This also affects me, and I can reproduce it reliably. Hardware: Lenovo ThinkPad X1 Carbon Gen 12 (21KC), Intel Core Ultra 7 155H, Intel Arc Graphics (Meteor Lake-P, i915, atomic modesetting), 1920x1200 eDP panel with PrivacyGuard. No external monitor. Software: Ubuntu 26.04, kernel 7.0.0-30-generic, libmutter-18-0 50.1-0ubuntu2.2, gnome-shell 50.1-0ubuntu1.2, Wayland.
The same crash occurred 5 times on this machine since 2025-11 (the first time with libmutter-17). All occurrences are the same kernel line: "KMS thread[...]: segfault ... in libmutter-18.so.0.0.0[1bed58,...]". Reliable reproducer (crashed on the first try): 1. Press Fn+D (privacy screen on), then Fn+D again (off). 2. Within about 10 s, lock with Super+L. The panel blanks about 8 s later. 3. Wait a couple of minutes, then move the mouse. gnome-shell segfaults and you are sent back to GDM. With idle blanking about 70 s after the toggle, instead of Super+L, it did not crash in my single attempt. Retraced backtrace (with libmutter-18-0-dbgsym 50.1-0ubuntu2.2 from ddebs, because debuginfod.ubuntu.com returns 404 for these build-ids): #0 meta_kms_impl_get_kms (meta-kms-impl.c:52) #1 meta_kms_impl_device_get_fd (meta-kms-impl-device.c:1235) #2 meta_kms_mode_create_blob_id (meta-kms-mode.c:51) #3 process_mode_set (meta-kms-impl-device-atomic.c:409) #5 meta_kms_impl_device_atomic_process_update (meta-kms-impl-device-atomic.c:1204) #6 do_process (flags=META_KMS_UPDATE_FLAG_MODE_SET) (meta-kms-impl-device.c:1649) #9 process_sync_update_in_impl (meta-kms-device.c:304) The main thread is in meta_kms_device_process_update_sync <- meta_renderer_native_post_mode_set_updates <- maybe_post_next_frame. Additional findings from two core dumps (the reproduced crash and an earlier one): - The whole MetaKmsMode is freed, not only its impl_device pointer: flags, clock and name are all garbage. - The mode set is for eDP-1 on an inactive CRTC, which means the panel is being re-enabled. - Two MetaCrtcModeKms objects (1920x1200, FIXED and VARIABLE refresh rate) still point to the freed mode. The connector's current state holds a new 1920x1200 MetaKmsMode that no MetaCrtcModeKms references. - So the eDP-1 connector state was replaced (and its old modes freed) without the monitor manager reloading its CRTC modes. The wake mode set then used a stale CRTC mode. I reported this upstream with the full analysis: https://gitlab.gnome.org/GNOME/mutter/-/work_items/5059 Workaround until fixed: after using Fn+D, log out and back in before locking or letting the screen blank. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165888 Title: gnome-shell 50.1 SIGSEGV in KMS thread during mode set on display wake after privacy screen toggle (regression of bug 2085420) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2165888/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
