Public bug reported:
Xorg crashes with SIGSEGV in FindGlyphRef(), taking down the whole X session.
Fixed
upstream, fix not present in the 21.1 branch that jammy ships.
[Impact]
xorg-server 21.1.4 (2:21.1.4-2ubuntu1.7~22.04.16) in jammy contains a glyph
accounting
bug in the RENDER extension. When a client registers two glyphs with the same
SHA1 in a
single glyphset, AddGlyph() reuses the first glyph's hash entry for the second,
and the
following FreeGlyph() then clears that shared entry and decrements
globalGlyphs[fdepth].tableEntries. The counter ends up one lower than the
number of
live glyphs.
Later, FreeGlyphSet() uses "tableEntries == 0" as its test for "no live glyphs
of this
depth remain" and frees the global hash table:
if (!globalGlyphs[glyphSet->fdepth].tableEntries) {
free(globalGlyphs[glyphSet->fdepth].table);
globalGlyphs[glyphSet->fdepth].table = 0;
globalGlyphs[glyphSet->fdepth].hashSet = 0;
}
Because of the off-by-one this happens while glyphs of that depth are still
alive. The
next FreeGlyph() for that depth reaches FindGlyphRef(), whose very first line
dereferences the now-NULL pointer without any check (render/glyph.c:127):
CARD32 tableSize = hash->hashSet->size;
The server aborts with "Segmentation fault at address 0x4" and the entire
desktop
session is lost — every open application dies with it. No user action can
trigger a
recovery; the session has to be restarted.
I hit this three times on an up-to-date jammy install: 2026-06-02, 2026-08-07
and
2026-08-13. The interval shrank from two months to six days.
[Fix]
Fixed upstream by commit 67e7343b588a, "Fix use-after-free caused by duplicate
glyphs
in one glyphset", merged 2026-07-30 via merge request !2264, closing upstream
issue
#1881:
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1881
https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2264
The commit is present in main, server-26.1-branch and xwayland-26.1, but has
not been
cherry-picked into server-21.1-branch, so no 21.1.x release carries it yet. I
have
asked upstream for the backport here:
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1914
The change is small and self-contained, touching only render/glyph.c, and comes
with an
upstream test.
[Test Plan]
The upstream merge request adds a regression test that reproduces the
accounting bug
directly. Manually: create two glyphsets of the same format depth, put two
glyphs with
identical content into the second one, free the glyphsets in an order that
leaves a
live glyph of that depth behind, then free that glyph. Before the fix the server
segfaults in FindGlyphRef(); after the fix it does not.
Organically the bug shows up as spontaneous session-wide X crashes every few
days under
a normal GNOME session.
[Where problems could occur]
The change is confined to glyph reference accounting in render/glyph.c. If it
were
wrong, the failure modes would be a leak of glyph objects (entries never
dropping to
zero, so the global hash is never released) or, in the opposite direction, a
glyph
freed while still referenced — which would surface as a crash in the same code
paths.
The RENDER glyph code has a history of security fixes (CVE-2024-31083 and its
follow-up), so it deserves careful review, which is also why taking the exact
upstream
commit rather than a local variant is preferable.
[Other Info]
Crash analysis from the core dump of the 2026-08-13 occurrence. No dbgsym
package is
available for this build any more (ddebs.ubuntu.com only keeps 21.1.22), so the
following comes from disassembly cross-checked against the 21.1.4 sources.
Faulting instructions, the prologue of FindGlyphRef():
mov 0x8(%rdi),%r10 ; r10 = hash->hashSet -> NULL
mov (%rdi),%r11 ; r11 = hash->table -> NULL
mov 0x4(%r10),%r8d ; <-- SIGSEGV, reads hashSet->size at 0x0+4
div %r8d ; signature % tableSize
Caller passes &globalGlyphs[2] (GlyphFormat8, i.e. a8) with match = TRUE,
matching
FreeGlyph() at render/glyph.c:267.
