Public bug reported: Package: mutter (binary libmutter-18-0) Ubuntu release: 26.04 (Resolute), amd64 Installed affected version: libmutter-18-0 50.1-0ubuntu2.2 GNOME Shell: 50.1-0ubuntu1.1 Session type: Wayland
Summary ------- Mutter's native virtual keyboard can leave a generated modifier contribution held after the virtual device is destroyed. This is reproducible with an uppercase keysym press followed by RemoteDesktop session Stop before the corresponding keysym release. Ordinary input from another keyboard then remains shifted even though Caps Lock is false and that keyboard has released its keys. Reproduction (ONLY in a disposable isolated compositor) ----------------------------------------------------- Do not run the interrupting sequence against your working desktop: it deliberately leaves input in a broken state on the affected compositor. 1. Start a separate Mutter instance under a private dbus-run-session, with its own mode-0700 XDG_RUNTIME_DIR, private config/cache/data/state directories, GSETTINGS_BACKEND=memory, and no inherited DISPLAY. Use --wayland --headless --no-x11 --virtual-monitor=800x600 and a private Wayland display name. Verify the org.gnome.Mutter.RemoteDesktop D-Bus owner PID equals the launched child PID before input. 2. Open and focus a native GTK text entry on that private display with a US keymap. Keep a focus keyboard session alive throughout the test. 3. Create and start a RemoteDesktop session using org.gnome.Mutter.RemoteDesktop.CreateSession and org.gnome.Mutter.RemoteDesktop.Session.Start. 4. On that session, call NotifyKeyboardKeysym with keysym 65 (XKB_KEY_A) and pressed=true. Do NOT send its matching release. 5. Call Stop on that session, causing its owned virtual keyboard to be torn down. 6. On a separate probe keyboard session, send balanced evdev keycode presses/releases for A (30) and 1 (2), without pressing Shift. Read the native entry and native modifier state. 7. Destroy only the private compositor and its owned sessions after recording the result. Expected -------- The destroyed keyboard releases all of its owned primary-key and generated-modifier contributions. The balanced probe produces "a1", modifier mask 0, Caps Lock false. Actual on the installed unmodified libmutter-18-0 ----------------------------------------------- The probe produces "A!", modifier mask 1, Caps Lock false. The generated Shift contribution outlives the virtual keyboard. Controls -------- - Balanced uppercase keysym press/release followed by Stop does not leak. - Explicit Shift and letter keycodes held until Stop are released by teardown. - A second keyboard's legitimate Shift ownership must survive teardown of the first keyboard; resetting all seat state is not an acceptable fix. Source mechanism ---------------- In src/backends/native/meta-virtual-input-device-native.c, apply_level_modifiers_in_impl() sends generated Shift_L or ISO_Level3_Shift directly through meta_seat_impl_notify_key_in_impl(). Those generated contributions are not tracked in the virtual device's button_count[]. release_device_in_impl() releases the tracked primary keys/buttons but misses the generated modifier after an interrupted keysym sequence. A related release-time problem is reproducible when a keysym is pressed under US, the private compositor's keymap changes to French, and the same keysym is released. The existing path resolves the release against the new map rather than the press-time primary code. The baseline warns about multiple releases and leaves the original primary key held until device teardown. Distinction from LP #2079823 / GNOME Mutter #3340 ----------------------------------------------- https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2079823 https://gitlab.gnome.org/GNOME/mutter/-/work_items/3340 Those reports were closed by Mutter !4546, "wayland: Drop second accounting of keyboard modifiers", included in Mutter 49.rc and Ubuntu 49~rc-0ubuntu2: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/4546 That change affects src/wayland/meta-wayland-keyboard.c and removes duplicate modifier-state reporting/accounting between Wayland clients and Clutter. The corresponding implementation is already present in the 50.1 source underlying the affected package. The isolated interrupted- keysym reproduction above still fails on installed 50.1-0ubuntu2.2. This report concerns generated-modifier ownership during virtual-device teardown, not evidence that the older Caps Lock fix is absent. Candidate repair evidence (not an upstream/released fix) ------------------------------------------------------- A local source patch stores each accepted keysym's press-time primary evdev code and resolved generated modifier, releases those exact owned contributions on release/teardown, preserves exclusive primary-key suppression, and relies on existing seat reference counts to preserve overlapping modifiers and other devices' ownership. It does not reset global counts or XKB state. The candidate passed an isolated real-compositor matrix covering interrupted and balanced input, explicit/generated overlap orderings, multiple symbols sharing Shift, cross-device ownership, unmatched/duplicate releases, primary API conflicts, layout-dependent release, and generated Level3 teardown. Both Left and Right Shift were checked for held "A!" and released "a1", followed by mask 0 and Caps false. An extracted paired local package also passed the interrupted case and both-Shift checks in a separate headless instance of the installed GNOME Shell, with runtime library hashes recorded. The custom matched package pair has since been installed locally. A separate headless GNOME Shell using the system-installed library passed the interrupted case and both Shift transitions, with its loaded library hash verified. After reboot, the working GNOME Shell was also verified to map the installed patched library inode with the expected SHA256. Physical-key behavior in that restarted desktop is not yet independently recorded. These are bounded results, not proof against every possible stuck-modifier mechanism. The application responsible for the original real-desktop incident remains unknown; no client is blamed by this report. ** Affects: mutter (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to mutter in Ubuntu. https://bugs.launchpad.net/bugs/2166586 Title: [Wayland] Interrupted NotifyKeyboardKeysym leaves generated Shift held after virtual keyboard teardown To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2166586/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
