Independent confirmation on Ubuntu 26.04 LTS after upgrading from 24.04:
xwayland 2:24.1.10-1, GNOME Shell / mutter 50.1 (Wayland session, GDM),
Intel UHD Graphics 620 (i915).
Symbolised against the matching xwayland-dbgsym (build-id
0d748fbe3aab20c19c4af7bf3fe577972db83324), it is the crash in this report:
"Segmentation fault at address 0x40" in damage_report()
(hw/xwayland/xwayland-window.c). I hit two of the three paths listed here:
1. DBE swap:
damage_report <- damageRegionAppend <- damageCopyArea
<- miDbeSwapBuffers <- ProcDbeSwapBuffers <- Dispatch
2. Window move (ConfigureWindow):
damage_report <- damageRegionAppend <- damageCopyWindow
<- miMoveWindow <- xwl_move_window <- compMoveWindow
<- ConfigureWindow <- ProcConfigureWindow <- Dispatch
Trigger: conky runs from autostart and is the first X11 client of the
session, so its connection is what starts Xwayland on demand. Results from
headless runs (gnome-shell --headless --virtual-monitor):
conky first, double_buffer = true ........... crashed 5 of 7
conky first, double_buffer = false .......... crashed 8 of 8
xeyes first ................................. crashed 0 of 3
conky started after Xwayland is running ..... crashed 0 of 5
conky started once _NET_SUPPORTING_WM_CHECK
is set on the root window ................. crashed 0 of 11
So turning off double buffering is not a workaround: it only moves the
crash from path 1 to path 2. Fractional scaling is not needed either; it
crashes at scale 1.0.
Impact on a real login: after the crash gnome-shell logged "Connection to
xwayland lost", at-spi2-registryd flagged it as an unresponsive app 34 s
later, and the session never fell back to GDM. It was still frozen 8
minutes later and I had to restart the machine. So for anyone with conky
in autostart, the upgrade to 26.04 can lock them out of the desktop.
The fix is upstream commit d346a6dec0c98ef3aba4e4c776c19aabc4621740 on the
xwayland-24.1 branch, "xwayland: Avoid NULL pointer dereference in
damage_report()" (cherry-pick of 36f53145e415, MR !2191, closes
xorg/xserver#1886). It is in xwayland-24.1.11 and changes 12 lines in
hw/xwayland/xwayland-window.c, so it should be an easy SRU. Today resolute
still only has 2:24.1.10-1, with nothing in -updates or -proposed. +1 for
the SRU.
Attached: xwayland-dbe-repro.sh, a headless reproducer. It starts a
throwaway gnome-shell --headless on a private D-Bus session and runs a
minimal conky as the first X11 client, so the running desktop is not
affected. Exit status 1 means it reproduced. Here it reproduces on the
first attempt.
Workaround until the SRU lands: start conky from a small wrapper that
polls "xprop -root _NET_SUPPORTING_WM_CHECK" until it returns a window id,
then execs conky. My login works again with that in place.
** Attachment added: "Attachment is to show that the crash is happening."
https://bugs.launchpad.net/ubuntu/+source/xwayland/+bug/2166607/+attachment/6013728/+files/xwayland-dbe-repro.sh
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166607
Title:
Xwayland crashes with NULL pointer dereference in damage_report() -
fixed upstream in 24.1.11
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/xwayland/+bug/2166607/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
