Frequent segfaults in pipewire-pulse from libspa-audioconvert.so
- PipeWire version (
pipewire --version
):0.3.59.r3.gd22feab-1~ubuntu22.04
from pipewire-debian PPA - Distribution and distribution version (
PRETTY_NAME
from/etc/os-release
): Ubuntu 22.04.1 LTS - Desktop Environment: GNOME
- Kernel version (
uname -r
): 5.19.10
Description of Problem:
pipewire-pulse
frequently segfaults, mostly during bluetooth A2DP <--> HFP transitions, but not consistently reproducible.
Here's the backtrace:
(gdb) info threads
Id Target Id Frame
* 1 Thread 0x7f88f9c18640 (LWP 3792605) 0x00007f88f93f53d4 in _mm256_mul_ps (__B=..., __A=...) at /usr/lib/gcc/x86_64-linux-gnu/11/include/avxintrin.h:320
2 Thread 0x7f88fad5f740 (LWP 3792600) 0x00007f88fab25fde in epoll_wait (epfd=4, events=0x7fff30ecea80, maxevents=32, timeout=-1) at ../sysdeps/unix/sysv/linux/epoll_wait.c:30
(gdb) bt full
#0 0x00007f88f93f53d4 in _mm256_mul_ps (__B=..., __A=...) at /usr/lib/gcc/x86_64-linux-gnu/11/include/avxintrin.h:320
No locals.
#1 conv_f32d_to_s16_2_avx2 (conv=<optimized out>, dst=<optimized out>, src=<optimized out>, n_samples=256) at ../spa/plugins/audioconvert/fmt-ops-avx2.c:1054
s0 = 0x5645d7c0d5e0
s1 = 0x7f88f9353040
d = 0x5645d79d71e0
n = <optimized out>
unrolled = 256
in = <optimized out>
out = <optimized out>
t = <optimized out>
int_scale = {32768, 32768, 32768, 32768, 32768, 32768, 32768, 32768}
#2 0x00007f88f93d9b77 in impl_node_process (object=<optimized out>) at ../spa/plugins/audioconvert/audioconvert.c:2638
this = <optimized out>
src_datas = {0x5645d7c0d5e0, 0x7f88f9353040, 0x0 <repeats 63 times>}
in_datas = <optimized out>
dst_datas = {0x5645d79d71e0, 0x7f88f9ed2040, 0x0 <repeats 63 times>}
remap_src_datas = {0x7f88f9ee4040, 0x7f88f9ed2040, 0x0 <repeats 58 times>, 0x2000, 0x0, 0x0, 0x0, 0x0}
remap_dst_datas = {0x5645d3385d08, 0x7f88fae3f000, 0x0, 0x5645d33857a8, 0x7f88f9c17a20, 0x7f88f93a4a32, 0x7f88f9353040, 0x0 <repeats 58 times>}
out_datas = <optimized out>
dst_remap = <optimized out>
i = <optimized out>
j = <optimized out>
n_src_datas = <optimized out>
n_dst_datas = <optimized out>
n_mon_datas = <optimized out>
remap = <optimized out>
n_samples = 256
max_in = <optimized out>
n_out = 8192
max_out = 8192
quant_samples = <optimized out>
port = <optimized out>
ctrlport = <optimized out>
buf = <optimized out>
out_bufs = {0x5645d35ee8a8, 0x0 <repeats 64 times>}
bd = <optimized out>
dir = 0x5645d63a20f0
tmp = <optimized out>
res = <optimized out>
in_passthrough = <optimized out>
mix_passthrough = <optimized out>
resample_passthrough = true
out_passthrough = <optimized out>
in_avail = <optimized out>
flush_in = true
flush_out = true
draining = <optimized out>
in_empty = <optimized out>
io = <optimized out>
ctrlio = <optimized out>
ctrl = <optimized out>
__func__ = "impl_node_process"
_min_a = <optimized out>
_min_b = <optimized out>
