 140570321627031, access_size = 140737438874880}}}}, function = 0x7fd9140d1359 <___interceptor___tls_get_addr(void*)+89> "L\211\360H\213]\360L\213u\370\311\303f.\017\037\204"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, addr_description = {data = {kind = 303961888, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6124623364552, alloc_stack_id = 303961888, free_stack_id = 31977, chunk_access = {bad_addr = 96, offset = 137340473185984, chunk_begin = 232, chunk_size = 140733193412616, user_requested_alignment = 2368, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6124623364552, frame_pc = 137340473186080, access_size = 96, frame_descr = 0x7ce9121e16c0 "\222\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6124623364552, size_with_redzone = 137340473186080, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7ce9121e16c0 "\222\005", has_dynamic_init = 232, gcc_location = 0x7fff00006008, odr_indicator = 140570291886400}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321915840, name = 0x7cb9121e0b90 "\003\021", module_name = 0x7ffffd0c1a50 "\240\"\f\375\377\177", has_dynamic_init = 140570320267064, gcc_location = 0xa0, odr_indicator = 137134314752912}, {beg = 140570294919376, size = 140737438816880, size_with_redzone = 137134314752928, name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136172222140704, gcc_location = 0x7ffffd0c22a0, odr_indicator = 140570321195969}, {beg = 140737438816880, size = 129173661314, size_with_redzone = 140737438816896, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7fd9140f9400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 94741506707048, gcc_location = 0x7ffffd0c2280, odr_indicator = 140737438818704}}, reg_sites = {324849120, 32729, 323672931, 32729}, access_size = 1, size = 205 '\315'}, wild = {addr = 0, access_size = 0}}}}, size = 140737438818800}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, beg = 137340473186080, end = 0, old_mid = 0, new_mid = 6124623364552}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, storage_beg = 137340473186080, storage_end = 0, old_container_beg = 0, old_container_end = 6124623364552, new_container_beg = 137340473186080, new_container_end = 96}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, stack = 0x5e05b9c600000002, old_storage_beg = 137340473186080, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 6124623364552}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, global1 = {beg = 6775025474503442434, size = 137340473186080, size_with_redzone = 0, name = 0x0, module_name = 0x592000001c8 <error: Cannot access memory at address 0x592000001c8>, has_dynamic_init = 137340473186080, gcc_location = 0x60, odr_indicator = 137340473185984}, global2 = {beg = 232, size = 140733193412616, size_with_redzone = 140570291886400, name = 0x7ffffd0c1a80 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140570321915840, gcc_location = 0x7cb9121e0b90, odr_indicator = 140737438816848}, stack_id1 = 335636280, stack_id2 = 32729}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, pc = 6775025474503442434, bp = 137340473186080, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6124623364552, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6124623364552, alloc_tid = 137340473186080, free_tid = 96, alloc_stack_id = 303961792, free_stack_id = 31977, chunk_access = {bad_addr = 232, offset = 140733193412616, chunk_begin = 140570291886400, chunk_size = 140737438816896, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6124623364552, tid = 137340473186080, offset = 96, frame_pc = 137340473185984, access_size = 232, frame_descr = 0x7fff00006008 <error: Cannot access memory at address 0x7fff00006008>}, global = {addr = 6124623364552, static kMaxGlobals = 4, globals = {{beg = 137340473186080, size = 96, size_with_redzone = 137340473185984, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7fff00006008 <error: Cannot access memory at address 0x7fff00006008>, has_dynamic_init = 140570291886400, gcc_location = 0x7ffffd0c1a80, odr_indicator = 2}, {beg = 140570321915840, size = 137134314752912, size_with_redzone = 140737438816848, name = 0x7fd914016738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137134314752912, gcc_location = 0x7fd9127ea0d0, odr_indicator = 140737438816880}, {beg = 137134314752928, size = 94741506794864, size_with_redzone = 140737438819200, name = 0x7bd910edd120 "pU\036\022I|", module_name = 0x7ffffd0c22a0 "\200\t\036\022I}", has_dynamic_init = 140570321195969, gcc_location = 0x7ffffd0c1a70, odr_indicator = 129173661314}, {beg = 140737438816896, size = 2, size_with_redzone = 140570321196032, name = 0x562ab9da4e68 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffffd0c2280 " \321\355\020\331{", has_dynamic_init = 140737438818704, gcc_location = 0x7fd9135ccde0 <_nl_C_locobj>, odr_indicator = 140570308303715}}, reg_sites = {1, 0, 3119143885, 22058}, access_size = 140737438818800, size = 224 '\340'}, wild = {addr = 6124623364552, access_size = 137340473186080}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140570321627031, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140570321627031, alloc_tid = 140737438874880, free_tid = 140737438818440, alloc_stack_id = 799097600, free_stack_id = 1577433542, chunk_access = {bad_addr = 140737438818640, offset = 140570321457021, chunk_begin = 136653278434696, chunk_size = 140570321891192, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140570321627031, tid = 140737438874880, offset = 140737438818440, frame_pc = 6775025475302540032, access_size = 140737438818640, frame_descr = 0x7fd914138f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140570321627031, static kMaxGlobals = 4, globals = {{beg = 140737438874880, size = 140737438818440, size_with_redzone = 6775025475302540032, name = 0x7ffffd0c2150 "H\024\036\022\331|", module_name = 0x7fd914138f7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136653278434696, gcc_location = 0x7fd9141a2f78, odr_indicator = 65535}, {beg = 6775025475302540032, size = 140570299885752, size_with_redzone = 140570321891192, name = 0x7c39121e7070 "", module_name = 0x7ffffd0c2380 "", has_dynamic_init = 136584558964800, gcc_location = 0x7c39121e7068, odr_indicator = 136584558964848}, {beg = 94741507683476, size = 64, size_with_redzone = 17021527767588, name = 0x7c59121e1620 "@\024\036\022\331|", module_name = 0x7bd910edd1c0 "\0166\340E", has_dynamic_init = 136309681111504, gcc_location = 0x562ab9e9d452 <bt_att_chan_cancel+402>, odr_indicator = 10}, {beg = 136584558964848, size = 10, size_with_redzone = 94741507725080, name = 0x7cd9121e1440 "", module_name = 0x7bd910edd220 "", has_dynamic_init = 17021527767608, gcc_location = 0x7ffffd0c2160, odr_indicator = 137271753708616}}, reg_sites = {4245431168, 32767, 315254968, 32729}, access_size = 136996875800576, size = 144 '\220'}, wild = {addr = 140570321627031, access_size = 140737438874880}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137340473186080, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137340473186080, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1426, chunk_access = {bad_addr = 137340473186080, offset = 96, chunk_begin = 137340473185984, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137340473186080, tid = 0, offset = 0, frame_pc = 6124623364552, access_size = 137340473186080, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137340473186080, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6124623364552, name = 0x7ce9121e1720 "\240\025\036\022Y|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137340473185984, gcc_location = 0xe8, odr_indicator = 140733193412616}, {beg = 140570291886400, size = 140737438816896, size_with_redzone = 2, name = 0x7fd9141a8fc0 <__asan::instance> "", module_name = 0x7cb9121e0b90 "\003\021", has_dynamic_init = 140737438816848, gcc_location = 0x7fd914016738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137134314752912, size = 140570294919376, size_with_redzone = 140737438816880, name = 0x7cb9121e0ba0 "\224\005", module_name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140737438819200, gcc_location = 0x7bd910edd120, odr_indicator = 140737438818976}, {beg = 140570321195969, size = 140737438816880, size_with_redzone = 129173661314, name = 0x7ffffd0c1a80 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140570321196032, gcc_location = 0x562ab9da4e68 <gatt_server_cleanup+200>, odr_indicator = 140737438818944}}, reg_sites = {4245430672, 32767, 324849120, 32729}, access_size = 140570308303715, size = 1 '\001'}, wild = {addr = 137340473186080, access_size = 0}}}}, pc = 94741507759053, bp = 140737438818800, sp = 140737438818784, access_size = 8, bug_descr = 0x7fd914162797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\331\177\000\000\305,\021\024\331\177\000\000`\200\036\0229|\000\000:\000\000\000\000\000\000\000@\200\036\0229|\000\000P\200\036\0229|\000\000`\026\f\375\377\177\000\000\005\214\005\024\331\177\000\000\260\026\f\375\377\177\000\000\000\240~\022\331\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000*\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\232\200\036\0229|\000\000\240\026\f\375\377\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000P\214\374\377\177\000\000:\000\000\000\000\000\000\000\240M\377\020\331{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137340473186080, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137340473186080, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1426, chunk_access = {bad_addr = 137340473186080, offset = 96, chunk_begin = 137340473185984, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137340473186080, tid = 0, offset = 0, frame_pc = 6124623364552, access_size = 137340473186080, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137340473186080, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6124623364552, name = 0x7ce9121e1720 "\240\025\036\022Y|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137340473185984, gcc_location = 0xe8, odr_indicator = 140733193412616}, {beg = 140570291886400, size = 140737438816896, size_with_redzone = 2, name = 0x7fd9141a8fc0 <__asan::instance> "", module_name = 0x7cb9121e0b90 "\003\021", has_dynamic_init = 140737438816848, gcc_location = 0x7fd914016738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137134314752912, size = 140570294919376, size_with_redzone = 140737438816880, name = 0x7cb9121e0ba0 "\224\005", module_name = 0x562ab9dba570 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140737438819200, gcc_location = 0x7bd910edd120, odr_indicator = 140737438818976}, {beg = 140570321195969, size = 140737438816880, size_with_redzone = 129173661314, name = 0x7ffffd0c1a80 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140570321196032, gcc_location = 0x562ab9da4e68 <gatt_server_cleanup+200>, odr_indicator = 140737438818944}}, reg_sites = {4245430672, 32767, 324849120, 32729}, access_size = 140570308303715, size = 1 '\001'}, wild = {addr = 137340473186080, access_size = 0}}}}, pc = 94741507759053, bp = 140737438818800, sp = 140737438818784, access_size = 8, bug_descr = 0x7fd914162797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007fd914106f8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140737438818800, sp=sp@entry=140737438818784, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007fd9141083f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140737438818800
                pc = <optimized out>
                local_stack = 140737438819200
                sp = 140737438818784
        #11 0x0000562ab9ea5bcd in discovery_op_free (op=0x7c59121e16a0) at src/shared/gatt-client.c:407
        No locals.
        #12 0x0000562ab9fd2dea in bt_gatt_request_unref (req=0x7c59121e2020) at src/shared/gatt-helpers.c:577
        No locals.
        #13 bt_gatt_request_unref (req=0x7c59121e2020) at src/shared/gatt-helpers.c:566
        No locals.
        #14 0x0000562ab9e93494 in cancel_att_send_op (data=0x7c39121e7040) at src/shared/att.c:229
                op = 0x7c39121e7040
        #15 0x0000562ab9e9e1d9 in bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1954
                chan = 0x7c59121e1620
                entry = 0x7bf9121f41d0
        #16 bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1935
                entry = <optimized out>
                chan = <optimized out>
        #17 0x0000562ab9e9efc0 in bt_att_unref (att=0x7cd9121e1440) at src/shared/att.c:1353
        No locals.
        #18 bt_att_unref (att=0x7cd9121e1440) at src/shared/att.c:1344
        No locals.
        #19 0x0000562ab9dba1df in attio_cleanup (device=device@entry=0x7d49121e0780) at src/device.c:873
        No locals.
