Bug#1147417: backtrace; NULL active_profile at gvc-mixer-control.c:2649 (HP dock audio card, 0 profiles)

[Andrew Hacker]

It recurred at session start on 2026-09-11 11:35:23. This time
gsd-media-keys crashed and gnome-shell survived. systemd-coredump was
installed, so there is a core, and the backtrace resolves with Debian's
debuginfod.

Same preceding sequence, same second:

2026-09-11T11:35:23 wireplumber[5045]: wp-device: SPA handle
'api.alsa.acp.device' could not be loaded; is it installed?
2026-09-11T11:35:23 wireplumber[5045]: s-monitors: Failed to create
'api.alsa.acp.device' device
2026-09-11T11:35:23 pipewire-pulse[5049]: mod.protocol-pulse:
0x563168324720: card 55 port 0 profiles inconsistent (0 < 3)
2026-09-11T11:35:23 pipewire-pulse[5049]: mod.protocol-pulse:
0x563168324720: card 55 port 1 profiles inconsistent (0 < 3)
2026-09-11T11:35:23 pipewire-pulse[5049]: mod.protocol-pulse:
0x563168324720: card 55 port 2 profiles inconsistent (0 < 3)
2026-09-11T11:35:23 pipewire-pulse[5049]: mod.protocol-pulse:
0x563168324720: card 55 port 3 profiles inconsistent (0 < 3)
2026-09-11T11:35:23 kernel: gsd-media-keys[5520]: segfault at 0 ip
000055fa4acb3360 sp 00007fff0a189500 error 4 in
gsd-media-keys[19360,55fa4aca4000+1c000]

The fault is in update_card() in the gvc copy bundled in
gnome-settings-daemon (subprojects/gvc), called from the card-info
callback:

#0  update_card (control=0x55fa5edd9080, info=0x7fff0a189610) at
../subprojects/gvc/gvc-mixer-control.c:2649
        card = 0x55fa5edd0e20
        (inlined into _pa_context_get_card_info_by_index_cb)
#1  _pa_context_get_card_info_by_index_cb (context=<optimized out>,
i=0x7fff0a189610, eol=0, userdata=0x55fa5edd9080) at
../subprojects/gvc/gvc-mixer-control.c:2862
#2  context_get_card_info_callback (pd=pd at entry=0x55fa5ede8f20,
command=command at entry=2, tag=tag at entry=4, t=t at entry=0x55fa5edea0d0,
userdata=userdata at entry=0x55fa5edfb040) at
../src/pulse/introspect.c:990
        i = {index = 55, name = 0x55fa5edfdfee
"alsa_card.usb-Generic_USB_Audio_201604140001-00", owner_module =
4294967295, driver = 0x55fa5edfe024 "alsa", n_profiles = 0, profiles =
0x0, active_profile = 0x0, proplist = 0x55fa5edfa930, n_ports = 4,
ports = 0x55fa5edb31a0, profiles2 = 0x0, active_profile2 = 0x0}
#3  run_action (...) at ../src/pulsecore/pdispatch.c:291
#4  pa_pdispatch_run (...) at ../src/pulsecore/pdispatch.c:344
#5  pstream_packet_callback (...) at ../src/pulse/context.c:364
#6  do_read (...) at ../src/pulsecore/pstream.c:1032
#7  do_pstream_read_write (...) at ../src/pulsecore/pstream.c:265
#8  dispatch_func (...) at ../src/pulse/glib-mainloop.c:581
#9  g_main_dispatch (...) at ../../../glib/gmain.c:3734
#10 g_main_context_dispatch_unlocked (...) at ../../../glib/gmain.c:4603
#11 g_main_context_iterate_unlocked (...) at ../../../glib/gmain.c:4672
#12 g_main_context_iteration (...) at ../../../glib/gmain.c:4738
#13 g_application_run (...) at ../../../gio/gapplication.c:2743
#14 start (...) at ../plugins/common/gsd-main-helper.c:204
#15 gsd_main_helper (...) at ../plugins/common/gsd-main-helper.c:250

The card I could not identify in the original report is card 55,
alsa_card.usb-Generic_USB_Audio_201604140001-00. It is the built-in
audio of the HP dock, USB ID 03f0:03c5 ("Generic" / "USB Audio"), which
sits on the dock's internal hub next to its 03f0:086b hub and its
Realtek 8153 Ethernet. It is not a separate USB audio device, as the
hardware list in my original report implied.
As delivered to the client, it has no profiles and no active profile,
and each of its four ports has n_profiles = 0:

  card  n_profiles=0 profiles2=NULL active_profile2=NULL n_ports=4
  port 0  analog-input-mic      "Microphone"               n_profiles=0
  port 1  iec958-stereo-input   "Digital Input (S/PDIF)"   n_profiles=0
  port 2  analog-output         "Analog Output"            n_profiles=0
  port 3  iec958-stereo-output  "Digital Output (S/PDIF)"  n_profiles=0

The faulting instruction loads info->active_profile->name to pass it to
gvc_mixer_card_set_profile(). With no active profile, that pointer is
NULL. From the core:

   0x55fa4acb3359 <_pa_context_get_card_info_by_index_cb+1417>:  mov
 0x30(%r15),%rax
   0x55fa4acb335d <_pa_context_get_card_info_by_index_cb+1421>:  mov
 %r14,%rdi
=> 0x55fa4acb3360 <_pa_context_get_card_info_by_index_cb+1424>:  mov
 (%rax),%rsi
   0x55fa4acb3363 <_pa_context_get_card_info_by_index_cb+1427>:  call
 gvc_mixer_card_set_profile

   r15 = 0x7fff0a189610 (info)   r14 = 0x55fa5edd0e20 (card)   rax = 0x0
   offset 0x30 in pa_card_info is active_profile; info->active_profile = 0x0

So gvc-mixer-control.c:2649 dereferences info->active_profile without
checking for NULL. pipewire-pulse delivers a card with no profiles
(right after logging "profiles inconsistent"), and every bundled gvc
client that receives it crashes.

The earlier gnome-shell crashes are the same line. Resolving the
libgvc.so+0xc8e3 offset from the report against the 50.4-1 debug symbols:

  0xc8e3 is _pa_context_get_card_info_by_index_cb+1107,
  ../subprojects/gvc/gvc-mixer-control.c:2649
  0xc8dc: mov 0x30(%r15),%rax
  0xc8e0: mov %r14,%rdi
  0xc8e3: mov (%rax),%rsi

It's the same instruction sequence in both binaries. The gsd-media-keys
crash on 2026-09-09 18:05:10 was also at +0x19360. Since this is gvc code
shared by gnome-shell and gnome-settings-daemon, a clone or reassignment
to libgnome-volume-control (upstream) may be appropriate.

Versions at the time of this crash:
gnome-settings-daemon  51~rc-1
gnome-shell            50.4-1
pipewire-pulse         1.6.8-1
wireplumber            0.5.17-1
libpulse0              17.0+dfsg1-3
Kernel                 Linux 7.1.13+deb14-amd64

Unrelated to this bug, the session was later ended at 11:50:52 by an
amdgpu GPU reset (a gnome-shell SIGABRT in libgallium after the context
was lost). I mention it only so that crash is not mistaken for this one.