Skip to content

fix: NULL deref in meta_x11_display_logical_monitor_to_xinerama_index#815

Closed
appositeit wants to merge 1 commit intolinuxmint:masterfrom
appositeit:fix/xinerama-null-deref
Closed

fix: NULL deref in meta_x11_display_logical_monitor_to_xinerama_index#815
appositeit wants to merge 1 commit intolinuxmint:masterfrom
appositeit:fix/xinerama-null-deref

Conversation

@appositeit
Copy link
Copy Markdown

Summary

Adds a NULL check for logical_monitor_data in meta_x11_display_logical_monitor_to_xinerama_index() to prevent a segfault that crashes Cinnamon on NVIDIA multi-monitor setups.

Root Cause

meta_x11_display_ensure_xinerama_indices() only attaches xinerama qdata to logical monitors whose geometry exactly matches a Xinerama screen entry (comparing rect.x/y/width/height). With NVIDIA drivers and multiple monitors, after sleep/wake or monitor power cycles, the Xinerama geometry can become stale or mismatched. When a logical monitor has no matching Xinerama entry, get_x11_display_logical_monitor_data() returns NULL and the subsequent dereference logical_monitor_data->xinerama_index segfaults.

The sibling function meta_x11_display_xinerama_index_to_logical_monitor already handles the NULL case correctly.

Crash Signature

cinnamon[PID]: segfault at 0 ip <addr> in libmuffin.so.0.0.0[...]
  • Signal 11 (SIGSEGV), NULL pointer dereference at meta_display_logical_index_to_xinerama_index+94
  • rax=0x0 (NULL from g_object_get_qdata)
  • Call chain: JS → libcjs → libffi → meta_display_logical_index_to_xinerama_indexmeta_x11_display_logical_monitor_to_xinerama_index

Environment

  • NVIDIA RTX 3080, dual 3440x1440 monitors on DisplayPort
  • Ubuntu 25.10, Cinnamon 6.4.12, muffin 6.4.1
  • Reproducible: crash occurs within seconds of cinnamon --replace after X session corruption from prior crash

Testing

  • Built patched libmuffin.so.0.0.0 from source (meson release build)
  • Replaced system library and verified Cinnamon runs stable (28s+ with no crash, vs immediate crash without fix)
  • Disassembly confirms NULL check generates test %rax,%rax; jereturn -1 path

Fixes #671

🤖 Generated with Claude Code

Add a NULL check for logical_monitor_data before dereferencing it.

When Xinerama screen geometry doesn't exactly match any logical
monitor's rect (common with NVIDIA multi-monitor setups after
sleep/wake or monitor power cycles), ensure_xinerama_indices()
never attaches qdata to that monitor. The subsequent call to
get_x11_display_logical_monitor_data() then returns NULL, and
dereferencing it causes a segfault at offset +94 in
meta_display_logical_index_to_xinerama_index.

This crash is reproducible on NVIDIA GPUs with 2+ monitors and
triggers when monitors power off/on or wake from sleep. It causes
Cinnamon to enter fallback mode and often requires a GDM restart
to recover.

The sibling function meta_x11_display_xinerama_index_to_logical_monitor
already handles the NULL case correctly (returns NULL when no match).

Fixes: linuxmint#671

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@appositeit
Copy link
Copy Markdown
Author

Closing in favour of adding this fix to #805, which already addresses related NULL dereference paths. Credit to @gurvesh who independently identified this same issue in #805's comments.

@appositeit appositeit closed this Mar 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

muffin.so crashes in nvidia/cinnamon on monitor powerups from sleep

1 participant