        #20 0x0000562ab9dba717 in device_free (user_data=0x7d49121e0780) at src/device.c:918
                device = 0x7d49121e0780
                __func__ = "device_free"
        #21 0x0000562ab9e3b4ca in remove_interface (data=0x7c49121e5570, name=name@entry=0x562aba061380 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c39121e6260
        #22 0x0000562ab9e3e08c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #23 0x0000562ab9d7035b in remove_temporary_devices (adapter=adapter@entry=0x7d09121e0200) at src/adapter.c:826
                dev = 0x7d49121e0780
                l = <optimized out>
                next = 0x0
        #24 0x0000562ab9d716ba in adapter_shutdown () at src/adapter.c:11503
                adapter = 0x7d09121e0200
                list = 0x7c09121e3910 = {0x7d09121e0200}
                __func__ = "adapter_shutdown"
        #25 0x0000562ab9e1219c in signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1517
                terminated = false
        #26 signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1504
                terminated = false
        #27 0x0000562ab9fc737e in signal_read (io=<optimized out>, user_data=0x7c09121e34c0) at src/shared/mainloop-notify.c:145
                data = <optimized out>
                si = <optimized out>
                result = <optimized out>
                fd = <optimized out>
        #28 0x0000562ab9fc4275 in watch_callback (channel=<optimized out>, cond=<optimized out>, user_data=<optimized out>) at src/shared/io-glib.c:173
                watch = <optimized out>
                result = <optimized out>
                destroy = <optimized out>
        #29 0x00007fd913e12b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #30 0x00007fd913e141d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #31 0x00007fd913e14577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #32 0x0000562ab9fc71d9 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #33 0x0000562ab9fc7b0b in mainloop_run_with_signal (func=func@entry=0x562ab9e12120 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7c09121e34c0
                io = 0x7c19121f9590
                ret = <optimized out>
        #34 0x0000562ab9b433eb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1745
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bass_past_earbuds_transport_acquire[hosts11-vm3]: AssertionError: Failed to acquire: org.bluez.Error.Failed


https://github.com/bluez/bluez/pull/2768

---
Regards,
Linux Bluetooth

RE: Fix handling of malformed GATT PDUs

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 56478 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1204442/

---Test result---

Test Summary:
CheckPatch                    PASS      4.11 seconds
GitLint                       FAIL      2.62 seconds
BuildEll                      PASS      20.40 seconds
BluezMake                     PASS      306.18 seconds
MakeCheck                     PASS      14.57 seconds
MakeDistcheck                 PASS      144.97 seconds
CheckValgrind                 PASS      343.73 seconds
CheckSmatch                   WARNING   300.94 seconds
bluezmakeextell               PASS      98.86 seconds
TestFunctional                FAIL      1279.72 seconds
IncrementalBuild              PASS      455.45 seconds
ScanBuild                     PASS      1165.77 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v2,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

1: T1 Title exceeds max length (85>80): "[BlueZ,v2,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bearer::test_bearer_le_conn_update[hosts14-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts14.1-bluetoothd-1794005149-189.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 189]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7feab89bb900 (LWP 189)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007feab9116b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007feab90f98ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140729938411056, 22, 140646100904912, 0, 140729938410992, 140646117750294, 140646090289152, 4096, 0, 17847858331768781312, 140646091194392}}, sa_flags = -1169940480, sa_restorer = 0x16}
        #5  0x00007feab9d21a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007feab9e47c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007feab9e1c93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffe3dfcff66) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7beab2c85000 '=' <repeats 65 times>, "\n==189==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cfab7ee1720 at pc 0x5556795d3bad bp 0x7ffe3dfd0be0 sp 0x7ffe3dfd0bd0"..., capacity_bytes_ = 8192, size_ = 4282}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007feab9e1be02 in __asan::ReportGenericError (pc=93829891701677, bp=140729938414560, sp=sp@entry=140729938414544, addr=137416269502240, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, signal = {siginfo = 0xf7b0549700000002, context = 0x7cfab7ee1720, addr = 0, pc = 0, sp = 6137508266440, bp = 137416269502240, is_memory_access = 96, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 192}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, second_free_stack = 0xf7b0549700000002, addr_description = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xf7b0549700000002, addr_description = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140646088202608, delete_alignment = 140729938412656}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, dealloc_stack = 0xf7b0549700000002, alloc_type = 3085834016, dealloc_type = 31994, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xc8), shadow_byte = 1 '\001'}, heap = {addr = 0, alloc_tid = 6137508266440, free_tid = 137416269502240, alloc_stack_id = 96, free_stack_id = 0, chunk_access = {bad_addr = 137416269502144, offset = 232, chunk_begin = 140728898445320, chunk_size = 140646088202608, user_requested_alignment = 1136, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 6137508266440, offset = 137416269502240, frame_pc = 96, access_size = 137416269502144, frame_descr = 0xe8 <error: Cannot access memory at address 0xe8>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 6137508266440, size = 137416269502240, size_with_redzone = 96, name = 0x7cfab7ee16c0 "\225\005", module_name = 0xe8 <error: Cannot access memory at address 0xe8>, has_dynamic_init = 140728898445320, gcc_location = 0x7feab8205970, odr_indicator = 140729938412656}, {beg = 2, size = 140646118318016, size_with_redzone = 137210111069072, name = 0x7ffe3dfd0440 "\220\f\375=\376\177", module_name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 160, gcc_location = 0x7ccab7ee0b90, odr_indicator = 140646092394704}, {beg = 140729938412640, size = 137210111069088, size_with_redzone = 93829890737488, name = 0x7ffe3dfd0d70 "", module_name = 0x7beab6bdd220 "pU\356\267Z|", has_dynamic_init = 140729938414736, gcc_location = 0x7feab9e0e3c1 <___interceptor_free(void*)+113>, odr_indicator = 140729938412640}, {beg = 131955619458, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", module_name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", has_dynamic_init = 140729938414704, gcc_location = 0x7ffe3dfd0b80, odr_indicator = 140646105882080}}, reg_sites = {3105631075, 32746, 1, 0}, access_size = 93829891701677, size = 224 '\340'}, wild = {addr = 0, access_size = 6137508266440}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, count = 137416269502240, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, count = 137416269502240, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, size = 137416269502240}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, alignment = 137416269502240}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, size = 137416269502240, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, alignment = 137416269502240}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, user_size = 137416269502240, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, requested_size = 137416269502240}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, length1 = 137416269502240, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6137508266440, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6137508266440, alloc_tid = 137416269502240, free_tid = 96, alloc_stack_id = 3085833920, free_stack_id = 31994, chunk_access = {bad_addr = 232, offset = 140728898445320, chunk_begin = 140646088202608, chunk_size = 140729938412656, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6137508266440, tid = 137416269502240, offset = 96, frame_pc = 137416269502144, access_size = 232, frame_descr = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>}, global = {addr = 6137508266440, static kMaxGlobals = 4, globals = {{beg = 137416269502240, size = 96, size_with_redzone = 137416269502144, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>, has_dynamic_init = 140646088202608, gcc_location = 0x7ffe3dfd0470, odr_indicator = 2}, {beg = 140646118318016, size = 137210111069072, size_with_redzone = 140729938412608, name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137210111069072, gcc_location = 0x7feab86050d0, odr_indicator = 140729938412640}, {beg = 137210111069088, size = 93829890737488, size_with_redzone = 140729938414960, name = 0x7beab6bdd220 "pU\356\267Z|", module_name = 0x7ffe3dfd0c90 "", has_dynamic_init = 140646117598145, gcc_location = 0x7ffe3dfd0460, odr_indicator = 131955619458}, {beg = 140729938412656, size = 2, size_with_redzone = 140646117598208, name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffe3dfd0c70 " \322\275\266\352{", has_dynamic_init = 140729938414464, gcc_location = 0x7feab92e1de0 <_nl_C_locobj>, odr_indicator = 140646104705891}}, reg_sites = {1, 0, 2036153261, 21846}, access_size = 140729938414560, size = 208 '\320'}, wild = {addr = 6137508266440, access_size = 137416269502240}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140646118029207, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140646118029207, alloc_tid = 140729938476288, free_tid = 140729938414200, alloc_stack_id = 982710784, free_stack_id = 4155528343, chunk_access = {bad_addr = 140729938414400, offset = 