Global tables at the crash:
globalGlyphs[2] (a8) = { table = NULL, hashSet = NULL, tableEntries = 0
}
globalGlyphs[4] (argb32) = { table = 0x..82d26640, hashSet = 0x..75b2dd10,
tableEntries = 260 }
The glyph being freed is intact rather than dangling: refcnt = 0 (just
decremented),
well-formed SHA1 whose first four bytes equal the signature argument
(0xb66eb44b),
size = 0x4c, 8x10 px. So a live a8 glyph existed while globalGlyphs[2] had
already been
released — exactly the off-by-one described above.
This matches the upstream backtrace in issue #1881 exactly, down to
globalGlyphs+48
(= globalGlyphs[2]) and render/glyph.c:127, on completely different hardware
(that
reporter: Intel Arc B580 with the xe driver on Arch).
System: ThinkPad X1 Carbon Gen 10, Intel Alder Lake-P [8086:46a6], modesetting +
glamor + iris, GNOME 42 / mutter 42.9 on X11, gdm3, kernel 6.8.0-136-generic.
Xorg binary BuildID[sha1] ee65255b3af911ebff7b3b31c4a9ad01ad0cb0b3.
ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.16
ProcVersionSignature: Ubuntu 6.8.0-136.136~22.04.1-generic 6.8.12
Uname: Linux 6.8.0-136-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.10
Architecture: amd64
BootLog: Error: [Errno 13] Permission denied: '/var/log/boot.log'
CasperMD5CheckResult: pass
CompositorRunning: None
CurrentDesktop: ubuntu:GNOME
Date: Fri Aug 14 17:00:15 2026
DistUpgraded: Fresh install
DistroCodename: jammy
DistroVariant: ubuntu
DkmsStatus:
tp_smapi/0.44, 6.8.0-124-generic, x86_64: installed
tp_smapi/0.44, 6.8.0-136-generic, x86_64: installed
ExtraDebuggingInterest: Yes
GraphicsCard:
Intel Corporation Alder Lake-P Integrated Graphics Controller [8086:46a6] (rev
0c) (prog-if 00 [VGA controller])
Subsystem: Lenovo Device [17aa:22e7]
InstallationDate: Installed on 2023-02-11 (1279 days ago)
InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64
(20220809.1)
MachineType: LENOVO 21CB00BPGP
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-136-generic
root=UUID=57642b03-a769-45b9-bd13-7bd997f89116 ro quiet splash
resume=UUID=57642b03-a769-45b9-bd13-7bd997f89116 resume_offset=159875072
i915.enable_psr=0 i915.enable_dc=0 mem_sleep_default=deep vt.handoff=7
SourcePackage: xorg-server
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 02/17/2026
dmi.bios.release: 1.54
dmi.bios.vendor: LENOVO
dmi.bios.version: N3AET89W (1.54 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21CB00BPGP
dmi.board.vendor: LENOVO
dmi.board.version: SDK0T76538 WIN
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.26
dmi.modalias:
dmi:bvnLENOVO:bvrN3AET89W(1.54):bd02/17/2026:br1.54:efr1.26:svnLENOVO:pn21CB00BPGP:pvrThinkPadX1CarbonGen10:rvnLENOVO:rn21CB00BPGP:rvrSDK0T76538WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21CB_BU_Think_FM_ThinkPadX1CarbonGen10:
dmi.product.family: ThinkPad X1 Carbon Gen 10
dmi.product.name: 21CB00BPGP
dmi.product.sku: LENOVO_MT_21CB_BU_Think_FM_ThinkPad X1 Carbon Gen 10
dmi.product.version: ThinkPad X1 Carbon Gen 10
dmi.sys.vendor: LENOVO
version.compiz: compiz N/A
version.libdrm2: libdrm2 2.4.113-2~ubuntu0.22.04.1
version.libgl1-mesa-dri: libgl1-mesa-dri 23.2.1-1ubuntu3.1~22.04.4
version.libgl1-mesa-glx: libgl1-mesa-glx 23.0.4-0ubuntu1~22.04.1
version.xserver-xorg-core: xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.16
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev N/A
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:19.1.0-2ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel
2:2.99.917+git20210115-1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.17-2build1
** Affects: xorg-server
Importance: Unknown
Status: Unknown
** Affects: xorg-server (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug jammy ubuntu
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163497
Title:
Xorg crashes in FindGlyphRef(); upstream fix 67e7343b not backported
to 21.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/xorg-server/+bug/2163497/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
