[Recover]a possible use-after-free bug in costmap_subscriber

[easylyou]

Bug report

Required Info:

• Operating System:
  • Ubuntu 20.04 LTS
• ROS2 Version:
  • Foxy
• Version or commit hash:
  • a7955d8
• DDS implementation:
  • default

Steps to reproduce issue

I had done some tests. And it can be reproduced.

//in navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp

void CostmapSubscriber::toCostmap2D()
{
  ...
  
  unsigned char * master_array = costmap_->getCharMap();
  unsigned int index = 0;
  for (unsigned int i = 0; i < costmap_msg_->metadata.size_x; ++i) {
    for (unsigned int j = 0; j < costmap_msg_->metadata.size_y; ++j) {
      //2. costmap_msg_ is pointing a freed memory, use-after-free, or out-of-bound if the size changed
      master_array[index] = costmap_msg_->data[index];
      ++index;
    }
  }
}

void CostmapSubscriber::costmapCallback(const nav2_msgs::msg::Costmap::SharedPtr msg)
{
  //1. release old shared_ptr, map will be freed
  costmap_msg_ = msg;
  if (!costmap_received_) {
    costmap_received_ = true;
  }
}

Expected behavior

Process should not crash.

Actual behavior

The cause is the same as #2507.

Additional information

==69084==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100012b6f0 at pc 0x7ffb379116b2 bp 0x7ffb2a6986f0 sp 0x7ffb2a6986e8
READ of size 8 at 0x61100012b6f0 thread T13
    #0 0x7ffb379116b1 in std::vector<unsigned char, std::allocator<unsigned char> >::operator[](unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/stl_vector.h:1043:25
    #1 0x7ffb36dcd60d in nav2_costmap_2d::CostmapSubscriber::toCostmap2D() /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp:91:29
    #2 0x7ffb36dccbaa in nav2_costmap_2d::CostmapSubscriber::getCostmap() /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_subscriber.cpp:62:3
    #3 0x7ffb36e22c79 in nav2_costmap_2d::CostmapTopicCollisionChecker::scorePose(geometry_msgs::msg::Pose2D_<std::allocator<void> > const&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_topic_collision_checker.cpp:78:48
    #4 0x7ffb36e210de in nav2_costmap_2d::CostmapTopicCollisionChecker::isCollisionFree(geometry_msgs::msg::Pose2D_<std::allocator<void> > const&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_costmap_2d/src/costmap_topic_collision_checker.cpp:58:9
    #5 0x7ffb2aaf799f in nav2_recoveries::Spin::isCollisionFree(double const&, geometry_msgs::msg::Twist_<std::allocator<void> >*, geometry_msgs::msg::Pose2D_<std::allocator<void> >&) /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/plugins/spin.cpp:164:30
    #6 0x7ffb2aaf6a3c in nav2_recoveries::Spin::onCycleUpdate() /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/plugins/spin.cpp:133:8
    #7 0x7ffb2ab13a82 in nav2_recoveries::Recovery<nav2_msgs::action::Spin>::execute() /home/r1/ros2_clang_navigation/src/navigation2/nav2_recoveries/include/nav2_recoveries/recovery.hpp:201:15
    #8 0x7ffb2ab19a60 in void std::__invoke_impl<void, void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>(std::__invoke_memfun_deref, void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
    #9 0x7ffb2ab1988d in std::__invoke_result<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>::type std::__invoke<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&>(void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::*&)(), nav2_recoveries::Recovery<nav2_msgs::action::Spin>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #10 0x7ffb2ab197d5 in void std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:400:11
    #11 0x7ffb2ab195f3 in void std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/functional:482:17
    #12 0x7ffb2ab19100 in std::_Function_handler<void (), std::_Bind<void (nav2_recoveries::Recovery<nav2_msgs::action::Spin>::* (nav2_recoveries::Recovery<nav2_msgs::action::Spin>*))()> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:300:2
    #13 0x7ffb39451c68 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
    #14 0x7ffb2ab4f7a2 in nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::work() /home/r1/ros2_clang_navigation/install/nav2_util/include/nav2_util/simple_action_server.hpp:144:9
    #15 0x7ffb2ab4f0a0 in nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()::operator()() const /home/r1/ros2_clang_navigation/install/nav2_util/include/nav2_util/simple_action_server.hpp:135:68
    #16 0x7ffb2ab4f040 in nav2_msgs::action::Spin std::__invoke_impl<void, nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()>(std::__invoke_other, rclcpp_lifecycle::LifecycleNode&&, nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:60:14
    #17 0x7ffb2ab4ef90 in std::__invoke_result<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode...>::type std::__invoke<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()>(nav2_msgs::action::Spin&&, rclcpp_lifecycle::LifecycleNode&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #18 0x7ffb2ab4ef58 in void std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
    #19 0x7ffb2ab4ecc8 in std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
    #20 0x7ffb2ab4e9cf in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:1362:6
    #21 0x7ffb2ab4e62e in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:285:9
    #22 0x7ffb3939a32f in std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/std_function.h:688:14
    #23 0x7ffb39399c04 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:561:27
    #24 0x7ffb3939a273 in void std::__invoke_impl<void, void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::__invoke_memfun_deref, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:73:14
    #25 0x7ffb39399fd7 in std::__invoke_result<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>::type std::__invoke<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #26 0x7ffb39399f48 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:671:4
    #27 0x7ffb39399e26 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda0'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:676:25
    #28 0x7ffb39399da2 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&)::'lambda0'()::__invoke() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:676:21
    #29 0x7ffb3644547e in __pthread_once_slow /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_once.c:116:7
    #30 0x7ffb3936fe60 in __gthread_once(int*, void (*)()) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/x86_64-linux-gnu/c++/9/bits/gthr-default.h:700:12
    #31 0x7ffb39399a3c in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/mutex:683:17
    #32 0x7ffb39398cbc in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:401:2
    #33 0x7ffb2ab4bc84 in std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/future:1662:3
    #34 0x7ffb2ab4b9a0 in nav2_msgs::action::Spin std::__invoke_impl<void, std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()>(std::__invoke_other, rclcpp_lifecycle::LifecycleNode&&, std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:60:14
    #35 0x7ffb2ab4b8f0 in std::__invoke_result<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode...>::type std::__invoke<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()>(nav2_msgs::action::Spin&&, rclcpp_lifecycle::LifecycleNode&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/invoke.h:95:14
    #36 0x7ffb2ab4b8b8 in void std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:244:13
    #37 0x7ffb2ab4b878 in std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:251:11
    #38 0x7ffb2ab4b692 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >, void>::_Async_state_impl(std::thread::_Invoker<std::tuple<nav2_util::SimpleActionServer<nav2_msgs::action::Spin, rclcpp_lifecycle::LifecycleNode>::handle_accepted(std::shared_ptr<rclcpp_action::ServerGoalHandle<nav2_msgs::action::Spin> >)::'lambda'()> >&&)::'lambda'()> > >::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/thread:195:13
    #39 0x7ffb35ef0de3  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6de3)
    #40 0x7ffb3643c608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
    #41 0x7ffb35bd3292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95