140646117859197, chunk_begin = 136729074750856, chunk_size = 140646118293368, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140646118029207, tid = 140729938476288, offset = 140729938414200, frame_pc = 17847858331768781312, access_size = 140729938414400, frame_descr = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140646118029207, static kMaxGlobals = 4, globals = {{beg = 140729938476288, size = 140729938414200, size_with_redzone = 17847858331768781312, name = 0x7ffe3dfd0b40 "H\024\356\267\352|", module_name = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136729074750856, gcc_location = 0x7feab9eb7f78, odr_indicator = 65535}, {beg = 17847858331768781312, size = 140646096287928, size_with_redzone = 140646118293368, name = 0x7c4ab7ee7c10 "", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136660355283936, gcc_location = 0x7c4ab7ee7c08, odr_indicator = 136660355283984}, {beg = 93829891626100, size = 64, size_with_redzone = 17031002307140, name = 0x7c6ab7ee1620 "@\024\356\267\352|", module_name = 0x7beab6bdd2c0 "\0166\340E", has_dynamic_init = 136385477427664, gcc_location = 0x5556795cb432 <bt_att_chan_cancel+402>, odr_indicator = 11}, {beg = 136660355283984, size = 11, size_with_redzone = 93829891667704, name = 0x7ceab7ee1440 "", module_name = 0x7beab6bdd320 "", has_dynamic_init = 17031002307160, gcc_location = 0x7ffe3dfd0b50, odr_indicator = 137347550024776}}, reg_sites = {1039994224, 32766, 3097213112, 32746}, access_size = 137072672116736, size = 128 '\200'}, wild = {addr = 140646118029207, access_size = 140729938476288}}}}, function = 0x7feab9de6359 <___interceptor___tls_get_addr(void*)+89> "L\211\360H\213]\360L\213u\370\311\303f.\017\037\204"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}, size = 140729938414560}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, beg = 137416269502240, end = 0, old_mid = 0, new_mid = 6137508266440}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, storage_beg = 137416269502240, storage_end = 0, old_container_beg = 0, old_container_end = 6137508266440, new_container_beg = 137416269502240, new_container_end = 96}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, old_storage_beg = 137416269502240, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 6137508266440}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, global1 = {beg = 17847858330786070530, size = 137416269502240, size_with_redzone = 0, name = 0x0, module_name = 0x595000001c8 <error: Cannot access memory at address 0x595000001c8>, has_dynamic_init = 137416269502240, gcc_location = 0x60, odr_indicator = 137416269502144}, global2 = {beg = 232, size = 140728898445320, size_with_redzone = 140646088202608, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646118318016, gcc_location = 0x7ccab7ee0b90, odr_indicator = 140729938412608}, stack_id1 = 3117594424, stack_id2 = 32746}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, pc = 17847858330786070530, bp = 137416269502240, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6137508266440, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6137508266440, alloc_tid = 137416269502240, free_tid = 96, alloc_stack_id = 3085833920, free_stack_id = 31994, chunk_access = {bad_addr = 232, offset = 140728898445320, chunk_begin = 140646088202608, chunk_size = 140729938412656, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6137508266440, tid = 137416269502240, offset = 96, frame_pc = 137416269502144, access_size = 232, frame_descr = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>}, global = {addr = 6137508266440, static kMaxGlobals = 4, globals = {{beg = 137416269502240, size = 96, size_with_redzone = 137416269502144, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>, has_dynamic_init = 140646088202608, gcc_location = 0x7ffe3dfd0470, odr_indicator = 2}, {beg = 140646118318016, size = 137210111069072, size_with_redzone = 140729938412608, name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137210111069072, gcc_location = 0x7feab86050d0, odr_indicator = 140729938412640}, {beg = 137210111069088, size = 93829890737488, size_with_redzone = 140729938414960, name = 0x7beab6bdd220 "pU\356\267Z|", module_name = 0x7ffe3dfd0c90 "", has_dynamic_init = 140646117598145, gcc_location = 0x7ffe3dfd0460, odr_indicator = 131955619458}, {beg = 140729938412656, size = 2, size_with_redzone = 140646117598208, name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffe3dfd0c70 " \322\275\266\352{", has_dynamic_init = 140729938414464, gcc_location = 0x7feab92e1de0 <_nl_C_locobj>, odr_indicator = 140646104705891}}, reg_sites = {1, 0, 2036153261, 21846}, access_size = 140729938414560, size = 208 '\320'}, wild = {addr = 6137508266440, access_size = 137416269502240}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140646118029207, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140646118029207, alloc_tid = 140729938476288, free_tid = 140729938414200, alloc_stack_id = 982710784, free_stack_id = 4155528343, chunk_access = {bad_addr = 140729938414400, offset = 140646117859197, chunk_begin = 136729074750856, chunk_size = 