Public bug reported:
Package: unity 7.7.0+23.04.20230222.2-0ubuntu7
Distribution: Ubuntu 24.04 LTS (noble), Unity 7 session on X11, compiz as
unity7.service
NOTE ON THE "MODIFIED" PACKAGE FLAG
Apport flags this package as modified. The only modified file is
/usr/lib/x86_64-linux-gnu/compiz/libunityshell.so, and the modification is
precisely the fix proposed below - I rebuilt 7.7.0+23.04.20230222.2-0ubuntu7
with
the patch in order to verify it.
The bug itself was reproduced four times on the stock, unmodified package (one
crash report from 2026-08-22 and three from 2026-08-28), all with a
byte-identical
signature. The pristine library is kept at
/usr/lib/x86_64-linux-gnu/.bak_unityshell_28.08.2026/ and can be restored with a
single copy if a stock-package reproduction is required.
SUMMARY
unity::decoration::Window::Impl::ComputeShapedShadowQuad() dereferences
shaped_shadow_pixmap_ without checking it for NULL. Any application that rapidly
maps and unmaps shaped override-redirect windows - Wine menus are a perfect
generator - reliably crashes compiz, taking the whole session down with it.
BACKTRACE
#0 unity::decoration::Window::Impl::ComputeShapedShadowQuad ()
#1 unity::decoration::Window::UpdateDecorationPosition ()
#2 unity::UnityWindow::windowNotify (CompWindowNotify)
#3 CompWindow::windowNotify (CompWindowNotify)
#4 CompWindow::map ()
#5 PrivateCompositeScreen::handleEvent (_XEvent*)
...
#30 PrivateScreen::processEvents ()
Faulting instruction, with rax = 0:
mov 0x240(%rbx),%rax ; shaped_shadow_pixmap_
mov 0x8(%rax),%rdx ; <-- SIGSEGV
ROOT CAUSE
In decorations/DecoratedWindow.cpp:
Shape shape(win_->id());
if (shape.GetRectangles().empty())
{
shaped_shadow_pixmap_.reset(); // (1) becomes NULL, last_shadow_rect_ is
NOT reset
return;
}
...
int width = shape.Width() + radius * 2 * SHADOW_BLUR_MARGIN_FACTOR;
int height = shape.Height() + radius * 2 * SHADOW_BLUR_MARGIN_FACTOR;
if (width != last_shadow_rect_.width() || height !=
last_shadow_rect_.height())
shaped_shadow_pixmap_ = BuildShapedShadowTexture(...); // (2) only inside
the if
const auto* texture = shaped_shadow_pixmap_->texture(); // (3) no
NULL check
Step (1) clears shaped_shadow_pixmap_ but leaves last_shadow_rect_ holding the
previous size. On the next call for the same window the recomputed width/height
therefore match last_shadow_rect_, the condition in (2) is false, the texture is
never rebuilt, and (3) dereferences a NULL pointer.
The empty Shape comes from XShapeGetRectangles() failing because the window is
already gone; DecorationsShape.cpp:78 logs this as "Failed to get shape
rectangles". That line appears many times per minute under load, so the window
into the bug is wide.
REPRODUCTION
1. Unity 7 session on X11.
2. Run any Wine application with rich menus (Notepad++ under Wine was used
here).
3. Open and close menus rapidly for a minute or two.
compiz dies with SIGSEGV. Note that Chromium-based applications (Chrome, VS
Code)
die along with it, because their GPU process does not survive the compositor
going
away - which is what makes this look like a whole-session crash to the user.
WHY THIS LIKELY WENT UNNOTICED FOR YEARS
The crashing path needs a shaped window to be mapped and then destroyed before
Unity gets around to reading its shape. Native GTK/Qt clients rarely produce
that
pattern: their menus are comparatively long-lived and often reused.
Wine is an unusually aggressive generator of exactly this pattern. Every Wine
menu
is a shaped, override-redirect window, and a user working through an
application's
menus creates and destroys dozens of them per minute. Under that load
XShapeGetRectangles() fails constantly - "Failed to get shape rectangles" was
logged 87 times in a single minute here - so the race is hit continuously rather
than occasionally.
This is probably why the code has been unchanged since 2023-02-22 without anyone
noticing: Unity's shaped-shadow path appears never to have been stress-tested
against a client that churns shaped windows this fast. Wine is not required to
trigger the bug, it just makes it trivially reproducible.
FIX
- if (width != last_shadow_rect_.width() || height !=
last_shadow_rect_.height())
+ if (!shaped_shadow_pixmap_ ||
+ width != last_shadow_rect_.width() || height !=
last_shadow_rect_.height())
shaped_shadow_pixmap_ = BuildShapedShadowTexture({width, height},
radius, color, shape);
+ if (!shaped_shadow_pixmap_)
+ return;
+
const auto* texture = shaped_shadow_pixmap_->texture();
Rebuild the texture when the pointer is NULL (the missed case), and bail out if
the
build itself returned nothing. Patch attached as well.
VERIFICATION
Rebuilt unity 7.7.0+23.04.20230222.2-0ubuntu7 with this patch and replaced only
libunityshell.so. The same workload that previously crashed compiz within one to
two minutes, four times out of four, no longer crashes it.
