I can reproduce a very similar crash on a **Goodix 27c6:530c**
fingerprint reader in a **Dell G3 3500**, running **Ubuntu 26.04.1
LTS**.
This may extend the affected hardware beyond the 27c6:533c reported
here, although I cannot confirm that the underlying cause is identical.
**Installed packages**
- fprintd: `1.94.5-4`
- libfprint-2-2: `1:1.95.1+tod1-0ubuntu2`
- libfprint-2-tod1: `1:1.95.1+tod1-0ubuntu2`
- libfprint-2-tod1-goodix: `0.0.6-0ubuntu1~somerville1`
- Driver module: `libfprint-tod-goodix-53xc-0.0.6.so`
**Reproduction**
I logged out and logged back in using fingerprint authentication twice.
Authentication succeeded, but fprintd subsequently crashed and Ubuntu
displayed a crash-report notification.
The following sequence was recorded on 8 October 2026 (UTC−03:00):
```text
00:08:04 fprintd[36908]: Creating TOD wrapper for goodix-tod (Goodix
Fingerprint Sensor 53xc) driver
00:08:05 fprintd[36908]: Authorization denied to :1.297 to call method 'Claim'
for device 'Goodix Fingerprint Sensor 53xc': Device was already claimed
00:08:15 fprintd[36908]: double free or corruption (out)
00:08:16 systemd[1]: fprintd.service: Main process exited, code=dumped,
status=6/ABRT
00:08:16 systemd[1]: fprintd.service: Failed with result 'core-dump'.
```
**Backtrace findings**
The attached backtrace is from this crash, PID **36908**.
The main thread was inside `fp_device_close_sync()`, with multiple
intervening frames in the proprietary Goodix module leading to
`usleep()`.
Another thread was inside `libusb_bulk_transfer()`, called from the same
Goodix module.
The aborting thread detected memory corruption during thread cleanup:
```text
malloc_printerr("double free or corruption (out)")
_int_free_merge_chunk()
_int_free_chunk()
tcache_thread_shutdown()
__malloc_arena_thread_freeres()
__libc_thread_freeres()
start_thread()
```
This closely resembles the closing-device scenario described in the
original report. The backtrace identifies where corruption was detected,
but does not establish which component originally corrupted the memory.
**Comparison with an older compatibility stack**
I previously tested an isolated compatibility configuration that made
only fprintd load libfprint/TOD `1.94.9+tod1-1ubuntu0.3` from `/opt`,
while retaining the same Goodix 0.0.6 module.
That configuration also crashed with the same general backtrace pattern.
Before reproducing the attached crash, I completely removed the
compatibility directory and its systemd `LD_LIBRARY_PATH` override, then
restarted fprintd. The new core confirms that both libraries were loaded
from the normal system paths:
```text
/usr/lib/x86_64-linux-gnu/libfprint-2.so.2
/usr/lib/x86_64-linux-gnu/libfprint-2-tod.so.1
```
Therefore, the custom compatibility configuration is not required to
reproduce this failure.
**Expected behavior**
Completing or cancelling fingerprint authentication, releasing the
reader, or handling a competing device claim should not crash fprintd.
**Questions for maintainers**
- Does this appear to be the same issue as the original report?
- Is there a corrected 53xc driver supporting USB ID **27c6:530c**?
- Could this be investigated with the Goodix driver maintainers, particularly
the device-close and worker-thread cleanup paths?
I can provide additional targeted diagnostics if needed. The attached
file contains the shared-library listing and backtraces for all threads;
it does not include the raw core dump.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167761
Title:
Goodix TOD 0.0.6 repeatedly corrupts memory and crashes fprintd on
27c6:533c
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libfprint/+bug/2167761/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
