Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 919133 - media-video/pipewire-1.0.0 x11 bell segfault
Summary: media-video/pipewire-1.0.0 x11 bell segfault
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Normal normal (vote)
Assignee: Sam James
URL: https://gitlab.freedesktop.org/pipewi...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-04 01:33 UTC by acab
Modified: 2023-12-09 18:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge.log,7.91 KB, text/plain)
2023-12-04 01:33 UTC, acab
Details
helgrind logs (asd2.log.bz2,40.56 KB, application/x-bzip2)
2023-12-04 14:12 UTC, acab
Details
valgrind --leak-check=full --track-origins=yes --trace-children=yes --main-stacksize=83886080 /usr/bin/pipewire (asd2.log,46.11 KB, text/x-log)
2023-12-05 08:57 UTC, acab
Details

Note You need to log in before you can comment on or make changes to this bug.
Description acab 2023-12-04 01:33:05 UTC
I'm getting randomly but quite often a segfault in pipewire's x11 bell

[57944.888406] X11 Bell[31380]: segfault at 7fe167255b34 ip 00007fe167255b34 sp 00007fe1654a8e50 error 14 in memfd:pipewire-memfd:flags=0x0000000f,type=2,size=2312 (deleted)[7fe16725a000+1000] likely on CPU 6 (core 10, socket 0)

this looks very similar to https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/2834 except that one should be already fixed

Reproducible: Sometimes

Steps to Reproduce:
1. in one shell execute gentoo-pipewire-launcher restart and let it run
2. open a second shell and execute `while true; do echo -e '\007' & done`
3. note how gentoo-pipewire-launcher in the first shell has exited
4. note the X11 Bell sefgault in dmesg

if the crash doesn't trigger within 10s, kill the while loop and repeats the steps 2-4 in a new shell
Actual Results:  
X11 Bell sefgaults


so far i was unable to catch the crash when running pipewire under strace nor gdb
Comment 1 acab 2023-12-04 01:33:27 UTC
Created attachment 876602 [details]
emerge --info
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-04 10:19:25 UTC
Could you try enabling coredumps to capture it?
Comment 3 acab 2023-12-04 11:12:10 UTC
(In reply to Sam James from comment #2)
> Could you try enabling coredumps to capture it?

it worked, but it's not very informative.
i'll try with symbols and update this thread

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fb4dcf13b34 in ?? ()
[Current thread is 1 (Thread 0x7fb4d6fa66c0 (LWP 19182))]
(gdb) thread apply all bt

Thread 5 (Thread 0x7fb4de479740 (LWP 3775)):
#0  0x00007fb4de577cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007fb4de762a90 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#2  0x00007fb4de753ed5 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#3  0x00007fb4de6b38d0 in pw_main_loop_run () from /usr/lib64/libpipewire-0.3.so.0
#4  0x000055f116a0f45e in ?? ()
#5  0x00007fb4de49feea in __libc_start_call_main () from /lib64/libc.so.6
#6  0x00007fb4de49ffa5 in __libc_start_main () from /lib64/libc.so.6
#7  0x000055f116a0f601 in ?? ()

Thread 4 (Thread 0x7fb4d7fa86c0 (LWP 3784)):
#0  0x00007fb4de577cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007fb4de762a90 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#2  0x00007fb4de753ed5 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#3  0x00007fb4de68d900 in ?? () from /usr/lib64/libpipewire-0.3.so.0
#4  0x00007fb4de503d09 in start_thread () from /lib64/libc.so.6
#5  0x00007fb4de5778a8 in clone3 () from /lib64/libc.so.6

Thread 3 (Thread 0x7fb4de0376c0 (LWP 3779)):
#0  0x00007fb4de577cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007fb4de762a90 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#2  0x00007fb4de753ed5 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#3  0x00007fb4de6f2ea5 in ?? () from /usr/lib64/libpipewire-0.3.so.0
#4  0x00007fb4de503d09 in start_thread () from /lib64/libc.so.6
#5  0x00007fb4de5778a8 in clone3 () from /lib64/libc.so.6

