Skip to content

session_connect segfaults in ei_seat_bind_capabilities on libei 1.5.0 (Fedora 43 / Bazzite) #29

@jflessenkemper

Description

@jflessenkemper

Summary

session_connect (and --default-live-session mode) crashes with SIGSEGV inside ei_seat_bind_capabilities on first call. Repro on a fresh KDE Plasma 6 Wayland session under Fedora 43 (Bazzite stable, May 2026 image).

Environment

  • Distro: Bazzite stable (atomic Fedora 43, image ghcr.io/ublue-os/bazzite:stable 44.20260508)
  • Compositor: KDE Plasma 6 / kwin_wayland (running)
  • libei: 1.5.0-1.fc43
  • libeis: 1.5.0-1.fc43
  • Python: 3.14.3-2.fc43
  • kwin-mcp: 0.7.0 (installed via pip into a venv with --system-site-packages to pick up Fedora's python3-cairo 1.28 + python3-gobject 3.54.5)
  • a11y bus running (org.a11y.Bus, org.freedesktop.a11y.Manager both present)

Repro

python3 -m venv --system-site-packages ~/kwin-venv
~/kwin-venv/bin/pip install kwin-mcp
~/kwin-venv/bin/kwin-mcp --default-live-session  # stdio MCP server
# then send: initialize, notifications/initialized, tools/call session_connect

The handshake + tools/list work fine (returns 30 tools). The crash happens the moment session_connect is invoked.

Stack trace (coredumpctl)

Signal: 11 (SEGV)
#0  0x00007f1d816548e8 ei_seat_bind_capabilities (libei.so.1 + 0xd8e8)
#1  0x00007f1d81b64056 ffi_call_unix64           (libffi.so.8 + 0x8056)
#2  0x00007f1d81b5fd16 ffi_call_int.lto_priv.0   (libffi.so.8 + 0x3d16)
#3  0x00007f1d81b627ae ffi_call                  (libffi.so.8 + 0x67ae)
#4  0x00007f1d81b9904b _ctypes_callproc          (_ctypes.cpython-314 + 0x1104b)
#5  0x00007f1d81b8b118 PyCFuncPtr_call.cold      (_ctypes.cpython-314 + 0x3118)
#6  0x00007f1d92d6fdbc _PyObject_Call            (libpython3.14.so.1.0 + 0x263dbc)

The crash is inside libei itself, called via raw ctypes — suggests the ctypes signature / caller assumptions in kwin_mcp/input.py (or wherever the EI seat is set up) don't match what libei 1.5 expects. Most likely candidates:

  1. ei_seat_bind_capabilities is being called with an invalid/NULL ei_seat* (seat not yet ready in 1.5's lifecycle).
  2. The capabilities argument's bit layout changed between libei 1.3/1.4 and 1.5.
  3. The seat needs an explicit handshake step (e.g. ei_seat_add_listener / wait for "added" event) before bind, that older versions tolerated being skipped.

Suggested fix

Switch from raw ctypes to pyei (python3-pyei is in Fedora and tracks libei) or wait for the seat-added event before calling ei_seat_bind_capabilities. Happy to test patches.

Workaround (for users hitting this)

Disable kwin-mcp until fixed. Fall back to ydotool (kernel uinput) for mouse/keyboard or libei via libei's own client tools.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions