pipewire-pulse crash in audioconvert/resample.c:reset_node
pipewire-pulse crash at ffc5c495, due to calling null pointer function.
Occurred when playing a stream with paplay, and switching Bluetooth headset from A2DP to HFP profile.
(gdb) thr a a bt
Thread 2 (Thread 0x7f3ed4297640 (LWP 201434)):
#0 0x00007f3ee689c69e in epoll_wait () from /lib64/libc.so.6
#1 0x00007f3ed57edc65 in impl_pollfd_wait (object=0x60c000000428, pfd=10, ev=0x7f3ed4296980, n_ev=32, timeout=-1) at ../spa/plugins/support/system.c:157
#2 0x00007f3ed57a3853 in loop_iterate (object=0x62d00000a428, timeout=-1) at ../spa/plugins/support/loop.c:318
#3 0x00007f3ee77e2c6c in do_loop (user_data=0x604000000290) at ../src/pipewire/data-loop.c:81
#4 0x00007f3ee2f2fb92 in custom_start (data=0x6060000028a0) at ../src/modules/module-rtkit.c:534
#5 0x00007f3ee6974299 in start_thread () from /lib64/libpthread.so.0
#6 0x00007f3ee689c353 in clone () from /lib64/libc.so.6
Thread 1 (Thread 0x7f3ee6405800 (LWP 201406)):
#0 0x00007f3ee67d92a2 in raise () from /lib64/libc.so.6
#1 0x00007f3ee67c28a4 in abort () from /lib64/libc.so.6
#2 0x00007f3ee812360f in __sanitizer::Abort() () from /lib64/libasan.so.6
#3 0x00007f3ee812e96c in __sanitizer::Die() () from /lib64/libasan.so.6
#4 0x00007f3ee810fdbc in __asan::ScopedInErrorReport::~ScopedInErrorReport() () from /lib64/libasan.so.6
#5 0x00007f3ee810db74 in __asan::ReportDeadlySignal(__sanitizer::SignalContext const&) () from /lib64/libasan.so.6
#6 0x00007f3ee810ceb2 in __asan::AsanOnDeadlySignal(int, void*, void*) () from /lib64/libasan.so.6
#7 <signal handler called>
#8 0x0000000000000000 in ?? ()
#9 0x00007f3ed359eedd in reset_node (this=0x7f3ed1dbcb78) at ../spa/plugins/audioconvert/resample.c:278
#10 0x00007f3ed359f776 in impl_node_send_command (object=0x7f3ed1dbcb78, command=0x7ffc54fd2bf0) at ../spa/plugins/audioconvert/resample.c:303
#11 0x00007f3ed34d3e52 in impl_node_send_command (object=0x7f3ed1b5cc08, command=0x7ffc54fd2bf0) at ../spa/plugins/audioconvert/audioconvert.c:886
#12 0x00007f3ed3487275 in impl_node_send_command (object=0x7f3ed1b5c828, command=0x7ffc54fd2bf0) at ../spa/plugins/audioconvert/audioadapter.c:705
#13 0x00007f3ee78c1958 in suspend_node (this=0x61d00000fa80) at ../src/pipewire/impl-node.c:403
#14 0x00007f3ee78efa2c in pw_impl_node_set_state (node=0x61d00000fa80, state=PW_NODE_STATE_SUSPENDED) at ../src/pipewire/impl-node.c:2100
#15 0x00007f3ed5012057 in client_node_removed (_data=0x7f3ed1ac8878) at ../src/modules/module-client-node/remote-node.c:1110
#16 0x00007f3ed501246d in client_node_destroy (_data=0x7f3ed1ac8878) at ../src/modules/module-client-node/remote-node.c:1125
#17 0x00007f3ee795d559 in pw_proxy_destroy (proxy=0x7f3ed1ac8800) at ../src/pipewire/proxy.c:256
#18 0x00007f3ee79a4eff in pw_stream_disconnect (stream=0x621000038500) at ../src/pipewire/stream.c:1841
#19 0x00007f3ed47e7832 in stream_free (stream=0x618000002880) at ../src/modules/module-protocol-pulse/stream.c:64
#20 0x00007f3ed479673f in do_delete_stream (client=0x6130000011c0, command=6, tag=195, m=0x606000005600) at ../src/modules/module-protocol-pulse/pulse-server.c:1855
#21 0x00007f3ed47d5dea in handle_packet (client=0x6130000011c0, msg=0x606000005600) at ../src/modules/module-protocol-pulse/server.c:99
#22 0x00007f3ed47d94bb in do_read (client=0x6130000011c0) at ../src/modules/module-protocol-pulse/server.c:264
#23 0x00007f3ed47d98f7 in on_client_data (data=0x6130000011c0, fd=20, mask=1) at ../src/modules/module-protocol-pulse/server.c:295
#24 0x00007f3ed57a4740 in source_io_func (source=0x608000001a20) at ../spa/plugins/support/loop.c:347
#25 0x00007f3ed57a42f4 in loop_iterate (object=0x62d000000428, timeout=-1) at ../spa/plugins/support/loop.c:335
#26 0x00007f3ee7891f98 in pw_main_loop_run (loop=0x604000000210) at ../src/pipewire/main-loop.c:155