#3 0x00007f88f93ba27b in impl_node_process (object=0x5645d639ff98) at ../spa/plugins/audioconvert/audioadapter.c:1423
_f = <optimized out>
_res = -95
_n = <optimized out>
this = 0x5645d639ff98
status = 0
fstatus = <optimized out>
retry = 7
__func__ = "impl_node_process"
#4 0x00007f88fadc4b19 in process_node (data=0x5645d342d6f0) at ../src/pipewire/impl-node.c:1120
_f = <optimized out>
_res = -95
_n = <optimized out>
this = 0x5645d342d6f0
ts = {
tv_sec = 166700,
tv_nsec = 540755518
}
p = <optimized out>
a = 0x7f88fae3f000
data_system = 0x5645d31a72e0
status = <optimized out>
__func__ = "process_node"
#5 0x00007f88fadc4f97 in node_on_fd_events (source=<optimized out>) at ../src/pipewire/impl-node.c:1178
cmd = 1
this = 0x5645d342d6f0
data_system = <optimized out>
__func__ = "node_on_fd_events"
#6 0x00007f88fae55a1e in ?? () from /usr/lib/x86_64-linux-gnu/spa-0.2/support/libspa-support.so
No symbol table info available.
#7 0x00007f88fada1e75 in do_loop (user_data=0x5645d31a7220) at ../src/pipewire/data-loop.c:81
_f = <optimized out>
_res = -95
_o = <optimized out>
__cancel_buf = {
__cancel_jmp_buf = {{
__cancel_jmp_buf = {140226282489408, -2425847898296228074, 140226282489408, 0, 140226297677904, 140734014221280, 2397141724239292182, 2397143724575221526},
__mask_was_saved = 0
}},
__pad = {0x7f88f9c17e70, 0x0, 0x5645d31ba028, 0x0}
}
_err = <optimized out>
__cancel_routine = 0x7f88fada1d10 <thread_cleanup>
__cancel_arg = 0x5645d31a7220
__not_first_call = <optimized out>
this = 0x5645d31a7220
res = <optimized out>
__func__ = "do_loop"
#8 0x00007f88faa94b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
ret = <optimized out>
pd = <optimized out>
out = <optimized out>
unwind_buf = {
cancel_jmp_buf = {{
jmp_buf = {140734014220928, -2425847898296228074, 140226282489408, 0, 140226297677904, 140734014221280, 2397141724182669078, 2397143581391251222},
mask_was_saved = 0
}},
priv = {
pad = {0x0, 0x0, 0x0, 0x0},
data = {
prev = 0x0,
cleanup = 0x0,
canceltype = 0
}
}
}
not_first_call = <optimized out>
#9 0x00007f88fab26a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
No locals.
How Reproducible:
Steps to Reproduce:
- Open pavucontrol
- Connect a bluetooth headset (in my case,
ATH-M50xBT2
) that supports A2DP and HFP modes. - Keep switching between modes until
pipewire-pulse
segfaults
Actual Results:
dmesg shows the segfault happening:
[166698.778053] pipewire-pulse[3792605]: segfault at 7f88f9353040 ip 00007f88f93f53d4 sp 00007f88f9c16aa8 error 4 in libspa-audioconvert.so[7f88f93b9000+3d000]
[166698.778089] Code: ff ff ff c5 fc 28 25 8b f7 00 00 31 c0 66 0f 1f 84 00 00 00 00 00 41 89 c1 44 8d 40 08 83 c0 10 48 83 c2 40 c4 a1 5c 59 0c 8f <c4> a1 5c 59 1c 8e c4 a1 5c 59 04 87 c4 a1 5c 59 14 86 c5 fd 5b c9
Attaching to the process with gdb doesn't seem to manage to get a backtrace, however, getting it from a coredump works.
Expected Results:
pipewire-pulse
doesn't segfault