Segfault in pipewire.c (Wayland)

[outfrost]

Operating System Info

Other

Other OS

Manjaro stable

OBS Studio Version

27.1.3

OBS Studio Version (Other)

No response

OBS Studio Log URL

https://obsproject.com/logs/6cmcf_nCJdt-Kqoe

OBS Studio Crash Log URL

No response

Expected Behavior

Sustained broadcast/recording with no crashes

Current Behavior

Unpredictable crashes every 5 to 180 minutes

Steps to Reproduce

1. Run obs on Wayland
2. Use a screen capture via PipeWire
3. Start recording
4. Wait anywhere between 5 to 180 minutes

Anything else we should know?

I'm using:

• OBS Studio 27.1.3, built from aur: obs-studio-browser, with obs-browser, obs-vst, CEF compatibility patch and python binary loading patch
• KDE Plasma 5.22.5
• plasma-wayland-session
• Qt 5.15.2
• PipeWire 0.3.38
• cef-minimal 94.4.9

During recent streaming sessions, I've encountered a lot of random crashes, sometimes minutes apart, sometimes after a couple hours of streaming. Running with debug symbols under gdb has revealed a segfault at plugins/linux-capture/pipewire.c:478:

Thread 73 "PipeWire thread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffe737fe640 (LWP 8002)]
on_process_cb (user_data=0x55555628dd20) at /usr/src/debug/obs-studio-browser/plugins/linux-capture/pipewire.c:478
478     /usr/src/debug/obs-studio-browser/plugins/linux-capture/pipewire.c: No such file or directory.
(gdb) backtrace -full
#0  on_process_cb (user_data=0x55555628dd20) at /usr/src/debug/obs-studio-browser/plugins/linux-capture/pipewire.c:478
        bitmap = 0x7fff0bfdf424
        format = GS_BGRA
        obs_pw = 0x55555628dd20
        cursor = 0x7fff0c00f728
        drm_format = 4294769916
        region = <optimized out>
        buffer = <optimized out>
        b = 0x5555588b4758
        swap_red_blue = <optimized out>
        has_buffer = <optimized out>
#1  0x00007fff503f5b68 in  () at /usr/lib/libpipewire-0.3.so.0
#2  0x00007fff504807d9 in  () at /usr/lib/spa-0.2/support/libspa-support.so
#3  0x00007fff5047cac6 in  () at /usr/lib/spa-0.2/support/libspa-support.so
#4  0x00007fff50480e8b in  () at /usr/lib/spa-0.2/support/libspa-support.so
#5  0x00007fff503f8fdf in  () at /usr/lib/libpipewire-0.3.so.0
#6  0x00007ffff630c259 in start_thread () at /usr/lib/libpthread.so.0
#7  0x00007ffff4ac55e3 in clone () at /usr/lib/libc.so.6

Given that line 478 nullchecks the pointer before using it, I assume it must be a dangling pointer. I'm not sure where to go looking from there, though.

[kkartaltepe]

Please provide the entire stack trace

[outfrost]

Sorry, should've thought of that. Updated the listing above with a new gdb printout with backtrace.

[xpamych]

When adding any 3D application window or browser, it fails with an error. Arch linux. obs-studio-browser from aur.

