Crash in `impl_add_listener` coming from `pw_core_spa_device_export`
- Fedora 32
- pipewire 0.3.9
Pipewire regularly crashes for me on Fedora 32 (~once per day). It is yet still unclear what exactly are the steps that reproduce that crash.
Here is the trace:
PID: 9639 (pipewire-media-)
UID: 1000 (bjoern)
GID: 1000 (bjoern)
Signal: 11 (SEGV)
Timestamp: Tue 2020-08-18 09:37:05 CEST (2h 58min ago)
Command Line: /usr/bin/pipewire-media-session -d bluez5
Executable: /usr/bin/pipewire-media-session
Control Group: /user.slice/user-1000.slice/user@1000.service/pipewire.service
Unit: user@1000.service
User Unit: pipewire.service
Slice: user-1000.slice
Owner UID: 1000 (bjoern)
Boot ID: c7e0ecb8393b4338889f55f703914f1e
Machine ID: 995443f1f6d243e787e3f4243cd8d44b
Hostname: xps-9370
Storage: /var/lib/systemd/coredump/core.pipewire-media-.1000.c7e0ecb8393b4338889f55f703914f1e.9639.1597736225000000000000.lz4
Message: Process 9639 (pipewire-media-) of user 1000 dumped core.
Stack trace of thread 9639:
#0 0x00007fd9a59b141d impl_add_listener (libspa-alsa.so + 0x1441d)
#1 0x00007fd9a5aa1165 pw_core_spa_device_export (libpipewire-module-client-device.so + 0x3165)
#2 0x00007fd9a734496c pw_core_export (libpipewire-0.3.so.0 + 0x2f96c)
#3 0x0000561783cec3e7 sm_media_session_export_device (pipewire-media-session + 0x2f3e7)
#4 0x0000561783cd6cbf alsa_udev_object_info (pipewire-media-session + 0x19cbf)
#5 0x00007fd9a59afd71 emit_object_info.isra.0 (libspa-alsa.so + 0x12d71)
#6 0x00007fd9a59b0547 impl_device_add_listener (libspa-alsa.so + 0x13547)
#7 0x0000561783cd80fd sm_alsa_monitor_start (pipewire-media-session + 0x1b0fd)
#8 0x0000561783ccf6ae main (pipewire-media-session + 0x126ae)
#9 0x00007fd9a6ff6042 __libc_start_main (libc.so.6 + 0x27042)
#10 0x0000561783ccfa7e _start (pipewire-media-session + 0x12a7e)
Stack trace of thread 9641:
#0 0x00007fd9a70d0c5e epoll_wait (libc.so.6 + 0x101c5e)
#1 0x00007fd9a73d9518 impl_pollfd_wait (libspa-support.so + 0x7518)
#2 0x00007fd9a73d6f20 loop_iterate (libspa-support.so + 0x4f20)
#3 0x00007fd9a7344f07 do_loop (libpipewire-0.3.so.0 + 0x2ff07)
#4 0x00007fd9a71a2432 start_thread (libpthread.so.0 + 0x9432)
#5 0x00007fd9a70d0913 __clone (libc.so.6 + 0x101913)
GNU gdb (GDB) Fedora 9.1-5.fc32
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/pipewire-media-session...
Reading symbols from /usr/lib/debug/usr/bin/pipewire-media-session-0.3.9-1.fc32.x86_64.debug...
warning: core file may not match specified executable file.
[New LWP 9639]
[New LWP 9641]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/bin/pipewire-media-session -d bluez5'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007fd9a59b141d in impl_add_listener (object=0x561784f773a8, listener=0x561784f7cc70, events=0x7fd9a5aaab40 <pw_protocol_native_device_event_marshal>, data=0x561784f7caa0)
at ../spa/plugins/alsa/alsa-acp-device.c:234
234 profile = card->profiles[card->active_profile_index];
[Current thread is 1 (Thread 0x7fd9a6c0c7c0 (LWP 9639))]
Missing separate debuginfos, use: dnf debuginfo-install alsa-lib-1.2.3.2-1.fc32.x86_64 dbus-libs-1.12.20-1.fc32.x86_64 glibc-2.31-4.fc32.x86_64 libgcc-10.2.1-1.fc32.x86_64 libgcrypt-1.8.5-3.fc32.x86_64 libgpg-error-1.36-3.fc32.x86_64 lz4-libs-1.9.1-2.fc32.x86_64 sssd-client-2.3.1-2.fc32.x86_64 systemd-libs-245.7-1.fc32.x86_64 xz-libs-5.2.5-1.fc32.x86_64
(gdb) thread apply all bt full
Thread 2 (Thread 0x7fd9a6337700 (LWP 9641)):
#0 0x00007fd9a70d0c5e in epoll_wait () from /lib64/libc.so.6
No symbol table info available.
