Public bug reported:
gnome-shell 50.1 SIGSEGV in KMS thread during mode set on display wake
after privacy screen toggle (regression of bug 2085420)
gnome-shell crashes with SIGSEGV in mutter's KMS thread when the built-
in panel is re-enabled after idle blanking, if the hardware privacy
screen was toggled earlier in the session. The crash is in the atomic
mode-set path: meta_kms_mode_create_blob_id() calls
meta_kms_impl_device_get_fd() with an invalid MetaKmsImplDevice pointer.
This is the trigger condition of bug 2085420, closed via bug 2085423
with the fix landing upstream in mutter 49.rc (merge request
mutter!4742). The fix is present in 50.1, so this is a regression or a
new bug with the same trigger.
Environment:
- libmutter-18-0 50.1-0ubuntu2.2, gnome-shell 50.1-0ubuntu1.2, Ubuntu 26.04
- Wayland session, native backend, i915, atomic mode setting
- Linux 7.0.0-30-generic
- Lenovo ThinkPad T14 Gen 1 (20S00078MX), PrivacyGuard panel, DRM privacy
screen provider privacy_screen-thinkpad_acpi
Steps to reproduce:
1. Fresh boot, Wayland session. Blank the screen on idle and wake it —
survives, repeatedly (verified with several cycles at a 60 s blank delay).
2. Toggle the privacy screen with Fn+D: on, then off (sw_state and hw_state
back to Disabled).
3. Let the screen blank, wake with any input.
gnome-shell segfaults during the wake mode set and the session is lost.
Reproduced 4 times over two days, the last with exactly this protocol.
No suspend/resume involved, no monitor hotplug.
Backtrace from the apport core dump, retraced with libmutter-18-0-dbgsym
50.1-0ubuntu2.2. Crashing thread is the KMS thread processing
META_KMS_UPDATE_FLAG_MODE_SET:
#6 meta_kms_impl_get_kms (impl=<error reading variable: Cannot access memory
at address 0x638bea15a607>) at ../src/backends/native/meta-kms-impl.c:52
#7 meta_kms_impl_device_get_fd (impl_device=0x638bea15a6af) at
../src/backends/native/meta-kms-impl-device.c:1235
#8 meta_kms_mode_create_blob_id (mode=0x7dc4c401fc50, error=0x7dc4d91fe118) at
../src/backends/native/meta-kms-mode.c:51
#9 process_mode_set (...) at
../src/backends/native/meta-kms-impl-device-atomic.c:409
#10 process_entries (...) at
../src/backends/native/meta-kms-impl-device-atomic.c:978
#11 meta_kms_impl_device_atomic_process_update (impl_device=0x7dc4c40052c0,
...) at ../src/backends/native/meta-kms-impl-device-atomic.c:1204
#12 do_process (impl_device=0x7dc4c40052c0, ...,
flags=META_KMS_UPDATE_FLAG_MODE_SET) at
../src/backends/native/meta-kms-impl-device.c:1649
#13 process_mode_set_update (...) at
../src/backends/native/meta-kms-impl-device.c:2330
#14 meta_kms_impl_device_process_update (...) at
../src/backends/native/meta-kms-impl-device.c:2370
#15 process_sync_update_in_impl (...) at
../src/backends/native/meta-kms-device.c:304
#16 meta_thread_impl_dispatch (...) at
../src/backends/native/meta-thread-impl.c:543
#17 impl_source_dispatch (...) at ../src/backends/native/meta-thread-impl.c:177
The impl_device argument in frame #7 (0x638bea15a6af) is unreadable and
misaligned, while the impl_device in frames #10-#14 (0x7dc4c40052c0) is
valid — the MetaKmsMode in frame #8 appears to hold a dangling pointer
to a freed or stale MetaKmsImplDevice.
Journal at crash:
Aug 31 08:29:23 gnome-shell[24522]: Launching DING process
Aug 31 08:29:23 gnome-shell[24522]: GNOME Shell crashed with signal 11
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to mutter in Ubuntu.
https://bugs.launchpad.net/bugs/2165888
Title:
gnome-shell 50.1 SIGSEGV in KMS thread during mode set on display wake
after privacy screen toggle (regression of bug 2085420)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2165888/+subscriptions
--
desktop-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