The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/bin/obs obs
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe1f08640 (LWP 31806)]
[New Thread 0x7fffe1707640 (LWP 31807)]
[New Thread 0x7fffe0f06640 (LWP 31808)]
[New Thread 0x7fffd3fff640 (LWP 31809)]
[New Thread 0x7fffcb7fe640 (LWP 31810)]
[New Thread 0x7fffd37fe640 (LWP 31811)]
[New Thread 0x7fffd2ffd640 (LWP 31812)]
Icon theme "elementary" not found.
Icon theme "gnome" not found.
Attempted path: share/obs/obs-studio/locale/en-US.ini
Attempted path: /usr/share/obs/obs-studio/locale/en-US.ini
Attempted path: share/obs/obs-studio/locale.ini
Attempted path: /usr/share/obs/obs-studio/locale.ini
Attempted path: share/obs/obs-studio/locale/ru-RU.ini
Attempted path: /usr/share/obs/obs-studio/locale/ru-RU.ini
info: Using preferred locale 'ru-RU'
Attempted path: share/obs/obs-studio/themes/Dark.qss
Attempted path: /usr/share/obs/obs-studio/themes/Dark.qss
info: Command Line Arguments: obs
info: Platform: Wayland
info: CPU Name: 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz
info: CPU Speed: 4200.000MHz
info: Physical Cores: 4, Logical Cores: 8
info: Physical Memory: 7620MB Total, 404MB Free
info: Kernel Version: Linux 5.15.5-arch1-1
info: Distribution: "Arch Linux" Unknown
info: Session Type: wayland
[New Thread 0x7fffd1dec640 (LWP 31813)]
info: Portable mode: false
Attempted path: share/obs/obs-studio/themes/Dark/no_sources.svg
Attempted path: /usr/share/obs/obs-studio/themes/Dark/no_sources.svg
QMetaObject::connectSlotsByName: No matching signal for on_tbar_position_valueChanged(int)
QMetaObject::connectSlotsByName: No matching signal for on_actionShowTransitionProperties_triggered()
QMetaObject::connectSlotsByName: No matching signal for on_actionHideTransitionProperties_triggered()
info: OBS 27.1.3 (linux)
info: ---------------------------------
info: ---------------------------------
info: audio settings reset:
        samples per sec: 48000
        speakers:        2
[New Thread 0x7fffd14f5640 (LWP 31814)]
info: ---------------------------------
info: Initializing OpenGL...
info: Using EGL/Wayland
[New Thread 0x7fffd0938640 (LWP 31815)]
info: Initialized EGL 1.5
[New Thread 0x7fffcbfff640 (LWP 31816)]
info: Loading up OpenGL on adapter Intel Mesa Intel(R) Xe Graphics (TGL GT2)
info: OpenGL loaded successfully, version 4.6 (Core Profile) Mesa 21.2.5, shading language 4.60
info: ---------------------------------
info: video settings reset:
        base resolution:   1920x1080
        output resolution: 1280x720
        downscale filter:  Bicubic
        fps:               30/1
        format:            NV12
        YUV mode:          709/Partial
[New Thread 0x7fffc93f5640 (LWP 31817)]
info: NV12 texture support not available
[New Thread 0x7fffac9d1640 (LWP 31818)]
info: Audio monitoring device:
        name: По умолчанию
        id: default
info: ---------------------------------
warning: Failed to load 'en-US' text for module: 'decklink-captions.so'
warning: Failed to load 'en-US' text for module: 'decklink-ouput-ui.so'
[New Thread 0x7fff9fa46640 (LWP 31819)]
info: [pipewire] Available captures:
info: [pipewire]     - Desktop capture
info: [pipewire]     - Window capture
libDeckLinkAPI.so: невозможно открыть разделяемый объектный файл: Нет такого файла или каталога
warning: A DeckLink iterator could not be created.  The DeckLink drivers may not be installed
info: No blackmagic support
[Detaching after vfork from child process 31820]
warning: v4l2loopback not installed, virtual camera disabled
info: [obs-browser]: Version 2.16.3
info: [obs-browser]: CEF Version 94.4.9+g09ee681+chromium-94.0.4606.71
error: os_dlopen(libnvidia-encode.so.1->libnvidia-encode.so.1): libnvidia-encode.so.1: невозможно открыть разделяемый объектный файл: Нет такого файла или каталога

