[Recover]a possible use-after-free bug in costmap_subscriber #2529
Description
Bug report
Required Info:
- Operating System:
- Ubuntu 20.04 LTS
- ROS2 Version:
- Foxy
- Version or commit hash:
- DDS implementation:
- default
Steps to reproduce issue
I had done some tests. And it can be reproduced.
//in navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp
void CostmapSubscriber::toCostmap2D()
{
...
unsigned char * master_array = costmap_->getCharMap();
unsigned int index = 0;
for (unsigned int i = 0; i < costmap_msg_->metadata.size_x; ++i) {
for (unsigned int j = 0; j < costmap_msg_->metadata.size_y; ++j) {
//2. costmap_msg_ is pointing a freed memory, use-after-free, or out-of-bound if the size changed
master_array[index] = costmap_msg_->data[index];
++index;
}
}
}
void CostmapSubscriber::costmapCallback(const nav2_msgs::msg::Costmap::SharedPtr msg)
{
//1. release old shared_ptr, map will be freed
costmap_msg_ = msg;
if (!costmap_received_) {
costmap_received_ = true;
}
}Expected behavior
Process should not crash.
Actual behavior
The cause is the same as #2507.
Additional information
==69084==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100012b6f0 at pc 0x7ffb379116b2 bp 0x7ffb2a6986f0 sp 0x7ffb2a6986e8
READ of size 8 at 0x61100012b6f0 thread T13
#0 0x7ffb379116b1 in std::vector<unsigned char, std::allocator<unsigned char> >::operator[](unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_vector.h:1043:25
#1 0x7ffb36dcd60d in nav2_costmap_2d::CostmapSubscriber::toCostmap2D() /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp:91:29
#2 0x7ffb36dccbaa in nav2_costmap_2d::CostmapSubscriber::getCostmap() /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp:62:3
#3 0x7ffb36e22c79 in nav2_costmap_2d::CostmapTopicCollisionChecker::scorePose(geometry_msgs::msg::Pose2D_<std::allocator<void> > const&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_topic_collision_checker.cpp:78:48
#4 0x7ffb36e210de in nav2_costmap_2d::CostmapTopicCollisionChecker::isCollisionFree(geometry_msgs::msg::Pose2D_<std::allocator<void> > const&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_topic_collision_checker.cpp:58:9
#5 0x7ffb2aaf799f in nav2_recoveries::Spin::isCollisionFree(double const&, geometry_msgs::msg::Twist_<std::allocator<void> >*, geometry_msgs::msg::Pose2D_<std::allocator<void> >&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/plugins/spin.cpp:164:30
#6 0x7ffb2aaf6a3c in nav2_recoveries::Spin::onCycleUpdate() /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/plugins/spin.cpp:133:8
#7 0x7ffb2ab13a82 in nav2_recoveries::Recovery<nav2_msgs::action::Spin>::execute() /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/include/nav2_recoveries/recovery.hpp:201:15
#8 0x7ffb2ab19a60 in void std::__invoke_impl<void, void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>(std::__invoke_memfun_deref, void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#9 0x7ffb2ab1988d in std::__invoke_result<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>::type std::__invoke<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>(void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#10 0x7ffb2ab197d5 in void std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
#11 0x7ffb2ab195f3 in void std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
#12 0x7ffb2ab19100 in std::_Function_handler<void (), std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
#13 0x7ffb39451c68 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#14 0x7ffb2ab4f7a2 in nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::work() /home/r1/ros2_clang_navigation/install/nav2_util/include/nav2_util/simple_action_server.hpp:144:9
#15 0x7ffb2ab4f0a0 in nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()::operator()() const /home/r1/ros2_clang_navigation/install/nav2_util/include/nav2_util/simple_action_server.hpp:135:68
#16 0x7ffb2ab4f040 in nav2_msgs::action::Spin std::__invoke_impl<void, nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()>(std::__invoke_other, rclcpp_lifecycle::LifecycleNode&&, nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:60:14
#17 0x7ffb2ab4ef90 in std::__invoke_result<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode...>::type std::__invoke<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()>(nav2_msgs::action::Spin&&, rclcpp_lifecycle::LifecycleNode&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#18 0x7ffb2ab4ef58 in void std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
#19 0x7ffb2ab4ecc8 in std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
#20 0x7ffb2ab4e9cf in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:1362:6
#21 0x7ffb2ab4e62e in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:285:9
#22 0x7ffb3939a32f in std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
#23 0x7ffb39399c04 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:561:27
#24 0x7ffb3939a273 in void std::__invoke_impl<void, void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::__invoke_memfun_deref, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
#25 0x7ffb39399fd7 in std::__invoke_result<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>::type std::__invoke<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#26 0x7ffb39399f48 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:671:4
#27 0x7ffb39399e26 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda0'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:676:25
#28 0x7ffb39399da2 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda0'()::__invoke() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:676:21
#29 0x7ffb3644547e in __pthread_once_slow /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_once.c:116:7
#30 0x7ffb3936fe60 in __gthread_once(int*, void (*)()) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/x86_64-linux-gnu/c++/9/bits/gthr-default.h:700:12
#31 0x7ffb39399a3c in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:683:17
#32 0x7ffb39398cbc in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:401:2
#33 0x7ffb2ab4bc84 in std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:1662:3
#34 0x7ffb2ab4b9a0 in nav2_msgs::action::Spin std::__invoke_impl<void, std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()>(std::__invoke_other, rclcpp_lifecycle::LifecycleNode&&, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:60:14
#35 0x7ffb2ab4b8f0 in std::__invoke_result<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode...>::type std::__invoke<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()>(nav2_msgs::action::Spin&&, rclcpp_lifecycle::LifecycleNode&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
#36 0x7ffb2ab4b8b8 in void std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
#37 0x7ffb2ab4b878 in std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
#38 0x7ffb2ab4b692 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> > >::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:195:13
#39 0x7ffb35ef0de3 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6de3)
#40 0x7ffb3643c608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#41 0x7ffb35bd3292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95