Bug 55701

Summary: module-rescue-streams with LADSPA filter chain causes infinite recursion crash on PA shutdown
Product: PulseAudio Reporter: Tomáš Trnka <tomastrnka>
Component: modulesAssignee: pulseaudio-bugs
Status: RESOLVED FIXED QA Contact: pulseaudio-bugs
Severity: normal    
Priority: medium CC: lennart
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Tomáš Trnka 2012-10-06 20:20:42 UTC
PulseAudio 1.1 (tested with Fedora package pulseaudio-1.1-9.fc17.x86_64) crashes on every daemon shutdown in my configuration consisting of an module-alsa-sink (denoted as A) and two chained module-ladspa-sinks (L1, L2):

L2 -> L1 -> A

default sink = A

If module-rescue-streams is enabled, the following happens on daemon shutdown (even with PA completely idle and no clients connected):

1) A is being unloaded
2) module-rescue-streams kicks in and tries to find a new home for the output stream of L1
3) find_evacuation_sink() iterates over all sinks and finds L2 as a suitable candidate
4) module-rescue-streams thus moves L1's output (L1out) to L2, creating a cycle
5) pa_sink_process_msg() processes the PA_SINK_MESSAGE_FINISH_MOVE message and calls attach() on the pa_sink_input being moved (L1out). This points to sink_input_attach_cb() of module-ladspa-sink.c
6) sink_input_attach_cb(L1out) calls pa_sink_attach_within_thread(L1out->sink), where L1out->sink == L1
7) pa_sink_attach_within_thread(L2) iterates over L2's inputs and calls attach() on each of them, including L2out. Again, this means sink_input_attach_cb(L2out) is called.
8) sink_input_attach_cb(L2out) calls pa_sink_attach_within_thread(L2)
9) pa_sink_attach_within_thread(L2) calls attach() on L2's inputs: sink_input_attach_cb(L1out)
10) Go to 6) and repeat until the stack overflows and PA is killed by SEGV.

I'm not sure how to fix this properly since I have only limited understanding on the internals of PA. It would probably be an overkill for module-rescue-streams to do full cycle detection somehow. Possibly it would be best to just fix find_evacuation_sink() to ignore "filter-like" sinks if there's a way how to recognise them easily (ignoring just module-ladspa-sinks seems too hackish to me).
Comment 1 Alexander E. Patrakov 2014-05-09 18:33:07 UTC
Assuming that the bug is still valid, I think that a better idea would be for module-rescue-streams to avoid rescuing virtual sink outputs.
Comment 2 Tanu Kaskinen 2014-05-23 12:49:45 UTC
I believe this has been fixed by this commit (released in 2.0): http://cgit.freedesktop.org/pulseaudio/pulseaudio/commit/?id=b7fab75fdde21569ef0be4c7c52887031393d75c

If not, feel free to reopen.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.