140646118293368, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140646118029207, tid = 140729938476288, offset = 140729938414200, frame_pc = 17847858331768781312, access_size = 140729938414400, frame_descr = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140646118029207, static kMaxGlobals = 4, globals = {{beg = 140729938476288, size = 140729938414200, size_with_redzone = 17847858331768781312, name = 0x7ffe3dfd0b40 "H\024\356\267\352|", module_name = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136729074750856, gcc_location = 0x7feab9eb7f78, odr_indicator = 65535}, {beg = 17847858331768781312, size = 140646096287928, size_with_redzone = 140646118293368, name = 0x7c4ab7ee7c10 "", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136660355283936, gcc_location = 0x7c4ab7ee7c08, odr_indicator = 136660355283984}, {beg = 93829891626100, size = 64, size_with_redzone = 17031002307140, name = 0x7c6ab7ee1620 "@\024\356\267\352|", module_name = 0x7beab6bdd2c0 "\0166\340E", has_dynamic_init = 136385477427664, gcc_location = 0x5556795cb432 <bt_att_chan_cancel+402>, odr_indicator = 11}, {beg = 136660355283984, size = 11, size_with_redzone = 93829891667704, name = 0x7ceab7ee1440 "", module_name = 0x7beab6bdd320 "", has_dynamic_init = 17031002307160, gcc_location = 0x7ffe3dfd0b50, odr_indicator = 137347550024776}}, reg_sites = {1039994224, 32766, 3097213112, 32746}, access_size = 137072672116736, size = 128 '\200'}, wild = {addr = 140646118029207, access_size = 140729938476288}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137416269502240, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137416269502240, tid = 0, offset = 0, frame_pc = 6137508266440, access_size = 137416269502240, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137416269502240, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6137508266440, name = 0x7cfab7ee1720 "\240\025\356\267j|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137416269502144, gcc_location = 0xe8, odr_indicator = 140728898445320}, {beg = 140646088202608, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9ebdfc0 <__asan::instance> "", module_name = 0x7ccab7ee0b90 "\003\021", has_dynamic_init = 140729938412608, gcc_location = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137210111069072, size = 140646092394704, size_with_redzone = 140729938412640, name = 0x7ccab7ee0ba0 "\227\005", module_name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140729938414960, gcc_location = 0x7beab6bdd220, odr_indicator = 140729938414736}, {beg = 140646117598145, size = 140729938412640, size_with_redzone = 131955619458, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646117598208, gcc_location = 0x5556794d2e48 <gatt_server_cleanup+200>, odr_indicator = 140729938414704}}, reg_sites = {1039993728, 32766, 3106807264, 32746}, access_size = 140646104705891, size = 1 '\001'}, wild = {addr = 137416269502240, access_size = 0}}}}, pc = 93829891701677, bp = 140729938414560, sp = 140729938414544, access_size = 8, bug_descr = 0x7feab9e77797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137416269502240, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137416269502240, tid = 0, offset = 0, frame_pc = 6137508266440, access_size = 137416269502240, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137416269502240, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6137508266440, name = 0x7cfab7ee1720 "\240\025\356\267j|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137416269502144, gcc_location = 0xe8, odr_indicator = 140728898445320}, {beg = 140646088202608, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9ebdfc0 <__asan::instance> "", module_name = 0x7ccab7ee0b90 "\003\021", has_dynamic_init = 140729938412608, gcc_location = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137210111069072, size = 140646092394704, size_with_redzone = 140729938412640, name = 0x7ccab7ee0ba0 "\227\005", module_name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140729938414960, gcc_location = 0x7beab6bdd220, odr_indicator = 140729938414736}, {beg = 140646117598145, size = 140729938412640, size_with_redzone = 131955619458, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646117598208, gcc_location = 0x5556794d2e48 <gatt_server_cleanup+200>, odr_indicator = 140729938414704}}, reg_sites = {1039993728, 32766, 3106807264, 32746}, access_size = 140646104705891, size = 1 '\001'}, wild = {addr = 137416269502240, access_size = 0}}}}, pc = 93829891701677, bp = 140729938414560, sp = 140729938414544, access_size = 8, bug_descr = 0x7feab9e77797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007feab9e1bf8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140729938414560, sp=sp@entry=140729938414544, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007feab9e1d3f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140729938414560
                pc = <optimized out>
                local_stack = 140729938414960
                sp = 140729938414544
        #11 0x00005556795d3bad in discovery_op_free (op=0x7c6ab7ee16a0) at src/shared/gatt-client.c:407
        No locals.
