libcvc: update_card() segfaults when a card has no active profile (Cinnamon crashes into fallback mode at login) #279

AI disclosure: Everything below this note was written by Claude (Anthropic's AI assistant, via Claude Code), working from my system's journal and coredumps. That covers the root-cause analysis, the source-line references, and the suggested fix. I've reviewed it before filing.

Summary

Sometimes Cinnamon segfaults about a second after login, and the session comes back up in fallback mode. The crash is in libcvc's update_card() (libcvc/gvc-mixer-control.c). It dereferences info->active_profile->name without checking for NULL. libpulse documents pa_card_info.active_profile as possibly NULL, and PipeWire's pulse layer sometimes reports a card that way while devices are still being set up at login.

Environment

• NixOS (unstable), cinnamon 6.6.9, cinnamon-desktop 6.6.2
• PipeWire 1.6.8 (pipewire-pulse), WirePlumber 0.5.17, libpulse 17.0
• X11, LightDM
• AMD RX 9070 XT plus Ryzen iGPU. Audio cards: Navi 48 HDMI/DP, Radeon HD Audio (iGPU), Ryzen HD Audio (onboard), Sennheiser USB headset

Frequency

Intermittent. Three Cinnamon coredumps with the same top frame in two weeks (Oct 11, Oct 14, Oct 24).

Backtrace

.cinnamon-wrapp[2266]: segfault at 0 ip 000076047c0c839b sp 00007ffe22648e70 error 4 in libcvc.so.0.0.0

#0  _pa_context_get_card_info_by_index_cb (libcvc.so.0 + 0xe39b)
#1  context_get_card_info_callback (libpulse.so.0 + 0x1f9af)
#2  run_action (libpulsecommon-17.0.so + 0x48fd2)
#3  pa_pdispatch_run (libpulsecommon-17.0.so + 0x49380)
#4  pstream_packet_callback (libpulse.so.0 + 0x13167)
#5  do_read (libpulsecommon-17.0.so + 0x4bd82)
#6  do_pstream_read_write (libpulsecommon-17.0.so + 0x4ee0f)
#7  dispatch_func (libpulse-mainloop-glib.so.0 + 0x268c)
#8  g_main_context_dispatch_unlocked (libglib-2.0.so.0 + 0x62c0b)
#9  g_main_context_iterate_unlocked.isra.0 (libglib-2.0.so.0 + 0x661d8)
#10 g_main_loop_run (libglib-2.0.so.0 + 0x66cf7)
#11 meta_run (libmuffin.so.0 + 0xd1cdc)
#12 main (.cinnamon-wrapped + 0x2810)

The faulting instruction loads offset 0x30 of the pa_card_info struct, which is active_profile, and then dereferences it. That is active_profile->name with active_profile == NULL.

In the same second, pipewire-pulse logged warnings about one of the cards. Blueman hit a NULL active_profile on the same card while handling the same card info:

pipewire-pulse: mod.protocol-pulse: card 56 port 0 profiles inconsistent (0 < 3)
...
blueman.desktop:   File ".../blueman/main/PulseAudioUtils.py", line 300, in __card_info
blueman.desktop:     "active_profile": card_info[0].active_profile[0].name.decode("UTF-8")
blueman.desktop: ValueError: NULL pointer access

(Card 56 is alsa_card.pci-0000_0e_00.6, the onboard Ryzen HD Audio Controller.)

Cause

On current master, update_card() in libcvc/gvc-mixer-control.c dereferences active_profile without a check in two places:

is_default = (g_strcmp0 (pi.name, info->active_profile->name) == 0);   // ~L2588
...
gvc_mixer_card_set_profile (card, info->active_profile->name);         // ~L2626

Upstream

libcvc is forked from GNOME's libgnome-volume-control, and GNOME's copy has the same bug. It's being tracked there:

• GNOME/libgnome-volume-control#47: update_card() crashes with NULL deref when a PulseAudio card reports zero profiles (gsd-media-keys)
• GNOME/libgnome-volume-control#50: gnome-shell segfaults about 1s after login, with the same _pa_context_get_card_info_by_index_cb top frame, also on an RX 9070 XT system with PipeWire
• GNOME/libgnome-volume-control!38: open MR with the fix (https://gitlab.gnome.org/GNOME/libgnome-volume-control/-/merge_requests/38)

Suggested fix

Same as GNOME's !38: guard both dereferences.

-                is_default = (g_strcmp0 (pi.name, info->active_profile->name) == 0);
+                is_default = (info->active_profile != NULL &&
+                              g_strcmp0 (pi.name, info->active_profile->name) == 0);
...
-        gvc_mixer_card_set_profile (card, info->active_profile->name);
+        if (info->active_profile != NULL)
+                gvc_mixer_card_set_profile (card, info->active_profile->name);

Since csd-media-keys and the sound applet also use libcvc, this crash isn't limited to the Cinnamon process itself.