Thread 2 (Thread 0x7fb4dcd216c0 (LWP 3782)):
#0  0x00007fb4de577cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007fb4de762a90 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#2  0x00007fb4de753ed5 in ?? () from /usr/lib64/spa-0.2/support/libspa-support.so
#3  0x00007fb4de6f2ea5 in ?? () from /usr/lib64/libpipewire-0.3.so.0
#4  0x00007fb4de503d09 in start_thread () from /lib64/libc.so.6
#5  0x00007fb4de5778a8 in clone3 () from /lib64/libc.so.6

Thread 1 (Thread 0x7fb4d6fa66c0 (LWP 19182)):
#0  0x00007fb4dcf13b34 in ?? ()
#1  0x00007fb4d003f488 in ?? ()
#2  0x00000000ffffff88 in ?? ()
#3  0x00007fb4c00008e8 in ?? ()
#4  0x0000000000000000 in ?? ()
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-04 11:13:44 UTC
(In reply to acab from comment #3)
> (In reply to Sam James from comment #2)
> > Could you try enabling coredumps to capture it?
> 
> it worked, but it's not very informative.
> i'll try with symbols and update this thread
> 

Thanks! Try https://wiki.gentoo.org/wiki/Debugging#Per-package for both glibc+pipewire.
Comment 5 acab 2023-12-04 12:02:02 UTC
hi
i'm having trouble with symbols

i've tried rebilding both with splitdebug and (a second time) with nostrip, however gdb says "No debugging symbols found"

i can confirm both /usr/bin/pipewire and /usr/lib64/libpipewire-0.3.so.0.1000.0 are NOT stripped

i'm taking advice here, thx
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-04 12:05:43 UTC
* did you make sure to build with -ggdb3?
* is debugedit installed?
* is the bt better despite the 'no debugging symbols' found message?
Comment 7 acab 2023-12-04 12:11:51 UTC
apologies, i was too quick...
symbols are indeed present, in fact i can get proper backtraces for all threads EXCEPT the one which segfaults

(gdb) thread apply 1 bt

Thread 1 (Thread 0x7efd649736c0 (LWP 24381)):
#0  0x00007efd6c415b34 in ?? ()
#1  0x00007efd6003f488 in ?? ()
#2  0x00000000ffffff88 in ?? ()
#3  0x00007efd500008e8 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) thread apply 2 bt

Thread 2 (Thread 0x7efd6d1c2740 (LWP 11082)):
#0  0x00007efd6d25d57e in free () from /lib64/libc.so.6
#1  0x00007efd6d4246dd in clear_item (item=0x556250001440) at ../pipewire-1.0.0/src/pipewire/properties.c:50
#2  pw_properties_clear (properties=properties@entry=0x55625001c600) at ../pipewire-1.0.0/src/pipewire/properties.c:269
#3  0x00007efd6d42471e in pw_properties_free (properties=0x55625001c600) at ../pipewire-1.0.0/src/pipewire/properties.c:358
#4  pw_properties_free (properties=0x55625001c600) at ../pipewire-1.0.0/src/pipewire/properties.c:350
#5  0x00007efd6d3ef84d in pw_global_destroy (global=0x55625001c2c0) at ../pipewire-1.0.0/src/pipewire/global.c:409
#6  0x00007efd6d3c6f3f in pw_impl_client_destroy (client=0x556250005320) at ../pipewire-1.0.0/src/pipewire/impl-client.c:679
#7  0x00007efd6c53cfee in handle_client_error (client=<optimized out>, res=<optimized out>, msg=<optimized out>) at ../pipewire-1.0.0/src/modules/module-protocol-native.c:437
#8  0x00007efd6c5405d4 in connection_data (data=<optimized out>, fd=<optimized out>, mask=<optimized out>) at ../pipewire-1.0.0/src/modules/module-protocol-native.c:474
#9  0x00007efd6d49cfa6 in loop_iterate (object=0x55624feef2c8, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/loop.c:496
#10 0x00007efd6d3fc9d0 in pw_main_loop_run (loop=loop@entry=0x55624feef170) at ../pipewire-1.0.0/src/pipewire/main-loop.c:128
#11 0x000055624ec3845e in main (argc=<optimized out>, argv=<optimized out>) at ../pipewire-1.0.0/src/daemon/pipewire.c:111
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-04 12:25:05 UTC
(In reply to acab from comment #7)
> apologies, i was too quick...

