Source: linux Version: 6.12.94-1 Severity: important X-Debbugs-Cc: [email protected]
Dear Maintainer, Subject: i915 kernel BUG when freeing GEM object (Xorg, xfwm4 compositor, hard lock) Package: src:linux Version: 6.12.94-1 Severity: important Hi, I’m seeing reproducible hard lockups on Debian 13 (trixie) with the stock 6.12.94+deb13-amd64 kernel when running Xfce with the Xfwm4 compositor enabled on a System76 Serval WS laptop (Intel iGPU + NVIDIA dGPU). Symptom ======= Roughly once per session (sometimes more), the system suddenly freezes: - The *mouse cursor still moves* on screen. - *Keyboard input stops working completely* (no response to any keys, including Ctrl+Alt+Fx to switch VTs, and SysRq combos). - The only way out is a hard power-off via holding the power button. On the next boot, the previous boot’s journal shows a kernel BUG in the i915 driver called from Xorg. System ====== - Debian GNU/Linux 13 (trixie) - Kernel versions installed: - 6.12.94+deb13-amd64 (linux-image-6.12.94+deb13-amd64 6.12.94-1) - 6.1.0-50-amd64 (linux-image-6.1.0-50-amd64 6.1.176-1) - Currently running when the bug occurs: uname -a ---------- - Linux muricanthus 6.12.94+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.94-1 (2026-06-20) x86_64 GNU/Linux - Hardware: lspci | grep -Ei 'vga|3d|display' --------------------------------- OUTPUT OF `lspci` HERE This is a System76 Serval WS laptop with both Intel iGPU and NVIDIA dGPU. The logs below show the X server (Xorg) using the Intel stack with the modesetting/i915 drivers. - Desktop: Xfce - Xfwm4 compositor: xfconf-query -c xfwm4 -p /general/use_compositing ------------------------------------------------- true Proprietary NVIDIA modules are also loaded (so the kernel is tainted P,O,E), but the crash trace is in i915 and drm_gem code. Crash trace =========== From the previous boot (journalctl -b -1), around the time of the freeze: journalctl -b -1 --since "2026-07-05 19:05" --until "2026-07-05 19:15" ---------------------------------------------------------------------- Jul 05 19:09:13 muricanthus kernel: perf: interrupt took too long (3138 > 3127), lowering kernel.perf_event_max_sample_rate to 63500 Jul 05 19:09:46 muricanthus kernel: BUG: unable to handle page fault for address: 0000000000800018 Jul 05 19:09:46 muricanthus kernel: #PF: supervisor write access in kernel mode Jul 05 19:09:46 muricanthus kernel: #PF: error_code(0x0002) - not-present page Jul 05 19:09:46 muricanthus kernel: PGD 0 P4D 0 Jul 05 19:09:46 muricanthus kernel: Oops: Oops: 0002 [#3] PREEMPT SMP NOPTI Jul 05 19:09:46 muricanthus kernel: CPU: 31 UID: 0 PID: 2027 Comm: Xorg Tainted: P D OE 6.12.94+deb13-amd64 #1 Debian 6.12.94-1 Jul 05 19:09:46 muricanthus kernel: Tainted: [P]=PROPRIETARY_MODULE, [D]=DIE, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Jul 05 19:09:46 muricanthus kernel: Hardware name: System76 Serval WS/Serval WS, BIOS 2023-09-19_16ef69c 09/15/2023 Jul 05 19:09:46 muricanthus kernel: RIP: 0010:_raw_spin_lock_irqsave+0x27/0x50 Jul 05 19:09:46 muricanthus kernel: Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 53 9c 58 0f 1f 40 00 48 89 c3 fa 0f 1f 44 00 00 65 ff 05 98 a4 72 52 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 09 48 89 d8 5b c3 cc cc cc cc 89 c6 e8 a3 08 00 00 Jul 05 19:09:46 muricanthus kernel: RSP: 0018:ffffd22206b3bb20 EFLAGS: 00010046 Jul 05 19:09:46 muricanthus kernel: RAX: 0000000000000000 RBX: 0000000000000206 RCX: 0000000080400030 Jul 05 19:09:46 muricanthus kernel: RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000800018 Jul 05 19:09:46 muricanthus kernel: Call Trace: Jul 05 19:09:46 muricanthus kernel: <TASK> Jul 05 19:09:46 muricanthus kernel: i915_drm_client_remove_object+0x35/0xc0 [i915] Jul 05 19:09:46 muricanthus kernel: i915_gem_free_object+0x17/0x60 [i915] Jul 05 19:09:46 muricanthus kernel: drm_gem_object_release_handle+0x59/0xb0 [drm] Jul 05 19:09:46 muricanthus kernel: drm_gem_handle_delete+0x5d/0xa0 [drm] Jul 05 19:09:46 muricanthus kernel: drm_ioctl_kernel+0xad/0x100 [drm] Jul 05 19:09:46 muricanthus kernel: drm_ioctl+0x277/0x4d0 [drm] Jul 05 19:09:46 muricanthus kernel: __x64_sys_ioctl+0x94/0xc0 Jul 05 19:09:46 muricanthus kernel: do_syscall_64+0x87/0x1b0 Jul 05 19:09:46 muricanthus kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e Jul 05 19:09:46 muricanthus kernel: RIP: 0033:0x7fc1d8d3e91b ... Jul 05 19:09:46 muricanthus kernel: note: Xorg[2027] exited with irqs disabled Jul 05 19:09:46 muricanthus kernel: note: Xorg[2027] exited with preempt_count 1 After this, the system was effectively unresponsive (no VT switch, no SysRq keys), and I had to hold the power button to force a reboot. Repro / pattern =============== - Using Xfce with xfwm4 compositor enabled: xfconf-query -c xfwm4 -p /general/use_compositing ------------------------------------------------- true - Xorg is using the modesetting/i915 stack (see Xorg.0.log; can provide full log on request). - Running normal desktop workloads (web browser, PyTorch/transformers app using NVIDIA GPU). - After some time (tens of minutes to hours), the BUG above appears and the machine hard-freezes. I have also seen similar freezes on Debian 12 with xfwm4 compositor enabled, but there I did not capture the kernel BUG trace. Next steps / questions ====================== - Is this a known regression in the i915 driver in the 6.12.94 Debian kernel? - Are there any recommended workarounds besides disabling xfwm4 compositing or downgrading to the 6.1.0-50-amd64 kernel? - I can test: - Running with xfwm4 compositing disabled on 6.12.94. - Running with 6.1.0-50-amd64 on the same hardware. - Providing full dmesg, Xorg.0.log and additional traces as needed. Thank you for looking into this. -- System Information: Debian Release: 13.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.94+deb13-amd64 (SMP w/32 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