#1 0x00007fd9a73d9518 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7fd9a6336c10, n_ev=<optimized out>, timeout=<optimized out>) at ../spa/plugins/support/system.c:154
ep = 0x7fd9a6336a60
i = <optimized out>
nfds = <optimized out>
#2 0x00007fd9a73d6f20 in loop_iterate (object=0x561784f0eec8, timeout=-1) at ../spa/plugins/support/loop.c:285
_f = <optimized out>
_res = -95
_o = <optimized out>
impl = 0x561784f0eec8
loop = 0x561784f0eee0
ep = {{events = 0, data = 0x0} <repeats 32 times>}
i = <optimized out>
nfds = <optimized out>
#3 0x00007fd9a7344f07 in do_loop (user_data=0x561784f0ed70) at ../src/pipewire/data-loop.c:77
_f = <optimized out>
_res = -95
_o = <optimized out>
__clframe = <optimized out>
this = 0x561784f0ed70
res = <optimized out>
__func__ = "do_loop"
#4 0x00007fd9a71a2432 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#5 0x00007fd9a70d0913 in clone () from /lib64/libc.so.6
No symbol table info available.
Thread 1 (Thread 0x7fd9a6c0c7c0 (LWP 9639)):
#0 0x00007fd9a59b141d in impl_add_listener (object=0x561784f773a8, listener=0x561784f7cc70, events=0x7fd9a5aaab40 <pw_protocol_native_device_event_marshal>, data=0x561784f7caa0) at ../spa/plugins/alsa/alsa-acp-device.c:234
this = 0x561784f773a8
save = {list = {next = 0x0, prev = 0x2ab34ee598a6d000}}
card = 0x561784f5be30
profile = <optimized out>
i = <optimized out>
__func__ = "impl_add_listener"
#1 0x00007fd9a5aa1165 in pw_core_spa_device_export (core=<optimized out>, type=<optimized out>, props=<optimized out>, object=0x561784f773c0, user_data_size=<optimized out>) at ../src/modules/module-client-device/proxy-device.c:84
_f = <optimized out>
_res = -95
_o = 0x561784f773c0
device = 0x561784f773c0
iface = 0x561784f7caa0
diface = 0x561784f773c0
proxy = 0x561784f7caa0
data = 0x561784f7cc68
#2 0x00007fd9a734496c in pw_core_export (core=0x561784f28d00, type=0x561783d08cea "Spa:Pointer:Interface:Device", props=0x561784f7c780, object=0x561784f773c0, user_data_size=336) at ../src/pipewire/core.c:287
proxy = <optimized out>
t = <optimized out>
res = <optimized out>
__func__ = "pw_core_export"
#3 0x0000561783cec3e7 in sm_media_session_export_device (sess=0x7fff5e45aed0, props=0x561784f7c780, object=0x561784f773c0) at ../src/examples/media-session/media-session.c:1415
impl = 0x7fff5e45aed0
device = <optimized out>
handle = <optimized out>
__func__ = "sm_media_session_export_device"
#4 0x0000561783cd6cbf in alsa_create_device (info=0x7fff5e45ab90, id=<optimized out>, impl=0x561784f4f960) at ../src/examples/media-session/alsa-monitor.c:771
res = <optimized out>
iface = 0x561784f773c0
card = <optimized out>
context = <optimized out>
device = 0x561784f7c670
handle = 0x561784f773a8
factory_name = <optimized out>
context = <optimized out>
device = <optimized out>
handle = <optimized out>
res = <optimized out>
iface = <optimized out>
card = <optimized out>
factory_name = <optimized out>
__func__ = "alsa_create_device"
_err = <optimized out>
reserve = <optimized out>
#5 alsa_udev_object_info (data=0x561784f4f960, id=<optimized out>, info=0x7fff5e45ab90) at ../src/examples/media-session/alsa-monitor.c:839
