Public bug reported:
gnome-shell crashed (SIGSEGV) on X11 at the moment Google Chrome was
launched from the dock.
Faulting code (libmutter-14.so.0 +0x9a3ee) matches
meta_window_get_unit_cgroup():
p = strstr(cgroup_path, unit_name); // returns NULL
p[strlen(unit_name)] = '\0'; // write to NULL+35 -> SIGSEGV
window->cgroup_path = g_file_new_for_path(cgroup_path);
Strings recovered from the core dump:
- cgroup path:
/sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/app.slice/app-gnome-google\x2dchrome-1575798.scope
- unit name: app-com.google.Chrome-1575798.scope
gnome-shell launched Chrome in app-gnome-google\x2dchrome-<pid>.scope.
Chrome then moves itself into its own app-com.google.Chrome-<pid>.scope.
mutter read the unit name and the cgroup path at different moments, the
two don't match, and the result of strstr() is dereferenced without a
NULL check. This is a race in the window-focus path:
meta_window_focus -> meta_display_set_input_focus -> ... ->
meta_window_get_unit_cgroup
Stack trace (apport, unsymbolized frames in libmutter):
#6 libmutter-14.so.0+0x9a3ee <- crash (strstr result NULL)
#7 libmutter-14.so.0+0x700e9
#8 meta_display_set_input_focus
#9 libmutter-14.so.0+0xd6231
#10 meta_window_focus
#11 libmutter-14.so.0+0x987c3
#12 g_list_foreach
#13 libmutter-14.so.0+0x79018
#14 meta_window_focus
...
#21 meta_context_run_main_loop
Suggested fix: check strstr() for NULL and return NULL (or treat the
cgroup as unknown) instead of crashing.
Versions: Ubuntu 24.04, gnome-shell 46.0-0ubuntu6~24.04.15,
mutter/libmutter-14-0 46.2-1ubuntu0.24.04.16, X11 session, kernel
7.0.0-38. The pending mutter updates (.17 and .18) don't touch this
code.
The original crash was also submitted to errors.ubuntu.com by whoopsie
on 2026-10-22.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: mutter 46.2-1ubuntu0.24.04.16
ProcVersionSignature: Ubuntu 7.0.0-38.38~24.04.4-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Thu Oct 22 15:35:57 2026
InstallationDate: Installed on 2025-08-17 (431 days ago)
InstallationMedia: Ubuntu 24.04.3 LTS "Noble Numbat" - Release amd64
(20250805.1)
SourcePackage: mutter
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble third-party-packages
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171973
Title:
gnome-shell SIGSEGV in meta_window_get_unit_cgroup(): strstr() returns
NULL when app moves to its own systemd scope (Chrome)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2171973/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
