xdg-desktop-portal-wlr: xdpw_screencast_instance_destroy segfaults with inproper refcount

It seems like xdg-desktop-portal-wlr crashes trying to free wlr frame on error. At first I thought it’s related #24 but I think it’s different. XDPW version is 55f873dac4ae6da8b96e6de57609ccb8cd2160c3.

Thread 2 (Thread 0x7ff522c30700 (LWP 6232)):
#0  0x00007ff522f6a70e in epoll_wait () from /usr/lib/libc.so.6
#1  0x00007ff5231be161 in ?? () from /usr/lib/spa-0.2/support/libspa-support.so
#2  0x00007ff5231bec50 in ?? () from /usr/lib/spa-0.2/support/libspa-support.so
#3  0x00007ff5230923e0 in ?? () from /usr/lib/libpipewire-0.3.so.0
#4  0x00007ff522e4446f in start_thread () from /usr/lib/libpthread.so.0
#5  0x00007ff522f6a3d3 in clone () from /usr/lib/libc.so.6

Thread 1 (Thread 0x7ff522ca77c0 (LWP 6231)):
#0  0x00007ff522ea6ce5 in raise () from /usr/lib/libc.so.6
#1  0x00007ff522e90857 in abort () from /usr/lib/libc.so.6
#2  0x00007ff522e90727 in __assert_fail_base.cold () from /usr/lib/libc.so.6
#3  0x00007ff522e9f426 in __assert_fail () from /usr/lib/libc.so.6
#4  0x000056331a4accde in xdpw_screencast_instance_destroy (cast=0x56331b75a7a0) at ../src/screencast/screencast.c:37
#5  0x000056331a4ae416 in xdpw_wlr_frame_free (cast=0x56331b75a7a0) at ../src/screencast/wlr_screencast.c:35
#6  0x000056331a4aeeab in wlr_frame_ready (data=0x56331b75a7a0, frame=0x56331b75b7c0, tv_sec_hi=0, tv_sec_lo=8112, tv_nsec=852745222) at ../src/screencast/wlr_screencast.c:144
#7  0x00007ff522e65a8d in ?? () from /usr/lib/libffi.so.7
#8  0x00007ff522e6501b in ?? () from /usr/lib/libffi.so.7
#9  0x00007ff523190e92 in ?? () from /usr/lib/libwayland-client.so.0
#10 0x00007ff52318d6c1 in ?? () from /usr/lib/libwayland-client.so.0
#11 0x00007ff52318eccc in wl_display_dispatch_queue_pending () from /usr/lib/libwayland-client.so.0
#12 0x000056331a4abc64 in main (argc=5, argv=0x7ffeaa9916a8) at ../src/core/main.c:157

Core dump and trace level logs are attached.

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Comments: 21 (2 by maintainers)

Most upvoted comments

at least it’s progress! And in these times, screensharing is kind of key when working remotely 😉. I can live with restarting pipewire and xdpw for now, not having to boot up my old dwm/xorg setup everytime. 😉

An easy fix would be to check the refcount in the setup_outputs function. That’s where we scan for existing cast objects that match the incoming request. If during that wl_list_for_each, we checked cast refcount and treated 0 as dead man walking and fell back to the “create a new cast instance” path when none is found, that could avoid this issue without any structural changes.

I’ll slap that fix together tomorrow and try my hardest to get an error condition. If it looks promising, I’ll share a branch for everyone on this issue to test.

I got it to work now! 👏 But I can only like restart the screen cast 3 times, after that I get blank screen, then I need to restart pipewire and xdpw and it starts working again. image

Can have some sort of races where refcounts can be incremented/decremented by multiple threads without being locked?

We don’t do threads, so one less footgun 😃