** Description changed: + NOTE: AI generated text below + ---- `gnome-shell` reliably segfaults in `meta_output_kms_read_edid()` shortly after resuming from suspend (S3), killing the entire Wayland session. It has happened twice, both times at the **same code offset** (`libmutter-14.so.0 + 0x17d816`), so it is not a random memory error. The crash is reached from an **external D-Bus call** to `org.gnome.Mutter.DisplayConfig.GetResources`, served while the KMS outputs are still being re-probed after resume. ### Versions ``` mutter / libmutter-14-0 46.2-1ubuntu0.24.04.16 gnome-shell 46.0-0ubuntu6~24.04.14 kernel 7.0.0-31-generic (HWE) Ubuntu 24.04.4 LTS (noble) session Wayland ``` ### Hardware ``` GPU 0 Intel TigerLake-H GT1 [UHD Graphics] [8086:9a60] ← drives all outputs GPU 1 NVIDIA TU117GLM [T600 Mobile] [10de:1fba] ← PRIME offload only driver nvidia 580.173.02 outputs eDP-1 (internal panel) + DP-1 (external monitor via Thunderbolt 4 dock) ``` Laptop with a Thunderbolt 4 controller at PCI `00:0d.0` hosting the dock. ### Steps to reproduce 1. Suspend the laptop (`systemctl suspend` or `suspend-then-hibernate`), with an - external monitor attached through a Thunderbolt dock — or attached while the - machine is resuming. + external monitor attached through a Thunderbolt dock — or attached while the + machine is resuming. 2. Resume. 3. `gnome-shell` segfaults ~160 ms after userspace is unfrozen. The session is - terminated and the user is dropped back to GDM with a brand-new session; all - running applications are lost. + terminated and the user is dropped back to GDM with a brand-new session; all + running applications are lost. Not every resume crashes: a 14-second suspend did not, a 4-minute one and a 15-hour one did. The common factor appears to be how completely the USB/TB controller powers down, and therefore how much device re-enumeration happens on resume. ### Symbolised backtrace Resolved with `addr2line` against `libmutter-14-0-dbgsym 46.2-1ubuntu0.24.04.16` (the trace recorded in the journal only had offsets; symbols were installed afterwards, so `coredumpctl info` still shows the unsymbolised version). ``` #0 meta_output_kms_read_edid (libmutter-14.so.0 + 0x17d816) #1 meta_monitor_manager_handle_get_resources (libmutter-14.so.0 + 0x9cc4a) #2 _g_dbus_codegen_marshal_BOOLEAN__OBJECT meta-dbus-display-config.c:241 #3 g_closure_invoke #4 g_signal_emitv #5 _meta_dbus_display_config_skeleton_handle_method_call meta-dbus-display-config.c:3506 #6 (libgio-2.0.so.0 + 0x129df3) #7 (libgio-2.0.so.0 + 0x10dc08) #8 g_main_loop_run #9 meta_context_run_main_loop (libmutter-14.so.0 + 0xd50aa) ``` ### Faulting instruction The kernel logged the code bytes around the fault: ``` Code: ... 48 8b 7f 18 e8 aa ff ff ff <48 8b 58 40> 48 85 db 74 21 ... - mov rdi,[rdi+0x18] call … mov rbx,[rax+0x40] test rbx,rbx + mov rdi,[rdi+0x18] call … mov rbx,[rax+0x40] test rbx,rbx ``` A call returns **NULL in `rax`** and the return value is dereferenced at `+0x40` without being checked — hence `segfault at 40`. Note that the very next instruction (`test rbx,rbx`) *does* check the loaded value for NULL. So a NULL check exists, but it is on the field that was read rather than on the pointer that was returned. Kernel message: ``` gnome-shell[…]: segfault at 40 ip …15f7d816 sp …0bbe9e00 error 4 - in libmutter-14.so.0.0.0[17d816,…+167000] + in libmutter-14.so.0.0.0[17d816,…+167000] ``` ### Timeline (kernel monotonic clock) ``` [29860.346] xhci_hcd 0000:00:0d.0: xHC error in resume, USBSTS 0x411, Reinit [29860.346] usb usb1/usb2: root hub lost power or was reset [29861.006] Restarting tasks: Starting [29861.006] usb 3-3: USB disconnect, device number 19 [29861.013] Restarting tasks: Done ← userspace unfrozen [29861.120] usb 3-3: new full-speed USB device number 20 [29861.137] psmouse serio1: synaptics: queried max coordinates [29861.169] psmouse serio1: synaptics: queried min coordinates [29861.175] gnome-shell segfault ← 162 ms after unfreeze [29861.233] usb 2-1: new SuperSpeed USB device number 6 (dock, AFTER the crash) ``` The crash lands in the middle of device re-enumeration, immediately after input devices are re-probed, and **before** the dock's own devices appear — so `GetResources` is being served while output/KMS state is still in flux. ### Impact The whole Wayland session dies and every open application is lost; recovery requires a fresh login. On a laptop that is resumed daily this is severe. ### What was ruled out - **Not a regression from a recent update.** The same kernel (7.0.0-31) and the - same mutter (46.2-…16, released 2026-06-17) were already in use before a clean - reinstall of the machine, on which the crash had never been observed. + same mutter (46.2-…16, released 2026-06-17) were already in use before a clean + reinstall of the machine, on which the crash had never been observed. - **Not a third-party GNOME extension.** The first crash predates the - installation of the only two third-party extensions by three hours. + installation of the only two third-party extensions by three hours. - **Not local systemd sleep hooks.** They run 0.4 s and 2.6 s *after* the crash. - **Not the dock's own re-enumeration.** Its devices appear after the crash. ### Related but distinct - LP #2148655 — same class (NULL deref on monitor state during hotplug/resume) - but a different function (`meta_logical_monitor_get_layout`), and only mutter - 50.x / Ubuntu 26.04. Fixed in 50.1-0ubuntu2.1; no equivalent fix exists for - 46.2 in noble. + but a different function (`meta_logical_monitor_get_layout`), and only mutter + 50.x / Ubuntu 26.04. Fixed in 50.1-0ubuntu2.1; no equivalent fix exists for + 46.2 in noble. - mutter MR !172 — adds a NULL check when `drmModeGetResources()` returns NULL. A 48 MB core dump is available and can be attached on request (privately).
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166959 Title: gnome-shell crashed with SIGSEGV in meta_output_kms_read_edid when GetResources is called during resu me from suspend To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2166959/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
