Public bug reported:
Xwayland reliably crashes with SIGSEGV inside damage_report() at
hw/xwayland/xwayland-window.c:321, usually within 60-90 seconds of the
Wayland session starting. Reproduced via two independent, unrelated call
paths that both terminate in the exact same frame, which points at a bug
inside damage_report() itself rather than in either calling client.
Environment:
- Ubuntu 26.04 (resolute)
- Xwayland 2:24.1.10-1
- GNOME Shell / Mutter 50.1, Wayland session
--- Backtrace 1: via X Double Buffer Extension (DBE) swap ---
Triggering client: conky, using own_window with double_buffer = true
(calls XdbeSwapBuffers).
#11 damage_report (pDamage=..., pRegion=..., data=<optimized out>)
at ../hw/xwayland/xwayland-window.c:321
#12 damageRegionAppend (...) at ../miext/damage/damage.c:267
#13 damageDamageBox (...) at ../miext/damage/damage.c:323
#14 damageCopyArea (...) at ../miext/damage/damage.c:773
#15 miDbeSwapBuffers (...) at ../dbe/midbe.c:296
#16 ProcDbeSwapBuffers (...) at ../dbe/dbe.c:532
#17 Dispatch () at ../dix/dispatch.c:550
#18 dix_main (...) at ../dix/main.c:277
#19 main (...) at ../dix/stubmain.c:34
--- Backtrace 2: via window move / ConfigureWindow ---
Triggering event: window manager repositioning a rootless X11 window at
session startup.
#11 damage_report (pDamage=..., pRegion=..., data=<optimized out>)
at ../hw/xwayland/xwayland-window.c:321
#12 damageRegionAppend (...) at ../miext/damage/damage.c:267
#13 damageCopyWindow (...) at ../miext/damage/damage.c:1526
#14 miMoveWindow (...) at ../mi/miwindow.c:293
#15 xwl_move_window (...) at ../hw/xwayland/xwayland-window.c:1949
#16 compMoveWindow (...) at ../composite/compwindow.c:399
#17 ConfigureWindow (...) at ../dix/window.c:2407
#18 ProcConfigureWindow (...) at ../dix/dispatch.c:984
#19 Dispatch () at ../dix/dispatch.c:550
#20 dix_main (...) at ../dix/main.c:277
#21 main (...) at ../dix/stubmain.c:34
Both backtraces were captured with apport-unpack + gdb against a locally
installed xwayland-dbgsym package.
This appears to already be fixed upstream: Xwayland 24.1.11 (April 2026)
includes "xwayland: Avoid NULL pointer dereference in damage_report()" by
Olivier Fourdan, listed in the release notes as "Fix a crash in window
damage handling caused a NULL pointer dereference." This matches this
crash site exactly.
Ubuntu's stonking (26.10) already carries 24.1.13, but resolute (26.04 LTS)
is still on 24.1.10. Requesting this fix be pulled into resolute via SRU.
Ruled out during
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: xwayland 2:24.1.10-1
ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
Uname: Linux 7.0.0-31-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sun Sep 6 23:48:11 2026
InstallationDate: Installed on 2025-10-14 (327 days ago)
InstallationMedia: Ubuntu 24.04.3 LTS "Noble Numbat" - Release amd64
(20250805.1)
ProcEnviron:
LANG=ja_JP.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: xwayland
UpgradeStatus: Upgraded to resolute on 2026-08-27 (10 days ago)
** Affects: xwayland (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166607
Title:
Xwayland crashes with NULL pointer dereference in damage_report() -
fixed upstream in 24.1.11
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/xwayland/+bug/2166607/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
