Bug#1147417: gnome-shell: SIGSEGV (NULL read) in bundled libgvc when a card's ports reference profiles the card lacks

[Andrew Hacker]

Package: gnome-shell
Version: 50.4-1
Severity: important

Dear Maintainer,

gnome-shell crashes with SIGSEGV in its bundled libgvc at session start,
when pipewire-pulse exposes a sound card whose ports reference profiles
the card does not have. The Wayland session ends and GDM returns to the
login screen. In one of the crashes gsd-media-keys, which also bundles
gvc, crashed with a NULL read in the same second.

This looks related to, but distinct from, #1124791, #1127073 and
#1139651. Those are SIGABRT assertions triggered by Bluetooth profile
switches. This is a SIGSEGV, no Bluetooth device is involved, and it
happens while the shell enumerates cards at startup.

Every crash is preceded, in the same second, by the same sequence
(hostname removed):

2026-09-09T18:54:09 wireplumber[15846]: wp-device: SPA handle
'api.alsa.acp.device' could not be loaded; is it installed?
2026-09-09T18:54:09 wireplumber[15846]: s-monitors: Failed to create
'api.alsa.acp.device' device
2026-09-09T18:54:09 pipewire-pulse[15848]: mod.protocol-pulse:
0x55f1da726670: card 55 port 0 profiles inconsistent (0 < 3)
2026-09-09T18:54:09 pipewire-pulse[15848]: mod.protocol-pulse:
0x55f1da726670: card 55 port 1 profiles inconsistent (0 < 3)
2026-09-09T18:54:09 pipewire-pulse[15848]: mod.protocol-pulse:
0x55f1da726670: card 55 port 2 profiles inconsistent (0 < 3)
2026-09-09T18:54:09 pipewire-pulse[15848]: mod.protocol-pulse:
0x55f1da726670: card 55 port 3 profiles inconsistent (0 < 3)
2026-09-09T18:54:09 kernel: gnome-shell[16182]: segfault at 0 ip
00007f0f7c0308e3 sp 00007ffe555b6050 error 4 in
libgvc.so[c8e3,7f0f7c02b000+10000] likely on CPU 15 (core 15, socket
0)

All three crashes fault at the same offset, libgvc.so+0xc8e3:

2026-09-09T18:05:10 kernel: gnome-shell[5248]: segfault at 0 ip
00007f2d443648e3 sp 00007ffec0f7cc10 error 4 in
libgvc.so[c8e3,7f2d4435f000+10000]
2026-09-09T18:05:10 kernel: gsd-media-keys[5397]: segfault at 0 ip
0000557fdfbaa360 sp 00007fff04391830 error 4 in
gsd-media-keys[19360,557fdfb9b000+1c000]
2026-09-09T18:54:09 kernel: gnome-shell[16182]: segfault at 0 ip
00007f0f7c0308e3 sp 00007ffe555b6050 error 4 in
libgvc.so[c8e3,7f0f7c02b000+10000]
2026-09-10T21:40:55 kernel: gnome-shell[199685]: segfault at 0 ip
00007fb3d0ed78e3 sp 00007ffdfdad0580 error 4 in
libgvc.so[c8e3,7fb3d0ed2000+10000]

The first preceding card message was "(0 < 1)"; the other two were "(0 < 3)".
The third crash was the shell GDM started after an amdgpu reset had ended
the previous session, so devices were being re-enumerated.

The faulting offset is a virtual address (the executable LOAD segment
has file offset == vaddr == 0x7000), so it can be resolved against the
50.4-1 debug symbols. I could not resolve it locally. The nearest
exported symbol is gvc_mixer_card_new at 0x9f40, 0x29a3 bytes earlier,
so the fault is almost certainly in an unexported function.

The "could not be loaded" warning alone is not sufficient. It appears at
every boot in this journal back to 2026-08-04, including sessions that
never crashed. "profiles inconsistent" appears only in the three crashing
session starts, and never before 2026-09-09. That day at 16:37 these
were upgraded together:

  wireplumber, libwireplumber-0.5-0   0.5.15-1 -> 0.5.17-1  (from unstable)
  linux-image-amd64                   7.1.12-1 -> 7.1.13-1
  gstreamer1.0 packages               1.28.6   -> 1.28.7

pipewire and libspa-0.2-modules were already 1.6.8-1, and gnome-shell
was already 50.4-1. This is a testing system that also had unstable
enabled at equal priority: wireplumber 0.5.17-1 came from unstable,
while gnome-shell 50.4-1 is the testing version. So the new wireplumber
or the new kernel may be what produces a card in this state, but a
client should not crash on it either way. It is intermittent: other
session starts since the upgrade were unaffected.

Hardware: AMD Raphael iGPU with its HDA controller, NVIDIA GB206 dGPU
with its HDA controller, Ryzen HD audio, a USB audio device, a USB
webcam, and a dock driving DisplayPort MST displays. The failing card
has four ports. I could not identify it, because it does not appear in
sessions that don't crash.

No core dump was captured, because systemd-coredump was installed after
the last crash. If it recurs I will send a backtrace to this bug.

-- Versions
Kernel: Linux 7.1.13+deb14-amd64
Session: GNOME on Wayland, via GDM
APT sources: testing (main contrib non-free non-free-firmware), plus
unstable (main) at equal priority 500, with no pinning, at the time
gnome-shell                          50.4-1
mutter-common, libmutter-18-0        50.4-1
gnome-settings-daemon                51~rc-1
pipewire, libspa-0.2-modules         1.6.8-1
wireplumber, libwireplumber-0.5-0    0.5.17-1