np, it happens

> symbols are indeed present, in fact i can get proper backtraces for all
> threads EXCEPT the one which segfaults
> 
> (gdb) thread apply 1 bt
> 
> Thread 1 (Thread 0x7efd649736c0 (LWP 24381)):
> #0  0x00007efd6c415b34 in ?? ()
> #1  0x00007efd6003f488 in ?? ()
> #2  0x00000000ffffff88 in ?? ()
> #3  0x00007efd500008e8 in ?? ()
> #4  0x0000000000000000 in ?? ()

It looks like the stack is corrupt there anyway...

Would you mind filing a bug upstream with what you have so far?
Comment 9 acab 2023-12-04 14:12:26 UTC
Created attachment 876616 [details]
helgrind logs

hi Sam, i can try, assuming they take bugs from non-systemd gentoo freaks

in the meantime i've noticed something surprising (to me)
gentoo-pipewire-launcher starts two pipewire process (comments from the script itself):
> # The core daemon which by itself does probably nothing.
and
> # The so called pipewire-pulse daemon used for PulseAudio compatibility.

The one that crashes is the first one (the one "which by itself does probably nothing").

FWIW it doesn't want to crash with gdb attached (which would probably be pointless anyway given the massive stack corruption) but it does crash under valgrind.

Valgrind itself doesn't complain much (a few possible leaks but nothing interesting) however helgrind does report a few issues.
TBH i am not familiar enough with pw to tell if these are real (and i'd rather have things stay that way) so I'm attaching the log just in case
Comment 10 Joakim Tjernlund 2023-12-04 17:35:07 UTC
Hi 

Do you have the PA schema discussed here, https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1468 , installed ?
Comment 11 acab 2023-12-04 21:05:49 UTC
(In reply to Joakim Tjernlund from comment #10)
> Hi 
> 
> Do you have the PA schema discussed here,
> https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1468 ,
> installed ?

no, i don't
Comment 12 Joakim Tjernlund 2023-12-05 07:57:39 UTC
(In reply to acab from comment #11)
> (In reply to Joakim Tjernlund from comment #10)
> > Hi 
> > 
> > Do you have the PA schema discussed here,
> > https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1468 ,
> > installed ?
> 
> no, i don't

Then I think gsettings will fail(possibly SEGV). just copy it over there
and see what happens
Comment 13 acab 2023-12-05 08:26:56 UTC
(In reply to Joakim Tjernlund from comment #12)
> Then I think gsettings will fail(possibly SEGV). just copy it over there
> and see what happens

tried but this unfortunately doesn't help
Comment 14 Joakim Tjernlund 2023-12-05 08:39:27 UTC
(In reply to acab from comment #13)
> (In reply to Joakim Tjernlund from comment #12)
> > Then I think gsettings will fail(possibly SEGV). just copy it over there
> > and see what happens
> 
> tried but this unfortunately doesn't help

oh, you need to compile it to I think:
glib-compile-schemas /usr/share/glib-2.0/schemas/
Comment 15 acab 2023-12-05 08:40:21 UTC
(In reply to Joakim Tjernlund from comment #14)
> oh, you need to compile it to I think:
> glib-compile-schemas /usr/share/glib-2.0/schemas/