info: FFMPEG VAAPI supported
[New Thread 0x7fff9c832640 (LWP 31822)]
[New Thread 0x7fff8ce13640 (LWP 31823)]
info: VLC found, VLC video source enabled
info: ---------------------------------
info:   Loaded Modules:
info:     vlc-video.so
info:     text-freetype2.so
info:     sndio.so
info:     rtmp-services.so
info:     obs-x264.so
info:     obs-vst.so
info:     obs-transitions.so
info:     obs-outputs.so
info:     obs-libfdk.so
info:     obs-filters.so
info:     obs-ffmpeg.so
info:     obs-browser.so
info:     linux-v4l2.so
info:     linux-pulseaudio.so
info:     linux-jack.so
info:     linux-decklink.so
info:     linux-capture.so
info:     linux-alsa.so
info:     image-source.so
info:     frontend-tools.so
info:     decklink-ouput-ui.so
info:     decklink-captions.so
info: ---------------------------------
info: ==== Startup complete ===============================================
[Thread 0x7fff8ce13640 (LWP 31823) exited]
info: All scene data cleared
info: ------------------------------------------------
[New Thread 0x7fff8ce13640 (LWP 31824)]
info: pulse-input: Server name: 'PulseAudio (on PipeWire 0.3.40) 15.0.0'
info: pulse-input: Audio format: s32le, 48000 Hz, 2 channels
info: pulse-input: Started recording from 'alsa_output.pci-0000_00_1f.3.analog-stereo.monitor'
info: [Loaded global audio device]: 'Устройство воспроизведения'
info: pulse-input: Server name: 'PulseAudio (on PipeWire 0.3.40) 15.0.0'
info: pulse-input: Audio format: s32le, 48000 Hz, 2 channels
info: pulse-input: Started recording from 'alsa_input.pci-0000_00_1f.3.analog-stereo'
info: [Loaded global audio device]: 'Mic/Aux'
info: [pipewire] available cursor modes:
info: [pipewire]     - Metadata
info: [pipewire]     - Always visible
info: [pipewire]     - Hidden
info: PipeWire initialized (sender name: 1_248)
info: Switched to scene 'Сцена'
info: ------------------------------------------------
info: Loaded scenes:
info: - scene 'Сцена':
info:     - source: 'Захват окна (PipeWire)' (pipewire-window-capture-source)
info: ------------------------------------------------
qt.qpa.wayland: Wayland does not support QWindow::requestActivate()
info: [pipewire] screencast session created
info: [pipewire] asking for window…
Attempted path: share/obs/obs-studio/images/overflow.png
Attempted path: /usr/share/obs/obs-studio/images/overflow.png
[Thread 0x7fff9c832640 (LWP 31822) exited]
info: adding 42 milliseconds of audio buffering, total audio buffering is now 42 milliseconds (source: Mic/Aux)

[New Thread 0x7fff7edfb640 (LWP 31834)]
[New Thread 0x7fff7e5fa640 (LWP 31835)]
[New Thread 0x7fff7ddf9640 (LWP 31836)]
[New Thread 0x7fff7d5f8640 (LWP 31837)]
info: [pipewire] screencast session cancelled
info: [pipewire] available cursor modes:
info: [pipewire]     - Metadata
info: [pipewire]     - Always visible
info: [pipewire]     - Hidden
info: PipeWire initialized (sender name: 1_248)

(process:31805): GLib-GObject-WARNING **: 13:44:47.928: ../glib/gobject/gsignal.c:2732: instance '0x7fffd8005a60' has no handler with id '15'
warning: [pipewire] Failed to start screencast, denied or cancelled by user
info: [pipewire] screencast session created
info: [pipewire] asking for window…
info: [pipewire] window selected, setting up screencast
[New Thread 0x7fff6ffff640 (LWP 31844)]
[New Thread 0x7fff6f7fe640 (LWP 31845)]
info: [pipewire] created stream 0x555556be6900
info: [pipewire] playing stream…

Thread 24 "PipeWire thread" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff6f7fe640 (LWP 31845)]
0x00007ffff4b55576 in __memmove_avx_unaligned_erms () from /usr/lib/libc.so.6

`

[kkartaltepe]

