Public bug reported:
Ptyxis segfaulted with no user interaction beyond a new tab opening,
taking down every window and tab in the process. Ptyxis runs as a single
--gapplication-service process for the whole application, so one crash
ends every terminal session on the desktop - in my case three long-
running jobs.
The fault is not in ptyxis. It is a NULL dereference inside
libpangocairo, reached through VTE's normal text-render path.
lsb_release -rd:
Description: Ubuntu 26.04 LTS
Release: 26.04
Package versions:
ptyxis 50.1-1ubuntu2
libpangocairo-1.0-0 1.57.0-1
libpango-1.0-0 1.57.0-1
libvte-2.91-gtk4-0 0.84.0-2
libgtk-4-1 4.22.4+ds-0ubuntu0.1
libcairo2 1.18.4-3
libglib2.0-0t64 2.88.0-1
kernel 7.0.0-29-generic
What I expected: opening a new tab does not affect other tabs.
What happened instead: the whole application segfaulted.
This machine was upgraded questing -> resolute on 2026-08-12, which
moved pango 1.56.3 -> 1.57.0 and vte 0.80.3 -> 0.84.0. The crash
happened about 27 hours later. I had not seen it on the previous stack.
--- Kernel log ---
ptyxis[5129]: segfault at 60 ip 00007e010f4855dc sp 00007ffd57e84370
error 4 in libpangocairo-1.0.so.0.5700.0[85dc,7e010f482000+8000] likely
on CPU 11
--- Backtrace (crashing thread, from the apport core) ---
#0 0x00007e010f4855dc in ?? () from
/usr/lib/x86_64-linux-gnu/libpangocairo-1.0.so.0
#1 0x00007e010f486a78 in ?? () from
/usr/lib/x86_64-linux-gnu/libpangocairo-1.0.so.0
#2 0x00007e01103b5bf0 in pango_glyph_string_extents_range () from
libpango-1.0.so.0
#3 0x00007e0110a00df8 in ?? () from libgtk-4.so.1
#4 0x00007e0110a01085 in gsk_text_node_new () from libgtk-4.so.1
#5 0x00007e010f7c6445 in ?? () from libvte-2.91-gtk4.so.0
#6 0x00007e010f7c669c in ?? () from libvte-2.91-gtk4.so.0
#7 0x00007e010f78768f in ?? () from libvte-2.91-gtk4.so.0
#8 0x00007e010f78d39f in ?? () from libvte-2.91-gtk4.so.0
#9 0x00007e010f790258 in ?? () from libvte-2.91-gtk4.so.0
... gtk_widget_snapshot_child() recursion up to the toplevel ...
--- Analysis ---
The fault offset is 0x85dc, inside the static function starting at
0x85a0 in libpangocairo, i.e.
_pango_cairo_font_private_get_scaled_font(). Disassembly around the
faulting instruction:
mov (%rbx),%edi
call *0x10(%rax) ; iface->create_font_face(cf_priv->cfont)
mov %rax,%r12
test %rax,%rax
je ... ; a NULL font_face IS handled
mov 0x8(%rbx),%rsi ; rsi = cf_priv->data -> 0x0
mov %rax,%rdi
=>mov 0x60(%rsi),%rcx ; data->options -> SEGV at 0x60
lea 0x30(%rsi),%rdx ; &data->ctm
call cairo_scaled_font_create
Registers at fault: rsi = 0x0, rdx = 0x0, fault address 0x60.
The offsets 0x00 / 0x30 / 0x60 line up exactly with
PangoCairoFontPrivateScaledFontData { cairo_matrix_t font_matrix;
cairo_matrix_t ctm; cairo_font_options_t *options; }.
So the function checks cf_priv->data for NULL on entry, calls out to
create_font_face(), and then dereferences cf_priv->data a second time
without re-checking. Between the two reads, data became NULL - i.e.
_pango_cairo_font_private_scaled_font_data_destroy() ran, either re-
entrantly from inside create_font_face() (fontconfig -> font-map
invalidation) or from another thread. The process had 22 threads at the
time.
Note that the NULL return from create_font_face() is handled; the
invalidated cf_priv->data is not.
--- Trigger ---
The journal shows a new terminal being spawned in the same second as the
crash:
23:48:03 systemd[2288]: Started ptyxis-spawn-bdf8709f-...scope -
[systemd-run] /usr/bin/bash
23:48:03 kernel: ptyxis[5129]: segfault at 60 ...
So a new tab was being set up (new font objects) while an existing tab
was rendering, which fits the race above. Not reproducible on demand.
--- Related upstream ---
I could not find this signature on gitlab.gnome.org/GNOME/pango. The
nearest open issue is #571 ("Segfault / threading inconsistencies around
PangoFcFontMap"), which is the same family - font-map state changing
under a live consumer - but a different failure mode (assertion in
pango_fc_patterns_unref, not a NULL cf_priv->data).
--- On the core dump ---
This was filed by hand rather than through apport, because the Ubuntu
Launchpad crash database only accepts problem_types ['Bug', 'Package']
and rejects ProblemType: Crash. whoopsie has already auto-submitted the
crash signature to errors.ubuntu.com.
I am deliberately not attaching the 10 MB apport .crash / 322 MB core:
it is a core dump of a terminal emulator, so it contains scrollback,
which in my case includes work material. I am happy to run gdb commands
against it on request, or to send it privately to a maintainer. The file
is retained locally.
** Affects: pango1.0 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163467
Title:
SIGSEGV in _pango_cairo_font_private_get_scaled_font(): cf_priv->data
dereferenced after create_font_face() invalidates it
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pango1.0/+bug/2163467/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