yep, i did that
Comment 16 Joakim Tjernlund 2023-12-05 08:41:04 UTC
and you should have USE=gsettings
Comment 17 Joakim Tjernlund 2023-12-05 08:42:55 UTC
I don't know then. I have Muted such sounds, maybe that is why I don't see any SEGVs
Comment 18 acab 2023-12-05 08:48:39 UTC
(In reply to Joakim Tjernlund from comment #16)
> and you should have USE=gsettings

rebuilt with USE=gsettings
copied the xml schema
recompiled schemas

same as before :(
Comment 19 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-05 08:51:54 UTC
(In reply to acab from comment #9)
> Created attachment 876616 [details]
> helgrind logs
> 
> hi Sam, i can try, assuming they take bugs from non-systemd gentoo freaks
> 

it should be fine, they're very friendly (and supportive)

> in the meantime i've noticed something surprising (to me)
> gentoo-pipewire-launcher starts two pipewire process (comments from the
> script itself):
> > # The core daemon which by itself does probably nothing.
> and
> > # The so called pipewire-pulse daemon used for PulseAudio compatibility.
> 
> The one that crashes is the first one (the one "which by itself does
> probably nothing").
> 
> FWIW it doesn't want to crash with gdb attached (which would probably be
> pointless anyway given the massive stack corruption) but it does crash under
> valgrind.

could you show me the uninteresting output? i'm very curious as to how it crashes but gives us nothing useful...

(possible it's the wrong process or something?)
Comment 20 acab 2023-12-05 08:57:47 UTC
Created attachment 877310 [details]
valgrind --leak-check=full --track-origins=yes --trace-children=yes --main-stacksize=83886080 /usr/bin/pipewire

(In reply to Sam James from comment #19)
> could you show me the uninteresting output? i'm very curious as to how it
> crashes but gives us nothing useful...
> 
> (possible it's the wrong process or something?)

sure, here you go
Comment 21 acab 2023-12-05 09:07:04 UTC
with a bit of luck it eventually crashed under gdb


Thread 479 "X11 Bell" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffeffff6c0 (LWP 8429)]
0x00007ffff6778b34 in ?? () from /usr/lib64/libcanberra-0.30/libcanberra-alsa.so
(gdb) bt
#0  0x00007ffff6778b34 in ?? () from /usr/lib64/libcanberra-0.30/libcanberra-alsa.so
#1  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
(gdb) thread apply all bt

