pipewire-1.0.0 x11 bell segfault
- PipeWire version (
pipewire --version
): 1.0.0 - Distribution and distribution version (
PRETTY_NAME
from/etc/os-release
): Gentoo Linux - Desktop Environment: Mate
- Kernel version (
uname -r
): 6.5.8
Description of Problem:
Preliminary note: the original report describes the situation more in depth and contains multiple backtraces, helgring and valgrind logs. Please quickly skim through it.
There appear to be a race which makes X11 Bell segfault. The issue manifests itself under normal use, although not frequently (few times per day) but it can be forcibly triggered somewhat reliably by spamming BEL chars in a terminal.
Backtraces are usually quite messy, i'm posting the "cleanest" i got - you'll find the rest in the gentoo ticket.
Thread 1500 "X11 Bell" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe77fe6c0 (LWP 5501)]
thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
424 /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c: No such file or directory.
(gdb) bt
#0 thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
#1 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
(gdb) thread apply all bt
Thread 1500 (Thread 0x7fffe77fe6c0 (LWP 5501) "X11 Bell"):
#0 thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
#1 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
Thread 4 (Thread 0x7ffff5d186c0 (LWP 29386) "pipewire"):
#0 0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1 0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff5d17be0, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2 0x00007ffff7fae049 in loop_iterate (object=object@entry=0x55555556d4d8, timeout=timeout@entry=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3 0x00007ffff7ee6f66 in do_loop (user_data=0x55555556d370) at ../pipewire-1.0.0/src/pipewire/data-loop.c:65
#4 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
Thread 3 (Thread 0x7ffff65196c0 (LWP 29385) "X11 Bell"):
#0 0x00007ffff7fd4d9a in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#1 0x00007ffff7fd573c in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#2 0x00007ffff7fd91b5 in dl_open_worker_begin () from /lib64/ld-linux-x86-64.so.2
#3 0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#4 0x00007ffff7fd8966 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#5 0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#6 0x00007ffff7fd8d45 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#7 0x00007ffff7d58d08 in dlopen_doit () from /lib64/libc.so.6
#8 0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#9 0x00007ffff7fce5ef in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff7d587ea in _dlerror_run () from /lib64/libc.so.6
#11 0x00007ffff7d58dc1 in dlopen () from /lib64/libc.so.6
#12 0x00007ffff6564636 in ?? () from //usr/lib64/libltdl.so.7
#13 0x00007ffff65610e8 in ?? () from //usr/lib64/libltdl.so.7
#14 0x00007ffff6562ef1 in ?? () from //usr/lib64/libltdl.so.7
#15 0x00007ffff6563714 in lt_dlopenadvise () from //usr/lib64/libltdl.so.7
#16 0x00007ffff65637e0 in lt_dlopenext () from //usr/lib64/libltdl.so.7
#17 0x00007ffff65a96d0 in try_open (t=<optimized out>, c=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/dso.c:130
#18 0x00007ffff65a9afb in driver_open (c=c@entry=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/dso.c:232
#19 0x00007ffff65a1748 in context_open_unlocked (c=c@entry=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/common.c:293
#20 0x00007ffff65a1eff in ca_context_open (c=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/commo--Type <RET> for more, q to quit, c to continue without paging--c
n.c:318
#21 0x00007ffff672983d in play_sample (impl=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:107
#22 do_play_sample (loop=<optimized out>, async=<optimized out>, seq=<optimized out>, data=<optimized out>, size=<optimized out>, user_data=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:131
#23 0x00007ffff7fabbba in flush_items (impl=0x5555555a4d18) at ../pipewire-1.0.0/spa/plugins/support/loop.c:180
#24 0x00007ffff7faba03 in source_event_func (source=0x5555555ace60) at ../pipewire-1.0.0/spa/plugins/support/loop.c:663
#25 0x00007ffff7fae116 in loop_iterate (object=0x5555555a4d18, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/loop.c:496
#26 0x00007ffff7f506a7 in do_loop (user_data=0x5555555a4ae0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#27 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#28 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
Thread 2 (Thread 0x7ffff78906c0 (LWP 29383) "module-rt"):
#0 0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1 0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff788fc60, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2 0x00007ffff7fae049 in loop_iterate (object=0x5555555842f8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3 0x00007ffff7f506a7 in do_loop (user_data=0x555555582ab0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#4 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
Thread 1 (Thread 0x7ffff7cd2740 (LWP 29380) "pipewire"):
#0 0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1 0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7fffffffc620, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2 0x00007ffff7fae049 in loop_iterate (object=0x5555555602d8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3 0x00007ffff7f0e75f in pw_main_loop_run (loop=loop@entry=0x555555560180) at ../pipewire-1.0.0/src/pipewire/main-loop.c:128
#4 0x0000555555555478 in main (argc=<optimized out>, argv=<optimized out>) at ../pipewire-1.0.0/src/daemon/pipewire.c:111
How Reproducible:
Reliably on my box
Steps to Reproduce:
- run pipewire (without config)
- run wireplumber
- run one or more BEL loops e.g.
while true; do echo -e '\007' & done
Actual Results:
- notice pipewire (1.) dies
- notice wireplumber (2.) exits
- notice X11 bell has segfaulted e.g.
X11 Bell[31380]: segfault at 7fe167255b34 ip 00007fe167255b34 sp 00007fe1654a8e50 error 14 in memfd:pipewire-memfd:flags=0x0000000f,type=2,size=2312 (deleted)[7fe16725a000+1000] likely on CPU 6 (core 10, socket 0)
Expected Results:
No SEGV expected
Additional Info (as attachments):
-
pw-dump > pw-dump.log
:pw-dump.log