#27 0x00005558663c5708 in main (argc=<error reading variable: Cannot access memory at address 0xffffffffffffef50>, argv=<error reading variable: Cannot access memory at address 0xffffffffffffef60>) at ../src/daemon/pipewire.c:129
(gdb) thread 1
[Switching to thread 1 (Thread 0x7f3ee6405800 (LWP 201406))]
#0 0x00007f3ee67d92a2 in raise () from /lib64/libc.so.6
(gdb) up
#1 0x00007f3ee67c28a4 in abort () from /lib64/libc.so.6
(gdb) up
#2 0x00007f3ee812360f in __sanitizer::Abort() () from /lib64/libasan.so.6
(gdb) up
#3 0x00007f3ee812e96c in __sanitizer::Die() () from /lib64/libasan.so.6
(gdb) up
#4 0x00007f3ee810fdbc in __asan::ScopedInErrorReport::~ScopedInErrorReport() () from /lib64/libasan.so.6
(gdb) up
#5 0x00007f3ee810db74 in __asan::ReportDeadlySignal(__sanitizer::SignalContext const&) () from /lib64/libasan.so.6
(gdb) up
#6 0x00007f3ee810ceb2 in __asan::AsanOnDeadlySignal(int, void*, void*) () from /lib64/libasan.so.6
(gdb) up
#7 <signal handler called>
(gdb) up
#8 0x0000000000000000 in ?? ()
(gdb) up
#9 0x00007f3ed359eedd in reset_node (this=0x7f3ed1dbcb78) at ../spa/plugins/audioconvert/resample.c:278
278 resample_reset(&this->resample);
(gdb) p this
$1 = (struct impl *) 0x7f3ed1dbcb78
(gdb) p this->resample
$2 = {cpu_flags = 19419, channels = 0, i_rate = 0, o_rate = 0, log = 0x0, rate = 0, quality = 0, free = 0x0, update_rate = 0x0, in_len = 0x0, out_len = 0x0, process = 0x0, reset = 0x0, delay = 0x0, data = 0x0}
(gdb) p resample_reset
No symbol "resample_reset" in current context.
(gdb) p this->resample->reset
$3 = (void (*)(struct resample *)) 0x0
log
[1633786779099469 pipewire-pulse][3][audioconvert.c:217 debug_params()] failed filter:
[1633786779099518 pipewire-pulse][3][audioadapter.c:706 impl_node_send_command()] audioadapter 0x7f3ed06e2828: can't send command 2: Toiminto ei ole tuettu
[1633786779099572 pipewire-pulse][3][impl-node.c:229 start_node()] pw.node: (PulseAudion äänenvoimakkuuden hallinta-0) start node error -95: Toiminto ei ole tuettu
[1633786779099616 pipewire-pulse][4][remote-node.c:502 client_node_command()] mod.client-node: node 0x7f3ed064e800: start failed
[1633786782660198 pipewire-pulse][3][audioconvert.c:202 debug_params()] params:
[1633786782660485 pipewire-pulse][3][audioconvert.c:217 debug_params()] failed filter:
[1633786782660534 pipewire-pulse][6][null:null null()] Object: size 184, type Spa:Pod:Object:Param:Format (262147), id Spa:Enum:ParamId:EnumFormat (3)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:mediaType (1), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 1 (Spa:Enum:MediaType:audio)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:mediaSubtype (2), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 1 (Spa:Enum:MediaSubtype:raw)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:format (65537), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 518 (Spa:Enum:AudioFormat:F32P)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:rate (65539), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Choice: type Spa:Enum:Choice:Range, flags 00000000 28 4
[1633786782660534 pipewire-pulse][6][null:null null()] Int 25
[1633786782660534 pipewire-pulse][6][null:null null()] Int 1
[1633786782660534 pipewire-pulse][6][null:null null()] Int 2147483647
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:channels (65540), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Int 1
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:position (65541), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Array: child.size 4, child.type Spa:Id
[1633786782660534 pipewire-pulse][6][null:null null()] Id 2 (Spa:Enum:AudioChannel:MONO)