        #12 0x0000555679700dea in bt_gatt_request_unref (req=0x7c6ab7ee2020) at src/shared/gatt-helpers.c:577
        No locals.
        #13 bt_gatt_request_unref (req=0x7c6ab7ee2020) at src/shared/gatt-helpers.c:566
        No locals.
        #14 0x00005556795c1474 in cancel_att_send_op (data=0x7c4ab7ee7be0) at src/shared/att.c:229
                op = 0x7c4ab7ee7be0
        #15 0x00005556795cc1b9 in bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1954
                chan = 0x7c6ab7ee1620
                entry = 0x7c0ab7ef41d0
        #16 bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1935
                entry = <optimized out>
                chan = <optimized out>
        #17 0x00005556795ccfa0 in bt_att_unref (att=0x7ceab7ee1440) at src/shared/att.c:1353
        No locals.
        #18 bt_att_unref (att=0x7ceab7ee1440) at src/shared/att.c:1344
        No locals.
        #19 0x00005556794e81bf in attio_cleanup (device=device@entry=0x7d5ab7ee0b00) at src/device.c:873
        No locals.
        #20 0x00005556794e86f7 in device_free (user_data=0x7d5ab7ee0b00) at src/device.c:918
                device = 0x7d5ab7ee0b00
                __func__ = "device_free"
        #21 0x00005556795694aa in remove_interface (data=0x7c5ab7ee5570, name=name@entry=0x55567978f380 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c4ab7ee6260
        #22 0x000055567956c06c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #23 0x000055567949e33b in remove_temporary_devices (adapter=adapter@entry=0x7d1ab7ee0200) at src/adapter.c:826
                dev = 0x7d5ab7ee0b00
                l = <optimized out>
                next = 0x0
        #24 0x000055567949f69a in adapter_shutdown () at src/adapter.c:11503
                adapter = 0x7d1ab7ee0200
                list = 0x7c1ab7ee3910 = {0x7d1ab7ee0200}
                __func__ = "adapter_shutdown"
        #25 0x000055567954017c in signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1517
                terminated = false
        #26 signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1504
                terminated = false
        #27 0x00005556796f537e in signal_read (io=<optimized out>, user_data=0x7c1ab7ee34c0) at src/shared/mainloop-notify.c:145
                data = <optimized out>
                si = <optimized out>
                result = <optimized out>
                fd = <optimized out>
        #28 0x00005556796f2275 in watch_callback (channel=<optimized out>, cond=<optimized out>, user_data=<optimized out>) at src/shared/io-glib.c:173
                watch = <optimized out>
                result = <optimized out>
                destroy = <optimized out>
        #29 0x00007feab9b27b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #30 0x00007feab9b291d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #31 0x00007feab9b29577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #32 0x00005556796f51d9 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #33 0x00005556796f5b0b in mainloop_run_with_signal (func=func@entry=0x555679540100 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7c1ab7ee34c0
                io = 0x7c2ab7ef9590
                ret = <optimized out>
        #34 0x00005556792713eb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1745
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bass_past_transport_acquire[hosts9-vm2]: AssertionError: Failed to acquire: org.bluez.Error.Failed
FAIL functional.test_bap::test_bass_past_earbuds_transport_acquire[hosts11-vm3]: AssertionError: Failed to acquire: org.bluez.Error.Failed


https://github.com/bluez/bluez/pull/2772

---
Regards,
Linux Bluetooth