impl = <optimized out>
device = 0x0
#6 0x00007fd9a59afd71 in emit_object_info (this=this@entry=0x561784f57b58, id=1, dev=dev@entry=0x561784f58a50) at ../spa/plugins/alsa/alsa-udev.c:311
_f = <optimized out>
_l = 0x561784f57ba0
_h = <optimized out>
_t = 0x561784f57ba0
info = {version = 0, type = 0x7fd9a5a1a109 "Spa:Pointer:Interface:Device", factory_name = 0x7fd9a5a1a203 "api.alsa.pcm.device", change_mask = 3, flags = 0, props = 0x7fff5e45ab80}
ctl_hndl = 0x561784f5b900
str = <optimized out>
path = "hw:1\000V\000\000\000\000\000\000\000\000\000\000\300\255E^\377\177\000\000\001\000\000\000\000\000\000"
items = {{key = 0x7fd9a5a1a217 "device.enum.api", value = 0x7fd9a5a1a4a4 "udev"}, {key = 0x7fd9a5a1a227 "device.api", value = 0x7fd9a5a1a232 "alsa"}, {key = 0x7fd9a5a1a237 "media.class", value = 0x7fd9a5a1a243 "Audio/Device"}, {key = 0x7fd9a5a1a250 "api.alsa.path", value = 0x7fff5e45ad30 "hw:1"}, {key = 0x7fd9a5a1a25e "api.alsa.card", value = 0x561784f588cb "1"}, {key = 0x7fd9a5a1a295 "device.profile-set", value = 0x561784f5a4f0 "dell-dock-tb16-usb-audio.conf"}, {key = 0x7fd9a5a1a2c6 "device.plugged.usec", value = 0x561784f58be0 "2420721248"}, {key = 0x7fd9a5a1a2e2 "device.bus-path", value = 0x561784f58c50 "pci-0000:39:00.0-usb-0:2.5:1.0"}, {key = 0x7fd9a5a1a2f2 "device.sysfs.path", value = 0x561784f58920 "/sys/devices/pci0000:00/0000:00:1c.4/0000:03:00.0/0000:04:02.0/0000:39:00.0/usb3/3-2/3-2.5/3-2.5:1.0/sound/card1"}, {key = 0x7fd9a5a1a30a "device.bus-id", value = 0x561784f598e0 "usb-Generic_USB_Audio_200901010001-00"}, {key = 0x7fd9a5a1a31f "device.bus", value = 0x561784f59a50 "usb"}, {key = 0x7fd9a5a1a334 "device.subsystem", value = 0x561784f58b10 "sound"}, {key = 0x7fd9a5a1a352 "device.vendor.id", value = 0x561784f59500 "0bda"}, {key = 0x7fd9a5a1a393 "device.vendor.name", value = 0x561784f59020 "Realtek Semiconductor Corp."}, {key = 0x7fd9a5a1a3b2 "device.product.id", value = 0x561784f59170 "4014"}, {key = 0x7fd9a5a1a3f1 "device.product.name", value = 0x7fff5e45ab40 "USB Audio"}, {key = 0x7fd9a5a1a40f "device.serial", value = 0x561784f590a0 "Generic_USB_Audio_200901010001"}, {key = 0x561784f589a8 "", value = 0x5b703d2a970cd7bb <error: Cannot access memory at address 0x5b703d2a970cd7bb>}, {key = 0x0, value = 0x561784f589a0 "\200Y\227\245\331\177"}, {key = 0x7fd9a5a1a14b "DEVPATH", value = 0x7fd9a5a1a14b "DEVPATH"}, {key = 0x7fff5e45adc0 "\001", value = 0x0}, {key = 0x5e05adc0 <error: Cannot access memory at address 0x5e05adc0>, value = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>}, {key = 0x0, value = 0x561784f57b58 ""}}
n_items = <optimized out>
res = <optimized out>
pcm = 0
__func__ = "emit_object_info"
#7 0x00007fd9a59b0547 in emit_device (dev=0x561784f58a50, enumerated=true, action=0, this=0x561784f57b58) at ../spa/plugins/alsa/alsa-udev.c:381
id = 1
id = <optimized out>
_l = <optimized out>
_h = <optimized out>
_t = <optimized out>
_f = <optimized out>
#8 enum_devices (this=0x561784f57b58) at ../spa/plugins/alsa/alsa-udev.c:474
dev = 0x561784f58a50
enumerate = 0x7fff5e45adc0
devices = 0x561784f729e0