Thread 479 (Thread 0x7fffeffff6c0 (LWP 8429) "X11 Bell"):
#0  0x00007ffff6778b34 in ?? () from /usr/lib64/libcanberra-0.30/libcanberra-alsa.so
#1  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 4 (Thread 0x7ffff5d6e6c0 (LWP 20081) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff5d6dbe0, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=object@entry=0x55555556d4d8, timeout=timeout@entry=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7ee6f66 in do_loop (user_data=0x55555556d370) at ../pipewire-1.0.0/src/pipewire/data-loop.c:65
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 3 (Thread 0x7ffff656f6c0 (LWP 20069) "X11 Bell"):
#0  0x00007ffff7fd4d9a in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#1  0x00007ffff7fd573c in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7fd91b5 in dl_open_worker_begin () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7fd8966 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#6  0x00007ffff7fd8d45 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#7  0x00007ffff7d58d08 in dlopen_doit () from /lib64/libc.so.6
#8  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#9  0x00007ffff7fce5ef in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff7d587ea in _dlerror_run () from /lib64/libc.so.6
#11 0x00007ffff7d58dc1 in dlopen () from /lib64/libc.so.6
#12 0x00007ffff65ba636 in ?? () from //usr/lib64/libltdl.so.7
#13 0x00007ffff65b70e8 in ?? () from //usr/lib64/libltdl.so.7
#14 0x00007ffff65b8ef1 in ?? () from //usr/lib64/libltdl.so.7
#15 0x00007ffff65b9714 in lt_dlopenadvise () from //usr/lib64/libltdl.so.7
#16 0x00007ffff65b97e0 in lt_dlopenext () from //usr/lib64/libltdl.so.7
#17 0x00007ffff65ff2f7 in ?? () from /usr/lib64/libcanberra.so.0
#18 0x00007ffff65ff72c in ?? () from /usr/lib64/libcanberra.so.0
#19 0x00007ffff65f7758 in ?? () from /usr/lib64/libcanberra.so.0
#20 0x00007ffff65f7ece in ca_context_open () from /usr/lib64/libcanberra.so.0
#21 0x00007ffff678083d in play_sample (impl=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:107
#22 do_play_sample (loop=<optimized out>, async=<optimized out>, seq=<optimized out>, data=<optimized out>, size=<optimized out>, user_data=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:131
--Type <RET> for more, q to quit, c to continue without paging--
#23 0x00007ffff7fabbba in flush_items (impl=0x5555555a4d28) at ../pipewire-1.0.0/spa/plugins/support/loop.c:180
#24 0x00007ffff7faba03 in source_event_func (source=0x5555555ace70) at ../pipewire-1.0.0/spa/plugins/support/loop.c:663
#25 0x00007ffff7fae116 in loop_iterate (object=0x5555555a4d28, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/loop.c:496
#26 0x00007ffff7f506a7 in do_loop (user_data=0x5555555a4af0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#27 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#28 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 2 (Thread 0x7ffff78906c0 (LWP 20022) "module-rt"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff788fc60, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555842f8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f506a7 in do_loop (user_data=0x555555582ab0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7cd2740 (LWP 19936) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7fffffffc620, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555602d8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f0e75f in pw_main_loop_run (loop=loop@entry=0x555555560180) at ../pipewire-1.0.0/src/pipewire/main-loop.c:128
#4  0x0000555555555478 in main (argc=<optimized out>, argv=<optimized out>) at ../pipewire-1.0.0/src/daemon/pipewire.c:111
Comment 22 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-05 09:10:10 UTC
ah, we're getting somewhere now!

could you try again with alsa-lib, libcanberra debug syms too?
Comment 23 acab 2023-12-05 09:24:24 UTC
(In reply to Sam James from comment #22)
> ah, we're getting somewhere now!
> 
> could you try again with alsa-lib, libcanberra debug syms too?

here you go but lol...


Thread 1988 "X11 Bell" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff517c6c0 (LWP 31998)]
0x00007ffff671db11 in ?? ()
(gdb) bt
#0  0x00007ffff671db11 in ?? ()
#1  0x00007fffe8000b98 in ?? ()
#2  0x0000000000004000 in ?? ()
#3  0x00007fffd8001fb0 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) thread apply all bt

Thread 1988 (Thread 0x7ffff517c6c0 (LWP 31998) "X11 Bell"):
#0  0x00007ffff671db11 in ?? ()
#1  0x00007fffe8000b98 in ?? ()
#2  0x0000000000004000 in ?? ()
#3  0x00007fffd8001fb0 in ?? ()
#4  0x0000000000000000 in ?? ()