[1633786782660534 pipewire-pulse][6][null:null null()] Object: size 152, type Spa:Pod:Object:Param:Format (262147), id Spa:Enum:ParamId:EnumFormat (3)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:mediaType (1), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 1 (Spa:Enum:MediaType:audio)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:mediaSubtype (2), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 1 (Spa:Enum:MediaSubtype:raw)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:format (65537), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Id 518 (Spa:Enum:AudioFormat:F32P)
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:rate (65539), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Int -1163138027
[1633786782660534 pipewire-pulse][6][null:null null()] Prop: key Spa:Pod:Object:Param:Format:Audio:channels (65540), flags 00000000
[1633786782660534 pipewire-pulse][6][null:null null()] Choice: type Spa:Enum:Choice:Range, flags 00000000 28 4
[1633786782660534 pipewire-pulse][6][null:null null()] Int 1
[1633786782660534 pipewire-pulse][6][null:null null()] Int 1
[1633786782660534 pipewire-pulse][6][null:null null()] Int 2147483647
[1633786782661326 pipewire-pulse][3][audioadapter.c:706 impl_node_send_command()] audioadapter 0x7f3ecfc88828: can't send command 2: Toiminto ei ole tuettu
[1633786782661373 pipewire-pulse][3][impl-node.c:229 start_node()] pw.node: (PulseAudion äänenvoimakkuuden hallinta-0) start node error -95: Toiminto ei ole tuettu
[1633786782661415 pipewire-pulse][4][remote-node.c:502 client_node_command()] mod.client-node: node 0x7f3ecfbf5800: start failed
[1633786782721702 pipewire-pulse][6][null:null null()] AddressSanitizer:DEADLYSIGNAL
[1633786782721702 pipewire-pulse][6][null:null null()] =================================================================
[1633786782721942 pipewire-pulse][6][null:null null()] ==201406==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffc54fd2960 sp 0x7ffc54fd2928 T0)
[1633786782721942 pipewire-pulse][6][null:null null()] ==201406==Hint: pc points to the zero page.
[1633786782721942 pipewire-pulse][6][null:null null()] ==201406==The signal is caused by a READ memory access.
[1633786782721942 pipewire-pulse][6][null:null null()] ==201406==Hint: address points to the zero page.
[1633786782724580 pipewire-pulse][6][null:null null()] #0 0x0 (<unknown module>)
[1633786782724649 pipewire-pulse][6][null:null null()] AddressSanitizer can not provide additional info.
[1633786782726566 pipewire-pulse][6][null:null null()] SUMMARY: AddressSanitizer: SEGV (<unknown module>)
[1633786782726644 pipewire-pulse][6][null:null null()] ==201406==ABORTING
[1633786783175069 systemd-coredump][2][coredump.c:802 submit_coredump()] Process 201406 (pipewire-pulse) of user 1000 dumped core.
Stack trace of thread 201406:
#0 0x00007f3ee67d92a2 raise (libc.so.6 + 0x3d2a2)
#1 0x00007f3ee67c28a4 abort (libc.so.6 + 0x268a4)
#2 0x00007f3ee812360f _ZN11__sanitizer5AbortEv (libasan.so.6 + 0xca60f)
#3 0x00007f3ee812e96c _ZN11__sanitizer3DieEv (libasan.so.6 + 0xd596c)
#4 0x00007f3ee810fdbc _ZN6__asan19ScopedInErrorReportD2Ev (libasan.so.6 + 0xb6dbc)
#5 0x00007f3ee810db74 _ZN6__asan18ReportDeadlySignalERKN11__sanitizer13SignalContextE (libasan.so.6 + 0xb4b74)
#6 0x00007f3ee810ceb2 _ZN6__asan18AsanOnDeadlySignalEiPvS0_ (libasan.so.6 + 0xb3eb2)
#7 0x00007f3ee697ea20 n/a (libpthread.so.0 + 0x13a20)
Stack trace of thread 201434:
#0 0x00007f3ee689c69e epoll_wait (libc.so.6 + 0x10069e)
#1 0x00007f3ed57edc65 n/a (/home/pauli/.local/lib/pipewire-local/lib64/spa-0.2/support/libspa-support.so + 0x100c65)
#2 0x00007f3ed57a3853 n/a (/home/pauli/.local/lib/pipewire-local/lib64/spa-0.2/support/libspa-support.so + 0xb6853)
#3 0x00007f3ee77e2c6c n/a (/home/pauli/.local/lib/pipewire-local/lib64/libpipewire-0.3.so.0.338.0 + 0x4e6c6c)
#4 0x00007f3ee2f2fb92 n/a (/home/pauli/.local/lib/pipewire-local/lib64/pipewire-0.3/libpipewire-module-rtkit.so + 0xeb92)
#5 0x00007f3ee6974299 start_thread (libpthread.so.0 + 0x9299)
#6 0x00007f3ee689c353 __clone (libc.so.6 + 0x100353)