** Description changed:
- Haven't determined the exact trigger, but the crashes are frequent with
- just minimal use.
+ [ Impact ]
- ProblemType: Bug
- DistroRelease: Ubuntu 26.04
- Package: gnome-shell 50.1-0ubuntu1
- ProcVersionSignature: Ubuntu 7.0.0-14.14-generic 7.0.0
- Uname: Linux 7.0.0-14-generic x86_64
- NonfreeKernelModules: zfs
- ApportVersion: 2.34.0-0ubuntu2
- Architecture: amd64
- CasperMD5CheckResult: pass
- CasperVersion: 26.04.2
- CloudArchitecture: x86_64
- CloudID: nocloud
- CloudName: unknown
- CloudPlatform: nocloud
- CloudSubPlatform: seed-dir (/var/lib/cloud/seed/nocloud)
- Date: Fri Apr 24 15:32:27 2026
- DisplayManager: gdm3
- GsettingsChanges:
-
- LiveMediaBuild: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
- ProcEnviron:
- LANG=C.UTF-8
- PATH=(custom, no user)
- SHELL=/bin/bash
- TERM=screen
- RelatedPackageVersions: mutter-common 50.1-0ubuntu2
- SourcePackage: gnome-shell
- UpgradeStatus: No upgrade log present (probably fresh install)
+ gnome-shell crashes with heap corruption ("free(): invalid pointer") on
+ some systems using Nouveau graphics, due to Nouveau's use of the Zink
+ stack in Mesa 26.
+
+ [ Test Plan ]
+
+ Requires Nvidia hardware and the default open source (Nouveau) driver to
+ be active.
+
+ There is no known test case to reproduce the issue on demand. Judging by
+ the fix, it is a race condition between threads and so is unpredictable.
+ We would need to rely on the feedback of crash reports from frequently-
+ affected users and to track automated crash reports in
+ https://errors.ubuntu.com/problem/3eeb40f2bfda80a6bfa3b538516c3a251ce01b51
+
+ [ Where problems could occur ]
+
+ The fix only affects the Zink code path in Mesa, so only users of
+ Nouveau could be impacted. Zink can also be used manually but we expect
+ that proportion of users to be negligible.
+
+ Tracking error bucket
+ https://errors.ubuntu.com/problem/3eeb40f2bfda80a6bfa3b538516c3a251ce01b51
+ is not totally reliable because it could collect false positives from
+ any other heap corruption in gnome-shell. Although none other is known
+ right now, we should expect false positives from buggy extensions for
+ example. And we have no control over what extensions people experiment
+ with.
+
+ [ Other Info ]
+
+ The bug does not manifest frequently enough to even be detectable by
+ Valgrind on the appropriate hardware.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2150244
Title:
[nouveau] [zink] gnome-shell crashes with free(): invalid pointer
To manage notifications about this bug go to:
https://bugs.launchpad.net/mesa/+bug/2150244/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