Measured with the "Failed to get shape rectangles" counter, which tracks the
race
itself rather than the crash:
before the patch: 21, 49 and 54 occurrences per minute -> crash every time
after the patch: 87 occurrences per minute -> no crash
The race is hit more often than before, and no longer kills compiz - so the null
dereference is fixed rather than the symptom being hidden.
The code is unchanged since 2023-02-22 and -0ubuntu8 is a no-change rebuild, so
this affects every current Unity 7 user.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: unity 7.7.0+23.04.20230222.2-0ubuntu7 [modified:
usr/lib/x86_64-linux-gnu/compiz/libunityshell.so]
ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12
Uname: Linux 6.8.0-138-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
.proc.driver.nvidia.capabilities.fabric-imex-mgmt:
DeviceFileMinor: 4323
DeviceFileMode: 256
DeviceFileModify: 1
.proc.driver.nvidia.capabilities.gpu0: Error: path was not a regular file.
.proc.driver.nvidia.capabilities.mig: Error: path was not a regular file.
.proc.driver.nvidia.gpus.0000.03.00.0: Error: path was not a regular file.
.proc.driver.nvidia.registry: Binary: ""
.proc.driver.nvidia.suspend: suspend hibernate resume
.proc.driver.nvidia.suspend_depth: default modeset uvm
.proc.driver.nvidia.version:
NVRM version: NVIDIA UNIX x86_64 Kernel Module 580.173.02 Tue Jun 23
08:38:17 UTC 2026
GCC version: gcc version 13.3.0 (Ubuntu 13.3.0-6ubuntu2~24.04.1)
.tmp.unity_support_test.0:
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
BootLog: Error: [Errno 13] Відмовлено у доступі: '/var/log/boot.log'
CasperMD5CheckResult: unknown
CompositorRunning: compiz
CompositorUnredirectDriverBlacklist: '(nouveau|Intel).*Mesa 8.0'
CompositorUnredirectFSW: true
CurrentDesktop: Unity:Unity7:ubuntu
Date: Fri Aug 28 13:08:37 2026
DistUpgraded: 2026-01-25 10:58:38,036 DEBUG /openCache(), new cache size 99177
DistroCodename: noble
DistroVariant: ubuntu
DkmsStatus:
nvidia/580.173.02, 6.8.0-137-generic, x86_64: installed
nvidia/580.173.02, 6.8.0-138-generic, x86_64: installed
GraphicsCard:
NVIDIA Corporation GP108 [GeForce GT 1030] [10de:1d01] (rev a1) (prog-if 00
[VGA controller])
Subsystem: Micro-Star International Co., Ltd. [MSI] GP108 [GeForce GT 1030]
[1462:8122]
InstallationDate: Installed on 2025-04-17 (498 days ago)
InstallationMedia: Ubuntu-Unity 24.04.1 LTS "Noble Numbat" - Release amd64
(20240827)
MachineType: Intel X99
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-138-generic
root=UUID=d5fe16a6-aae2-4910-9315-e7cf73810e77 ro quiet splash vt.handoff=7
SourcePackage: unity
UpgradeStatus: Upgraded to noble on 2026-01-25 (215 days ago)
dmi.bios.date: 12/02/2022
dmi.bios.release: 5.11
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 5.11
dmi.board.asset.tag: Default string
dmi.board.name: X99H
dmi.board.vendor: Intel
dmi.board.version: Default string
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: Intel
dmi.chassis.version: Default string
dmi.modalias:
dmi:bvnAmericanMegatrendsInc.:bvr5.11:bd12/02/2022:br5.11:svnIntel:pnX99:pvrDefaultstring:rvnIntel:rnX99H:rvrDefaultstring:cvnIntel:ct3:cvrDefaultstring:skuDefaultstring:
dmi.product.family: Default string
dmi.product.name: X99
dmi.product.sku: Default string
dmi.product.version: Default string
dmi.sys.vendor: Intel
version.compiz: compiz 1:0.9.14.2+22.10.20220822-0ubuntu12
version.libdrm2: libdrm2 2.4.125-1ubuntu0.1~24.04.2
version.libgl1-mesa-dri: libgl1-mesa-dri 25.2.8-0ubuntu0.24.04.2
version.libgl1-mesa-glx: libgl1-mesa-glx N/A
version.nvidia-graphics-drivers: nvidia-graphics-drivers-* N/A
version.xserver-xorg-core: xserver-xorg-core 2:21.1.12-1ubuntu1.6
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev N/A
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:22.0.0-1build1
version.xserver-xorg-video-intel: xserver-xorg-video-intel
2:2.99.917+git20210115-1build1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau
1:1.0.17-2ubuntu0.1
** Affects: unity (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug compiz-0.9 noble third-party-packages ubuntu
** Patch added: "Suggested fix: null check in ComputeShapedShadowQuad"
https://bugs.launchpad.net/bugs/2165662/+attachment/5996079/+files/0001-fix-null-deref-shaped-shadow.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165662
Title:
compiz crashes in ComputeShapedShadowQuad: null shaped_shadow_pixmap_
dereferenced
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/unity/+bug/2165662/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
