SIGSEGV in CDRMFB::drop() during session termination via loginctl

[skylight74]

Summary

Hyprland crashes with SIGSEGV in libaquamarine during graceful session termination triggered by loginctl terminate-user. The crash occurs in CDRMFB::drop() during the DRM backend cleanup path when dropping framebuffers during connector disconnect. This prevents session recovery and requires a full system reboot.

System Information

Component	Version
Distro	CachyOS (Arch-based, rolling)
Kernel	6.18.5-2-cachyos
Hyprland	0.53.1-1
Aquamarine	0.10.0-2.1
Hyprutils	0.11.0-1.1
SDDM	0.21.0-8
UWSM	0.26.0-1
GPU	AMD Phoenix1 (integrated, rev c7)
Driver	amdgpu (kernel DRM)

Monitor Configuration

• eDP-1: Laptop display
• HDMI-A-1: Samsung C27R50x (external)
• DP-1: External monitor

Environment

export AQ_DRM_DEVICES=/dev/dri/card1
export AQ_TRACE=1  # enabled to debug this issue

Steps to Reproduce

1. Start Hyprland session via SDDM using UWSM
2. Use the session normally (multiple monitors connected)
3. Run: loginctl terminate-user $USER
4. Expected: Session terminates gracefully, SDDM shows login screen
5. Actual: Hyprland crashes with SIGSEGV, SDDM reports "Process crashed", session cannot recover

Stack Trace

Signal: 11 (SEGV)

#0  0x00007f202018fc31 Aquamarine::CLogger::log(...) (libaquamarine.so.9 + 0x87c31)
#1  0x00007f20201cc5a5 Aquamarine::CDRMFB::drop() (libaquamarine.so.9 + 0xc45a5)
#2  0x00007f20201cc751 n/a (libaquamarine.so.9 + 0xc4751)
#3  0x00007f20200ad459 Hyprutils::Signal::CSignalListener::emitInternal(void*) (libhyprutils.so.10 + 0x39459)
#4  0x00007f20200ad723 Hyprutils::Signal::CSignalBase::emitInternal(void*) (libhyprutils.so.10 + 0x39723)
#5  0x00007f20201826ed Aquamarine::CGBMBuffer::~CGBMBuffer() (libaquamarine.so.9 + 0x7a6ed)
#6  0x00007f2020182b7b Hyprutils::Memory::CSharedPointer<Aquamarine::CGBMBuffer>::_delete(void*) (libaquamarine.so.9 + 0x7ab7b)
#7  0x00007f202018357e Hyprutils::Memory::CSharedPointer<Aquamarine::CSwapchain>::_delete(void*) (libaquamarine.so.9 + 0x7b57e)
#8  0x00007f20201e95ae Aquamarine::IOutput::~IOutput() (libaquamarine.so.9 + 0xe15ae)
#9  0x00007f20201ca22b Hyprutils::Memory::CSharedPointer<Aquamarine::CDRMOutput>::_delete(void*) (libaquamarine.so.9 + 0xc222b)
#10 0x00007f20201bef8e Aquamarine::SDRMConnector::disconnect() (libaquamarine.so.9 + 0xb6f8e)
#11 0x00007f20201b1967 Aquamarine::CDRMBackend::~CDRMBackend() (libaquamarine.so.9 + 0xa9967)
#12 0x00007f20201ca1cb Hyprutils::Memory::CSharedPointer<Aquamarine::CDRMBackend>::_delete(void*) (libaquamarine.so.9 + 0xc21cb)
#13 0x00007f2020184715 Aquamarine::CBackend::~CBackend() (libaquamarine.so.9 + 0x7c715)
#14 0x00007f2020184ec8 Hyprutils::Memory::CSharedPointer<Aquamarine::CBackend>::_delete(void*) (libaquamarine.so.9 + 0x7cec8)
#15 0x00007f202019f74a n/a (libaquamarine.so.9 + 0x9774a)
#16 0x00007f201f046ec3 __cxa_finalize (libc.so.6 + 0x46ec3)
#21 0x00007f201f047730 exit (libc.so.6 + 0x47730)

Analysis

The crash occurs during the cleanup sequence triggered by exit():

1. exit() triggers __cxa_finalize running destructors
2. CBackend::~CBackend() → CDRMBackend::~CDRMBackend()
3. SDRMConnector::disconnect() disconnects outputs
4. CDRMOutput → IOutput::~IOutput() → CSwapchain deleted
5. CGBMBuffer::~CGBMBuffer() emits signal for buffer drop
6. CDRMFB::drop() crashes while attempting to log

The crash appears to be a use-after-free or null pointer dereference in CDRMFB::drop() during the logging operation. The framebuffer may already be in an invalid state when drop() is called during destructor chaining.

SDDM Logs

Jan 17 20:19:33 sddm: Authentication error: SDDM::Auth::ERROR_INTERNAL "Process crashed"
Jan 17 20:19:33 sddm: Auth: sddm-helper crashed (exit code 1)

Impact

• Session cannot be terminated gracefully via loginctl terminate-user
• Session cannot recover after crash, leaving black screen
• Requires full system reboot or service restart to recover

Workaround

Restarting the SDDM service (systemctl restart sddm) after the crash allows logging back in.

Related Issues

• Terminating session with loginctl --terminate-session causes Hyprland to exit status 1, crashing SDDM Hyprland#4399 (closed as NOT_PLANNED, but different stack trace)
• Crash on an attempt to close mpv fullscreen window Hyprland#8628 (fixed, but different code path)

Coredump

Available at /var/lib/systemd/coredump/core.Hyprland.1000.*.zst - can provide if needed.

[Manix80]

Have you tried the git packages? It also looks like : here and discuss. Otherwise, you can try building Aquamarine manually and loading the .so files manually. Unfortunately, that was for version 0.52.1-5 of Hyprland. Since the latest version 0.53.1-1, coredump again.... : discuss. Personally, I have disabled coredumps via sysctl for the moment