Linux: renderer SIGKILLed mid-call (Exit Code: 9) — RingRTC SCHED_FIFO threads exceed RLIMIT_RTTIME

Using a supported version?

• I have searched open and closed issues for duplicates.
• I am using Signal-Desktop as provided by the Signal team, not a 3rd-party package.

Overall summary

On Linux, the renderer gets SIGKILLed partway through 1:1 voice calls (Render process is gone: Error: Reason: killed, Exit Code: 9). This happened three times on 8.27.0, after about 18, 8 and 9 minutes in a call. There was nothing in the kernel log and no OOM.

I traced it to the kernel's RLIMIT_RTTIME hard limit. RingRTC's WebRTC threads switch themselves to SCHED_FIFO with pthread_setschedparam whenever RLIMIT_RTPRIO allows it. But the process runs with a 200 ms RLIMIT_RTTIME. As soon as one of those threads uses 200 ms of CPU without blocking, the kernel SIGKILLs the whole renderer. Nothing gets logged and no crash dump is written.

Why this setup triggers it:

• The user is in the audio group with @audio - rtprio 50 in /etc/security/limits.d/audio.conf, which is common on JACK/pro-audio setups. So the FIFO request succeeds instead of failing with EPERM as it would on a default install.
• Apps started from GNOME Shell inherit RLIMIT_RTTIME = 200000/200000 µs. /proc/<pid>/limits shows it for gnome-shell, brave, spotify, pipewire and wireplumber. Every Signal process shows Max realtime priority 50/50 and Max realtime timeout 200000/200000 us.

Evidence:

1. I ran bpftrace on tracepoint:signal:signal_generate, filtered to SIGKILL, during the third crash:
   复制

   19:39:34 SIGKILL from AudioEncoderQue (pid 37274) -> AudioEncoderQue (pid 37395)
   19:39:34 SIGKILL from signal-desktop (pid 37202) -> signal-desktop (pid 37274)

   37274 is the renderer and 37395 is its AudioEncoderQue thread. (In this probe pid is the sender's TGID and args->pid is the target TID.) The first SIGKILL is generated in that thread's own context and aimed at itself, which is what the posix CPU-timer path does when RLIMIT_RTTIME is exceeded. The second line is the browser process cleaning up.
2. libringrtc-x64.node imports pthread_setschedparam and sched_get_priority_max. rtkit logged no realtime grants for any Signal process.
3. I reproduced the mechanism outside Signal with the same limits. A SCHED_FIFO priority-49 busy loop under prlimit --rttime=200000:200000 --rtprio=50:50 is SIGKILLed after 0.226 s (exit 137). Under --rtprio=0:0, sched_setscheduler fails with EPERM instead.
4. Ruled out: kernel OOM (nothing in journalctl -k), earlyoom (no kills logged), systemd-oomd (inactive), seccomp/AppArmor audit events, and Bluetooth/PipeWire events at the crash times. About 21% of RAM and 75% of swap were free.

On the same machine, 8.26.0 had calls of up to 3 hours without this. I don't know whether 8.27.0 changed thread priorities or those earlier calls were just lucky.

Workaround: launch with prlimit --rtprio=0:0 /opt/Signal/signal-desktop %U (for example in a ~/.local/share/applications override of the .desktop file). The FIFO request then fails, and the threads stay SCHED_OTHER. With this, every Signal process shows Max realtime priority 0/0. I haven't confirmed it over a long call yet.

Suggested fix: avoid raw SCHED_FIFO for call threads on Linux, at least for threads that can do long CPU bursts like the audio encoder queue. Otherwise, make sure the RT threads can't exceed RLIMIT_RTTIME.

Related: #5454 (realtime threads in Signal Desktop, 2021).

Steps to reproduce

1. Use Linux with RLIMIT_RTPRIO ≥ 49 (for example a user in the audio group with rtprio 50) and a finite RLIMIT_RTTIME. On Ubuntu 24.04 GNOME, apps inherit 200 ms from gnome-shell.
2. Start Signal Desktop from the GNOME launcher.
3. Start a 1:1 voice call and stay in it.
4. After a few minutes (8–18 min in my cases), the renderer is killed.

Expected result

The call continues normally.

Actual result

The call drops, a dialog appears, and Signal quits:

Render process is gone
Error: Reason: killed, Exit Code: 9
    at EventEmitter.<anonymous> (bundles:///main.js:12:2281)
    at EventEmitter.emit (node:events:509:28)
    at WebContents.<anonymous> (node:electron/js2c/browser_init:2:103007)
    at WebContents.emit (node:events:509:28)

Screenshots

No response

Signal version

8.27.0 (deb from updates.signal.org; RingRTC 2.71.0, Electron 43.5.0)

Operating system

Ubuntu 24.04.5 LTS, kernel 6.8.0-139-generic, GNOME on Wayland, PipeWire 1.0.5, Intel i9-13900H

Version of Signal on your phone

No response

Link to debug log

Can provide one on request.