Another user also reported a crash in uploading the texture with debug symbols

(gdb) bt
#0  0x00007ffff4b4f693 in __memmove_avx_unaligned_erms () at /usr/lib/libc.so.6
#1  0x00007fffba71cea1 in  () at /usr/lib/dri/radeonsi_dri.so
#2  0x00007fffba71def3 in  () at /usr/lib/dri/radeonsi_dri.so
#3  0x00007fffba8bc391 in  () at /usr/lib/dri/radeonsi_dri.so
#4  0x00007fffba8bc46e in  () at /usr/lib/dri/radeonsi_dri.so
#5  0x00007fffe00a6abc in gl_init_face
    (target=target@entry=3553, type=5121, num_levels=num_levels@entry=1, format=32993, internal_format=35905, compressed=compressed@entry=false, width=1920, height=1036, size=7956480, p_data=0x7fffd3ffe000)
    at /usr/src/debug/obs-studio-27.1.3/libobs-opengl/gl-helpers.c:38
#6  0x00007fffe00b4d35 in upload_texture_2d
    (data=<optimized out>, tex=0x7fffc80061e0)
    at /usr/src/debug/obs-studio-27.1.3/libobs-opengl/gl-texture2d.c:34
#7  device_texture_create
    (device=<optimized out>, width=<optimized out>, height=<optimized out>, color_format=<optimized out>, levels=<optimized out>, data=<optimized out>, flags=2)
    at /usr/src/debug/obs-studio-27.1.3/libobs-opengl/gl-texture2d.c:107
#8  0x00007ffff5ba1aff in gs_texture_create
    (width=1920, height=1036, color_format=color_format@entry=GS_BGRX, levels=<optimized out>, levels@entry=1, data=0x7fffc8001c50, flags=flags@entry=2)
    at /usr/src/debug/obs-studio-27.1.3/libobs/graphics/graphics.c:1366
#9  0x00007fff70072df5 in on_process_cb (user_data=0x555555dfd260)
    at /usr/src/debug/obs-studio-27.1.3/plugins/linux-capture/pipewire.c:437
#10 0x00007fff51d02aa8 in  () at /usr/lib/libpipewire-0.3.so.0
#11 0x00007fffb800cc29 in  () at /usr/lib/spa-0.2/support/libspa-support.so
--Type <RET> for more, q to quit, c to continue without paging--c
#12 0x00007fffb800bd46 in  () at /usr/lib/spa-0.2/support/libspa-support.so
#13 0x00007fffb800d2cb in  () at /usr/lib/spa-0.2/support/libspa-support.so
#14 0x00007fff51d0623a in  () at /usr/lib/libpipewire-0.3.so.0
#15 0x00007ffff630c259 in start_thread () at /usr/lib/libpthread.so.0
#16 0x00007ffff4aea5e3 in clone () at /usr/lib/libc.so.6

[kkartaltepe]

@GeorgesStavracas Does this make sense to you? The latest crash is reported as immediately after beginning capture.

[GeorgesStavracas]

Thanks for the ping. i don't know what could be causing this crash. __memmove_avx_unaligned_erms is usually a general memory corruption - either unintialized or freed memory. So this indeed looks like a use-after-free.

[xpamych]

@GeorgesStavracas

The error is repeated on different computers. Lenovo ThinkPad L13 Gen2 Laptop
OS: Arch Linux x86_64
Host: 20VH001WRT ThinkPad L13 Gen 2
Kernel: 5.15.5-arch1-1
Shell: zsh 5.8
Resolution: 1920x1080
DE: Plasma 5.23.4
WM: kwin
CPU: 11th Gen Intel i5-1135G7 (8) @ 4.200GHz
GPU: Intel TigerLake-LP GT2 [Iris Xe Graphics]
and PC:
Host: X470 AORUS GAMING 7 WIFI
CPU: AMD Ryzen 9 5900X (24) @ 3.700GHz
GPU: AMD ATI Radeon RX 6800/6800 XT / 6900 XT
Memory: 32053MiB
OS: Arch Linux x86_64
Kernel: linux-lqx
Resolution: 2560x1440, 2560x1080, 2560x1080

[minecraft2048]

I'm also having same segfault on Arch Linux with KDE.. Tried to run it under valgrind --track-origins=yes but not helpful

info: adding 64 milliseconds of audio buffering, total audio buffering is now 106 milliseconds (source: Desktop Audio)

==30927== Thread 46:
==30927== Invalid read of size 4
==30927==    at 0x40147EDC: on_process_cb (pipewire.c:478)
==30927==    by 0x41F87AA7: ??? (in /usr/lib/libpipewire-0.3.so.0.340.0)
==30927==    by 0x417A9C28: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x417A8D45: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x417AA2CA: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x41F8B239: ??? (in /usr/lib/libpipewire-0.3.so.0.340.0)
==30927==    by 0x6501258: start_thread (in /usr/lib/libpthread-2.33.so)
==30927==    by 0x7D625E2: clone (in /usr/lib/libc-2.33.so)
==30927==  Address 0x14330f859 is not stack'd, malloc'd or (recently) free'd
==30927== 
==30927== 
==30927== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==30927==  Access not within mapped region at address 0x14330F859
==30927==    at 0x40147EDC: on_process_cb (pipewire.c:478)
==30927==    by 0x41F87AA7: ??? (in /usr/lib/libpipewire-0.3.so.0.340.0)
==30927==    by 0x417A9C28: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x417A8D45: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x417AA2CA: ??? (in /usr/lib/spa-0.2/support/libspa-support.so)
==30927==    by 0x41F8B239: ??? (in /usr/lib/libpipewire-0.3.so.0.340.0)
==30927==    by 0x6501258: start_thread (in /usr/lib/libpthread-2.33.so)
==30927==    by 0x7D625E2: clone (in /usr/lib/libc-2.33.so)
==30927==  If you believe this happened as a result of a stack
==30927==  overflow in your program's main thread (unlikely but
==30927==  possible), you can try to increase the size of the
==30927==  main thread stack using the --main-stacksize= flag.
==30927==  The main thread stack size used in this run was 8388608.
==30927== 
==30927== HEAP SUMMARY:
==30927==     in use at exit: 54,888,920 bytes in 179,411 blocks
==30927==   total heap usage: 771,375 allocs, 591,964 frees, 190,896,200 bytes allocated
==30927== 
==30927== LEAK SUMMARY:
==30927==    definitely lost: 0 bytes in 0 blocks
==30927==    indirectly lost: 0 bytes in 0 blocks
==30927==      possibly lost: 34,331,363 bytes in 59,853 blocks
==30927==    still reachable: 20,542,965 bytes in 119,419 blocks
==30927==                       of which reachable via heuristic:
==30927==                         newarray           : 821,208 bytes in 59 blocks
==30927==                         multipleinheritance: 213,584 bytes in 267 blocks
==30927==         suppressed: 200 bytes in 6 blocks
==30927== Rerun with --leak-check=full to see details of leaked memory
==30927== 
==30927== For lists of detected and suppressed errors, rerun with: -s
==30927== ERROR SUMMARY: 3777 errors from 165 contexts (suppressed: 2 from 2)
fish: Job 1, 'valgrind --track-origins=yes obs' terminated by signal SIGSEGV (Address boundary error)

[kkartaltepe]

Another user has reported this and posted a log which appears to show the frame data being garbled. https://cdn.discordapp.com/attachments/858151683418226708/914281546196865094/unknown.png They believe it may be packed RGB data being sent to obs, which we dont support IIRC.

[minecraft2048]

After thinking about where the segfault come from:

obs-studio/plugins/linux-capture/pipewire.c

Lines 518 to 521 in b92e941

	if (bitmap && bitmap->size.width > 0 &&
	bitmap->size.height > 0 &&
	spa_pixel_format_to_obs_format(bitmap->format, &format,
	&swap_red_blue)) {

I found a workaround, which is to uncheck Show Cursor in the Pipewire screen capture properties window. Instead of OBS crashing within several seconds, now its stable for at least 10 minutes

[outfrost]

@minecraft2048 Please keep in mind that these crashes can be quite random. At least for me, they could happen in the first 5 minutes, or only after 3+ hours of streaming/recording.

[GeorgesStavracas]

Given that the only thing in common between all these reports is that they all use KDE, I'm starting to think the KDE implementation is sending a bogus cursor through PipeWire. That would be the only reasonable explanation. PipeWire itself doesn't touch the contents of the cursor, only OBS Studio, so we end up triggering the crash.