[Linux] SIGSEGV inside exit() during service shutdown, IP == fault address (Hyprland/NVIDIA)

报告中没有指出源文件或测试。首先，使用列出的 Arch Linux、Hyprland、NVIDIA 和 Sunshine 版本重现关机崩溃，然后检查 coredump 以及 terminate handler、main-loop 退出和退出时清理相关的关机路径。完成标准是确定发生故障的清理序列，并确认重复关机不再崩溃。

Is there an existing issue for this?

• I have searched the existing issues (closest match: #5378, "SIGSEGV on client disconnect" — same fault signature class, different code path and already fixed for that path)

Is your issue described in the documentation?

• I have read the documentation

Is your issue present in the latest beta/pre-release?

Unknown / not tested. Installed release is the "Latest" stable tag v2026.516.143833 (2026-05-16, Arch package build date 2026-08-13, installed 2026-08-28). The repo's most recent pre-releases (v2026.830.223700, v2026.830.165455) are ~3.5 months newer and postdate the fix for #5378 (nightly 2026.713.170739), so this may already be resolved upstream — flagging that gap rather than assuming a fresh bug.

Describe the Bug

sunshine segfaults with SIGSEGV while the process is inside exit() (i.e. after its own main loop has already exited cleanly), not during active streaming. Fault address equals the instruction pointer and resolves to no mapped module — same signature class as #5378 ("instruction pointer equal to the faulting address", consistent with a jump through a dangling/stale function pointer), but here the crash lands in the exit-time cleanup path (__run_exit_handlers → exit()) rather than in the RTSP disconnect handler.

Timeline (systemd/journal, all times local):

20:08:44  client sends GET /unpair (Moonlight, macOS client "roth")
20:08:57.944819  systemd: Stopping Self-hosted game stream host for Moonlight...
20:08:57.944     sunshine: Info: Terminate handler called
20:08:57.946     sunshine: Info: Main loop has exited
20:08:58.084631  kernel: sunshine[108442]: segfault at 7fcfc40000c8 ip 00007fcfc40000c8 sp 00007ffcb348fcc8 error 15 likely on CPU 3 (core 3, socket 0)

No systemctl stop invocation appears in the journal around the stop request — the terminate signal's origin wasn't captured (only that libwrap-visible systemd unit transition + Sunshine's own terminate-handler log line, effectively simultaneous).

At the moment of the crash, a worker thread was blocked inside libcuda.so.1 (poll()), i.e. a CUDA/NVENC context was still live — consistent with an encoder/GPU-resource destructor running in the wrong order during shutdown.

coredumpctl info backtrace (crashing thread; full output with all 8 threads available on request):

Stack trace of thread 108442:
#0  0x00007fcfc40000c8 n/a (n/a + 0x0)
#1  0x00005605a664df84 n/a (sunshine + 0x103f84)
#2  0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#3  0x00005605a660cffa n/a (sunshine + 0xc2ffa)
#4  0x00005605a6620ea6 n/a (sunshine + 0xd6ea6)
#5  0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#6  0x00005605a6647735 n/a (sunshine + 0xfd735)
#7  0x00005605a6610a96 n/a (sunshine + 0xc6a96)
#8  0x00005605a66f7dbf n/a (sunshine + 0x1addbf)
#9  0x00007fd01b640fbf n/a (libc.so.6 + 0x40fbf)
#10 0x00007fd01b64109e exit (libc.so.6 + 0x4109e)
#11 0x00007fd01b627788 n/a (libc.so.6 + 0x27788)
#12 0x00007fd01b6278b9 __libc_start_main (libc.so.6 + 0x278b9)
#13 0x00005605a6603b75 n/a (sunshine + 0xb9b75)

No debug symbols were available for this build (not on debuginfod.archlinux.org — this is an Arch/Omarchy community package build, not upstream-provided debuginfo), so the sunshine + 0x... offsets are unresolved. Happy to provide the raw (root-owned) coredump if it's useful for offline symbolization against this exact build (BuildID ce1214ae1aaa2e5873a39a5359b9fdba3be96b5f).

This is not an isolated one-off on this machine: coredumpctl list sunshine shows 6 crashes across 3 days since installing the package, in at least two distinct failure modes — this exit-time SIGSEGV (twice, back-to-back with a SIGABRT at shutdown ~3 min earlier the same evening), three SIGSEGVs within a 10-minute window on the day of install, and separately a SIGABRT (SI_TKILL) during startup inside gtk_init_check → wl_display_roundtrip_queue, unrelated to this report.

No user data loss (streaming host, no persisted user documents); Restart=on-failure (5s) on the systemd unit masks the outage in most cases.

Expected Behavior

Sunshine should tear down GPU/encoder resources and any other static state during shutdown without segfaulting, regardless of whether shutdown was triggered by a config change (pairing/unpairing), signal, or normal exit.

Additional Information

No response

Host Operating System

Arch Linux (Omarchy 4.0.1), kernel 7.1.9-arch1-2

Sunshine commit/version

v2026.516.143833 (Arch package sunshine 2026.516.143833-4, build date 2026-08-13)

Capture method

wlgrab (Wayland), Hyprland 0.56.2

GPU Type

Nvidia

GPU Model

NVIDIA GeForce RTX 3060 Ti

GPU driver/mesa version

610.57.04

Config

No response

Apps.json

No response

Relevant log output

Aug 28 20:08:58.084631 NXHome kernel: sunshine[108442]: segfault at 7fcfc40000c8 ip 00007fcfc40000c8 sp 00007ffcb348fcc8 error 15 likely on CPU 3 (core 3, socket 0)
Aug 28 20:08:58.086214 NXHome systemd-coredump[334111]: Process 108442 (sunshine) of user 1000 terminated abnormally with signal 11/SEGV, processing...
Aug 28 20:08:58.974857 NXHome systemd[1642]: app-dev.lizardbyte.app.Sunshine.service: Main process exited, code=dumped, status=11/SEGV
Aug 28 20:08:58.974953 NXHome systemd[1642]: app-dev.lizardbyte.app.Sunshine.service: Failed with result 'core-dump'.