#9 impl_device_add_listener (object=0x561784f57b58, listener=0x561784f4f9b0, events=<optimized out>, data=<optimized out>) at ../spa/plugins/alsa/alsa-udev.c:527
res = <optimized out>
this = 0x561784f57b58
save = {list = {next = 0x7fff5e45adb0, prev = 0x7fff5e45adb0}}
__func__ = "impl_device_add_listener"
#10 0x0000561783cd80fd in sm_alsa_monitor_start (session=0x7fff5e45aed0) at ../src/examples/media-session/alsa-monitor.c:930
_f = <optimized out>
_res = -95
_o = <optimized out>
context = <optimized out>
impl = 0x561784f4f960
iface = 0x561784f57b70
str = <optimized out>
res = 0
__func__ = "sm_alsa_monitor_start"
#11 0x0000561783ccf6ae in main (argc=<optimized out>, argv=<optimized out>) at ../src/examples/media-session/media-session.c:2045
name = 0x561783d0f897 "alsa-acp"
impl = {this = {session = 0x0, props = 0x561784f05ce0, session_id = 0, client_session = 0x0, loop = 0x561784f05e60, context = 0x561784f0e260, dbus_connection = 0x561784f25f90, metadata = 0x561784f4f370, info = 0x0}, loop = 0x561784f05e30, dbus = 0x561784f179a0, monitor_core = 0x561784f28d00, monitor_listener = {link = {next = 0x561784f28d58, prev = 0x561784f28da8}, cb = {funcs = 0x561783d1fc60 <monitor_core_events>, data = 0x7fff5e45aed0}, removed = 0x0, priv = 0x0}, monitor_seq = 1073741827, policy_core = 0x561784f3bdb0, policy_listener = {link = {next = 0x561784f3be08, prev = 0x561784f3be58}, cb = {funcs = 0x561783d1fc00 <policy_core_events>, data = 0x7fff5e45aed0}, removed = 0x0, priv = 0x0}, proxy_policy_listener = {link = {next = 0x561784f3bdf8, prev = 0x561784f3be88}, cb = {funcs = 0x561783d1fbc0 <proxy_core_events>, data = 0x7fff5e45aed0}, removed = 0x0, priv = 0x0}, registry = 0x561784f4ee50, registry_listener = {link = {next = 0x561784f4eea8, prev = 0x561784f4eea8}, cb = {funcs = 0x561783d1fcf0 <registry_events>, data = 0x7fff5e45aed0}, removed = 0x0, priv = 0x0}, globals = {items = {data = 0x561784f25b60, size = 0, alloc = 512, extend = 64}, free_list = 4294967295}, global_list = {next = 0x7fff5e45b030, prev = 0x7fff5e45b030}, hooks = {list = {next = 0x561784f4eed8, prev = 0x561784f4f578}}, endpoint_link_list = {next = 0x7fff5e45b050, prev = 0x7fff5e45b050}, endpoint_links = {items = {data = 0x561784f25d70, size = 0, alloc = 512, extend = 64}, free_list = 4294967295}, link_list = {next = 0x7fff5e45b088, prev = 0x7fff5e45b088}, sync_list = {next = 0x7fff5e45b098, prev = 0x7fff5e45b098}, rescan_seq = 0, last_seq = 0}
support = <optimized out>
n_support = 8
res = <optimized out>
c = <optimized out>
opt_enabled = <optimized out>
opt_disabled = 0x7fff5e45c84a "bluez5"
opt_properties = <optimized out>
long_options = {{name = 0x561783d0f7e1 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x561783d0f7e6 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x561783d0f7ee "enabled", has_arg = 1, flag = 0x0, val = 101}, {name = 0x561783d0f7f6 "disabled", has_arg = 1, flag = 0x0, val = 100}, {name = 0x561783d0f7ff "properties", has_arg = 1, flag = 0x0, val = 112}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
i = <optimized out>
item = <optimized out>
__func__ = "main"