Public bug reported: # gnome-shell SIGSEGV in meta_context_get_backend() when an application maps windows in a headless gnome-remote-desktop "Remote Login" Wayland session
## Affects - **mutter (Ubuntu noble)** — 46.2-1ubuntu0.24.04.16 (libmutter-14) - Reported against: gnome-shell 46.0-0ubuntu6~24.04.14 (the crashing executable) ## Summary In a headless GNOME Wayland session created by the Ubuntu 24.04 "Remote Login" feature (system `gnome-remote-desktop` daemon), launching MusicBrainz Picard (a PyQt6 application) reliably crashes gnome-shell with SIGSEGV ~0.5 seconds after launch. The crash is inside libmutter's Wayland request dispatch path: a client request handler calls `meta_context_get_backend()` which dereferences a garbage/invalid context pointer. Because the whole graphical session dies, the RDP stream is torn down as well (the client receives `ERRINFO_LOGOFF_BY_USER`). Any unsaved work in the remote session is lost. Reproducible: **always** (5+ occurrences across two days on this machine, including a crash loop this morning when session restore relaunched apps). ## Steps to reproduce 1. Ubuntu 24.04.4, NVIDIA GPU (RTX 2060, driver 580.173.02), Settings → System → Remote Login enabled (system-level gnome-remote-desktop on :3389). 2. Connect from any RDP client and authenticate at the GDM greeter shown over RDP; a headless user Wayland session starts. 3. Launch MusicBrainz Picard from the dock/activities. 4. Within about half a second, gnome-shell segfaults; the entire session (and the RDP connection) terminates. Journal evidence of one occurrence (all timestamps the same second): ``` 17:07:03 systemd[...]: Started app-gnome-org.musicbrainz.Picard-427533.scope - Application launched by gnome-shell. 17:07:03 org.musicbrainz.Picard.desktop[427533]: qt.qpa.plugin: Could not find the Qt platform plugin "wayland" in "" 17:07:03 gnome-shell[426141]: GNOME Shell crashed with signal 11 17:07:05 systemd[...]: [email protected]: Main process exited, code=dumped, status=11/SEGV ``` Launching the same app explicitly with `QT_QPA_PLATFORM=xcb` crashes identically (Picard's Qt has no Wayland plugin installed here, so it always connects via XWayland either way — the fatal dispatch arrives through Xwayland's Wayland connection). Plain GTK applications appear unaffected; only the Qt6 app has triggered it so far. ## Environment | Component | Version | |----------------------|--------------------------------------| | Distro | Ubuntu 24.04.4 LTS (noble) | | Kernel | 6.8.0-138-generic | | gnome-shell | 46.0-0ubuntu6~24.04.14 | | mutter / libmutter-14| 46.2-1ubuntu0.24.04.16 | | gnome-remote-desktop | 46.3-0ubuntu1.2 | | xserver-xorg-core | 2:21.1.12-1ubuntu1.6 | | NVIDIA driver | 580.173.02 (+550 meta installed) | | GPU | NVIDIA GeForce RTX 2060 (TU106) | | Session type | headless Wayland via g-r-d "Remote Login", virtual monitor | Client side (for completeness): Remmina 1.4.43 / FreeRDP 3.30 on another Ubuntu 24.04 machine. ## Crash analysis gdb backtrace of the crashing thread from the apport core dump (`/var/crash/_usr_bin_gnome-shell.1000.crash`, ~60 MB core available): ``` #0 __pthread_kill_implementation (no_tid=0, signo=11) ./nptl/pthread_kill.c:44 #3 __GI_raise (sig=11) ../sysdeps/posix/raise.c:26 #4 ??? () gnome-shell binary (own crash handler re-raising) #5 <signal handler called> #6 meta_context_get_backend () libmutter-14.so.0 (+0xcc3db) #7 ??? static function libmutter-14.so.0 (+0x1b41e4) #8 ??? libffi.so.8 #10 ffi_call () #11 ??? libwayland-server.so.0 #13 wl_event_loop_dispatch () libwayland-server.so.0 ... #18 meta_context_run_main_loop () libmutter-14.so.0 ``` Disassembly at the fault: ``` 0x...cc3d0 <meta_context_get_backend>: endbr64 0x...cc3d4 <meta_context_get_backend+4>: movslq 0x17e64d(%rip),%rax => 0x...cc3db <meta_context_get_backend+11>: mov 0x30(%rax,%rdi,1),%rax ``` `si_addr = 0x3e80004af33` — the context object pointer is garbage by the time this Wayland request handler runs. The same signature was captured in three separate crashes (08:13, 16:36, 17:02 UTC-4 today). ## Additional observations - The headless user-session shell logs `Created surfaceless renderer without GPU` and `Failed to query EGL render node path`, while the GDM greeter shell does get the NVIDIA device (`Added device '/dev/dri/card1' (nvidia-drm)`). Possibly relevant context for why this only breaks under Remote Login. - The teardown cascade after the crash: gnome-session shuts down → GDM closes the PAM session → gnome-remote-desktop reports `ERRINFO_RPC_INITIATED_DISCONNECT` to the client. These are consequences, not causes. - Workaround that fully avoids the problem: serve the desktop with `xrdp` (Xorg backend) instead of gnome-remote-desktop's Wayland path; the crashing code path does not exist there. ## Attachments I can provide - `/var/crash/_usr_bin_gnome-shell.1000.crash` (apport file with core) - Full gdb backtraces (`bt`, registers, disassembly) of all three crashes - Complete journalctl excerpts for each incident window ## Error tracker correlation The same crash was also uploaded through the automatic reporting path: **OOPS ID `d26de773-a00a-11f1-9247-fa163e414971`** (errors.ubuntu.com, uploaded 2026-08-24 18:26 EDT from this machine). ** Affects: mutter (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to mutter in Ubuntu. https://bugs.launchpad.net/bugs/2164959 Title: gnome-shell SIGSEGV in meta_context_get_backend() when an app maps windows in a headless gnome-remote-desktop Remote Login session To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2164959/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
