SIGSEGV in gnome-xkb-info.c free_layout() during parse_error - corrupted pointer (mem=0x6)

[fernandoromay]

Crash Report

Process: cinnamon (PID 2327)
Signal: SIGSEGV (Segmentation fault)
Date: Wed 2026-06-24 21:14:18 CST

Summary

Cinnamon crashes on startup when the XKB runtime layout state does not match the configured layout in /etc/default/keyboard. Specifically, free_layout() in gnome-xkb-info.c:99 is called with a corrupted pointer (mem=0x6) during the parse_error callback at gnome-xkb-info.c:540.

Stack Trace (Thread 2327)

#0  __GI___libc_free (mem=0x6) at ./malloc/malloc.c:3375
#1  free_layout (data=0x5870c08c7aa0) at gnome-xkb-info.c:99
#2  parse_error (context=<optimized out>, error=<optimized out>, data=<optimized out>) at gnome-xkb-info.c:540
#3  ?? () from libglib-2.0.so.0
#4  ?? () from libglib-2.0.so.0
#5  ?? () from libglib-2.0.so.0
#6  g_markup_parse_context_parse () from libglib-2.0.so.0
#7  parse_rules_file (self=0x5870c0751020, path="/usr/share/X11/xkb/rules/evdev.xml", error=0x7fff3d683970) at gnome-xkb-info.c:572
#8  parse_rules (self=0x5870c0751020) at gnome-xkb-info.c:608
#9  ensure_rules_are_parsed (self=0x5870c0751020) at gnome-xkb-info.c:640
#10 gnome_xkb_info_get_layout_info (self=0x5870c0751020, id="latam") at gnome-xkb-info.c:945

Environment

• OS: Ubuntu 24.04
• cinnamon-desktop version: libcinnamon-desktop.so.4 (from libzstd-1.5.5+dfsg2-2build1.1.amd64)
• Keyboard config (/etc/default/keyboard): XKBLAYOUT="es", XKBVARIANT="rapid"
• Running XKB state (setxkbmap -query): layout: us,latam, variant: , (empty)
• Mismatch: Config says es/rapid, but runtime had us,latam

Reproduction

1. Have /etc/default/keyboard set to es/rapid (Spanish Rapid)
2. Have the running XKB state show us,latam (e.g. from a session restore or another input source manager)
3. Start cinnamon - it calls gnome_xkb_info_get_layout_info("latam"), hits a parse error, and parse_error() calls free_layout() on a partially-initialized layout struct with a corrupted pointer (0x6)

Root Cause Analysis

The parse_error callback at gnome-xkb-info.c:540 calls free_layout() to clean up. However, the layout struct being freed contains a pointer with value 0x6 instead of a valid address. This appears to be either:

1. A use-after-free where the layout struct was already partially cleaned up
2. An uninitialized field in the layout struct that gets freed during error handling
3. Memory corruption from the mismatch between the configured and running XKB layouts

Workaround

Setting the XKB layout to match the configured layout before starting cinnamon prevents the crash:

setxkbmap -layout es -variant rapid -model pc105
gsettings set org.cinnamon.desktop.input-sources sources "[('xkb', 'es+rapid')]"

Additional Info

Core dump available at: /var/lib/systemd/coredump/core.cinnamon.1000.ef081baf1d754cae9959f28b6029e8a6.2327.1782357258000000.zst

This issue also affects layouts defined in evdev.xml (the rapid variant under es, and latam). The crash occurs when the parser encounters an error and the cleanup path tries to free a corrupted pointer.

[mtwebster]

Hi I feel you may not be telling the whole story here - did you edit evdev.xml or redirect to a different, possibly corrupt version?

[fernandoromay]

Sorry, forgot to mention that. Yes, I put an orphan variant tag in evdev.xml, which triggered a crash. After fixing that, the layout mismatch arised.