Thread 4 (Thread 0x7ffff5d186c0 (LWP 2415) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff5d17be0, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=object@entry=0x55555556d4d8, timeout=timeout@entry=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7ee6f66 in do_loop (user_data=0x55555556d370) at ../pipewire-1.0.0/src/pipewire/data-loop.c:65
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 3 (Thread 0x7ffff65196c0 (LWP 2414) "X11 Bell"):
#0  0x00007ffff7fcf139 in _dl_close_worker () from /lib64/ld-linux-x86-64.so.2
#1  0x00007ffff7fcf5b6 in _dl_close () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff7fce5ef in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7d587ea in _dlerror_run () from /lib64/libc.so.6
#5  0x00007ffff7d58516 in dlclose () from /lib64/libc.so.6
#6  0x00007ffff656467c in ?? () from //usr/lib64/libltdl.so.7
#7  0x00007ffff65624aa in lt_dlclose () from //usr/lib64/libltdl.so.7
#8  0x00007ffff65a97a2 in driver_destroy (c=c@entry=0x7fffe807baf0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/dso.c:295
#9  0x00007ffff65a1898 in ca_context_destroy (c=0x7fffe807baf0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/common.c:186
#10 0x00007ffff6729895 in play_sample (impl=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:123
#11 do_play_sample (loop=<optimized out>, async=<optimized out>, seq=<optimized out>, data=<optimized out>, size=<optimized out>, user_data=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:131
#12 0x00007ffff7fabbba in flush_items (impl=0x5555555a4d18) at ../pipewire-1.0.0/spa/plugins/support/loop.c:180
#13 0x00007ffff7faba03 in source_event_func (source=0x5555555ace60) at ../pipewire-1.0.0/spa/plugins/support/loop.c:663
#14 0x00007ffff7fae116 in loop_iterate (object=0x5555555a4d18, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/loop.c:496
#15 0x00007ffff7f506a7 in do_loop (user_data=0x5555555a4ae0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#16 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#17 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

--Type <RET> for more, q to quit, c to continue without paging--
Thread 2 (Thread 0x7ffff78906c0 (LWP 2412) "module-rt"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff788fc60, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555842f8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f506a7 in do_loop (user_data=0x555555582ab0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7cd2740 (LWP 2409) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7fffffffc620, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555602d8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f0e75f in pw_main_loop_run (loop=loop@entry=0x555555560180) at ../pipewire-1.0.0/src/pipewire/main-loop.c:128
#4  0x0000555555555478 in main (argc=<optimized out>, argv=<optimized out>) at ../pipewire-1.0.0/src/daemon/pipewire.c:111
Comment 24 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-12-05 09:28:24 UTC
lol, okay - i think it's probably a race before it's completely torn down and another bell playing.

it should be fine to report upstream at this point with that last output + a description of the symptoms
Comment 25 acab 2023-12-05 09:32:29 UTC
out of curiosity why does gentoo-pipewire-launcher sapwn 2x pipewire processes?
and why does it think the first one is useless while it's in fact that one which runs the show?

i.e. without pretending to understand what i'm doing, it seems to me that "pipewire & wireplumber" is sufficient to get the sound up and running
Comment 26 acab 2023-12-05 09:37:10 UTC
i got a "better" one...

Thread 1500 "X11 Bell" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe77fe6c0 (LWP 5501)]
thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
424	/var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c: No such file or directory.
(gdb) bt
#0  thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
#1  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6
(gdb) thread apply all bt

Thread 1500 (Thread 0x7fffe77fe6c0 (LWP 5501) "X11 Bell"):
#0  thread_func (userdata=0x7fffe84b24f0) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/alsa.c:424
#1  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#2  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 4 (Thread 0x7ffff5d186c0 (LWP 29386) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff5d17be0, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=object@entry=0x55555556d4d8, timeout=timeout@entry=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7ee6f66 in do_loop (user_data=0x55555556d370) at ../pipewire-1.0.0/src/pipewire/data-loop.c:65
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 3 (Thread 0x7ffff65196c0 (LWP 29385) "X11 Bell"):
#0  0x00007ffff7fd4d9a in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2
#1  0x00007ffff7fd573c in _dl_map_object () from /lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7fd91b5 in dl_open_worker_begin () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7fd8966 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#6  0x00007ffff7fd8d45 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#7  0x00007ffff7d58d08 in dlopen_doit () from /lib64/libc.so.6
#8  0x00007ffff7fce4c9 in _dl_catch_exception () from /lib64/ld-linux-x86-64.so.2
#9  0x00007ffff7fce5ef in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff7d587ea in _dlerror_run () from /lib64/libc.so.6
#11 0x00007ffff7d58dc1 in dlopen () from /lib64/libc.so.6
#12 0x00007ffff6564636 in ?? () from //usr/lib64/libltdl.so.7
#13 0x00007ffff65610e8 in ?? () from //usr/lib64/libltdl.so.7
#14 0x00007ffff6562ef1 in ?? () from //usr/lib64/libltdl.so.7
#15 0x00007ffff6563714 in lt_dlopenadvise () from //usr/lib64/libltdl.so.7
#16 0x00007ffff65637e0 in lt_dlopenext () from //usr/lib64/libltdl.so.7
#17 0x00007ffff65a96d0 in try_open (t=<optimized out>, c=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/dso.c:130
#18 0x00007ffff65a9afb in driver_open (c=c@entry=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/dso.c:232
#19 0x00007ffff65a1748 in context_open_unlocked (c=c@entry=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/common.c:293
#20 0x00007ffff65a1eff in ca_context_open (c=0x7fffe8000b70) at /var/tmp/portage/media-libs/libcanberra-0.30-r7/work/libcanberra-0.30/src/commo--Type <RET> for more, q to quit, c to continue without paging--c
n.c:318
#21 0x00007ffff672983d in play_sample (impl=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:107
#22 do_play_sample (loop=<optimized out>, async=<optimized out>, seq=<optimized out>, data=<optimized out>, size=<optimized out>, user_data=<optimized out>) at ../pipewire-1.0.0/src/modules/module-x11-bell.c:131
#23 0x00007ffff7fabbba in flush_items (impl=0x5555555a4d18) at ../pipewire-1.0.0/spa/plugins/support/loop.c:180
#24 0x00007ffff7faba03 in source_event_func (source=0x5555555ace60) at ../pipewire-1.0.0/spa/plugins/support/loop.c:663
#25 0x00007ffff7fae116 in loop_iterate (object=0x5555555a4d18, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/loop.c:496
#26 0x00007ffff7f506a7 in do_loop (user_data=0x5555555a4ae0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#27 0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#28 0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 2 (Thread 0x7ffff78906c0 (LWP 29383) "module-rt"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7ffff788fc60, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555842f8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f506a7 in do_loop (user_data=0x555555582ab0) at ../pipewire-1.0.0/src/pipewire/thread-loop.c:295
#4  0x00007ffff7d5cd09 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7dd08a8 in clone3 () from /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7cd2740 (LWP 29380) "pipewire"):
#0  0x00007ffff7dd0cfa in epoll_wait () from /lib64/libc.so.6
#1  0x00007ffff7fbd830 in impl_pollfd_wait (object=<optimized out>, pfd=<optimized out>, ev=0x7fffffffc620, n_ev=<optimized out>, timeout=<optimized out>) at ../pipewire-1.0.0/spa/plugins/support/system.c:137
#2  0x00007ffff7fae049 in loop_iterate (object=0x5555555602d8, timeout=-1) at ../pipewire-1.0.0/spa/plugins/support/loop.c:471
#3  0x00007ffff7f0e75f in pw_main_loop_run (loop=loop@entry=0x555555560180) at ../pipewire-1.0.0/src/pipewire/main-loop.c:128
#4  0x0000555555555478 in main (argc=<optimized out>, argv=<optimized out>) at ../pipewire-1.0.0/src/daemon/pipewire.c:111
Comment 27 Joakim Tjernlund 2023-12-05 09:43:05 UTC
gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
and you have several pipewire processes?
Comment 28 Joakim Tjernlund 2023-12-05 09:43:50 UTC
(In reply to Joakim Tjernlund from comment #27)
> gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
> and you have several pipewire processes?

forgot a "maybe" first
Comment 29 acab 2023-12-05 09:44:57 UTC
(In reply to Joakim Tjernlund from comment #28)
> (In reply to Joakim Tjernlund from comment #27)
> > gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
> > and you have several pipewire processes?
> 
> forgot a "maybe" first

gentoo-pipewire-launcher works fine, there are no extra processes
Comment 30 Joakim Tjernlund 2023-12-05 09:52:10 UTC
(In reply to acab from comment #29)
> (In reply to Joakim Tjernlund from comment #28)
> > (In reply to Joakim Tjernlund from comment #27)
> > > gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
> > > and you have several pipewire processes?
> > 
> > forgot a "maybe" first
> 
> gentoo-pipewire-launcher works fine, there are no extra processes

OK, I read this though that this only happens if you do gentoo-pipewire-launcher?
SEGV never happens on first login?
Comment 31 acab 2023-12-05 10:14:26 UTC
(In reply to Joakim Tjernlund from comment #30)
> (In reply to acab from comment #29)
> > (In reply to Joakim Tjernlund from comment #28)
> > > (In reply to Joakim Tjernlund from comment #27)
> > > > gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
> > > > and you have several pipewire processes?
> > > 
> > > forgot a "maybe" first
> > 
> > gentoo-pipewire-launcher works fine, there are no extra processes
> 
> OK, I read this though that this only happens if you do
> gentoo-pipewire-launcher?
> SEGV never happens on first login?

SEGV happens randomly *in every case*:
1. if i let the session run gentoo-pipewire-launcher for me at login (this is how initially noticed the bug)
2. if i manually run gentoo-pipewire-launcher restart (which i usually do after the session-launched one has died)
3. if i manually run pipewire + wireplumber without using the gentoo-pipewire-launcher helper


the BEL spam loop is just a quick way to reproduce it, the bug still triggers for me a few times per day under normal conditions (case 1. above)
Comment 32 Joakim Tjernlund 2023-12-05 10:39:48 UTC
(In reply to acab from comment #31)
> (In reply to Joakim Tjernlund from comment #30)
> > (In reply to acab from comment #29)
> > > (In reply to Joakim Tjernlund from comment #28)
> > > > (In reply to Joakim Tjernlund from comment #27)
> > > > > gentoo-pipewire-launcher restart does not manage to kill all pipewire procs
> > > > > and you have several pipewire processes?
> > > > 
> > > > forgot a "maybe" first
> > > 
> > > gentoo-pipewire-launcher works fine, there are no extra processes
> > 
> > OK, I read this though that this only happens if you do
> > gentoo-pipewire-launcher?
> > SEGV never happens on first login?
> 
> SEGV happens randomly *in every case*:
> 1. if i let the session run gentoo-pipewire-launcher for me at login (this
> is how initially noticed the bug)
> 2. if i manually run gentoo-pipewire-launcher restart (which i usually do
> after the session-launched one has died)
> 3. if i manually run pipewire + wireplumber without using the
> gentoo-pipewire-launcher helper
> 
> 
> the BEL spam loop is just a quick way to reproduce it, the bug still
> triggers for me a few times per day under normal conditions (case 1. above)

OK, I have one openrc system and tried your BEL script and nothing happened for me.
Comment 33 acab 2023-12-05 11:02:45 UTC
Filed upstream -> https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/3688
Comment 34 Larry the Git Cow gentoo-dev 2023-12-09 18:42:30 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b46eb64181a50d28f6857949209ab7b12ccf77d8

commit b46eb64181a50d28f6857949209ab7b12ccf77d8
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-12-09 18:30:44 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-12-09 18:41:55 +0000

    media-video/pipewire: backport bell segfault fix
    
    Closes: https://bugs.gentoo.org/919133
    Signed-off-by: Sam James <sam@gentoo.org>

 .../files/1.0.0/0002-fix-x11-bell-segfault.patch   | 29 ++++++++++++++++++++++
 ...ewire-1.0.0.ebuild => pipewire-1.0.0-r1.ebuild} |  0
 2 files changed, 29 insertions(+)