** Description changed:
- NOTE: this text is AI generated
- ----
`gnome-shell` reliably segfaults in `meta_output_kms_read_edid()` shortly
after
resuming from suspend (S3), killing the entire Wayland session. It has
happened
twice, both times at the **same code offset** (`libmutter-14.so.0 +
0x17d816`),
so it is not a random memory error.
The crash is reached from an **external D-Bus call** to
`org.gnome.Mutter.DisplayConfig.GetResources`, served while the KMS outputs
are
still being re-probed after resume.
### Versions
```
mutter / libmutter-14-0 46.2-1ubuntu0.24.04.16
gnome-shell 46.0-0ubuntu6~24.04.14
kernel 7.0.0-31-generic (HWE)
Ubuntu 24.04.4 LTS (noble)
session Wayland
```
### Hardware
```
GPU 0 Intel TigerLake-H GT1 [UHD Graphics] [8086:9a60] ← drives all
outputs
GPU 1 NVIDIA TU117GLM [T600 Mobile] [10de:1fba] ← PRIME offload
only
driver nvidia 580.173.02
outputs eDP-1 (internal panel) + DP-1 (external monitor via Thunderbolt 4
dock)
```
Laptop with a Thunderbolt 4 controller at PCI `00:0d.0` hosting the
dock.
### Steps to reproduce
1. Suspend the laptop (`systemctl suspend` or `suspend-then-hibernate`), with
an
external monitor attached through a Thunderbolt dock — or attached while
the
machine is resuming.
2. Resume.
3. `gnome-shell` segfaults ~160 ms after userspace is unfrozen. The session is
- terminated and the user is dropped back to all
+ terminated and the user is dropped back to GDM with a brand-new session;
all
running applications are lost.
- Not every resume crashes: a 14-second suspend
- 15-hour one did. The common factor appears to
- controller powers down, and therefore how muchs on
+ Not every resume crashes: a 14-second suspend did not, a 4-minute one and a
+ 15-hour one did. The common factor appears to be how completely the USB/TB
+ controller powers down, and therefore how much device re-enumeration happens
on
resume.
### Symbolised backtrace
- Resolved with `addr2line` against `libmutter-14.16`
- (the trace recorded in the journal only had of
- afterwards, so `coredumpctl info` still shows
+ Resolved with `addr2line` against `libmutter-14-0-dbgsym
46.2-1ubuntu0.24.04.16`
+ (the trace recorded in the journal only had offsets; symbols were installed
+ afterwards, so `coredumpctl info` still shows the unsymbolised version).
```
- #0 meta_output_kms_read_edid 0 + 0x17d816)
+ #0 meta_output_kms_read_edid (libmutter-14.so.0
+ 0x17d816)
#1 meta_monitor_manager_handle_get_resources (libmutter-14.so.0
+ 0x9cc4a)
- #2 _g_dbus_codegen_marshal_BOOLEAN__OBJECT -config.c:241
+ #2 _g_dbus_codegen_marshal_BOOLEAN__OBJECT
meta-dbus-display-config.c:241
#3 g_closure_invoke
#4 g_signal_emitv
#5 _meta_dbus_display_config_skeleton_handle_method_call
meta-dbus-display-config.c:3506
#6 (libgio-2.0.so.0 + 0x129df3)
#7 (libgio-2.0.so.0 + 0x10dc08)
#8 g_main_loop_run
- #9 meta_context_run_main_loop 0 + 0xd50aa)
+ #9 meta_context_run_main_loop (libmutter-14.so.0
+ 0xd50aa)
```
### Faulting instruction
- The kernel logged the code bytes around the fa
+ The kernel logged the code bytes around the fault:
```
- Code: ... 48 8b 7f 18 e8 aa ff ff ff <48 8
- mov rdi,[rdi+0x18] call … mov
+ Code: ... 48 8b 7f 18 e8 aa ff ff ff <48 8b 58 40> 48 85 db 74 21 ...
+ mov rdi,[rdi+0x18] call … mov rbx,[rax+0x40] test rbx,rbx
```
- A call returns **NULL in `rax`** and the retur0x40`
- without being checked — hence `segfault at 40`
+ A call returns **NULL in `rax`** and the return value is dereferenced at
`+0x40`
+ without being checked — hence `segfault at 40`.
- Note that the very next instruction (`test rbxd
- value for NULL. So a NULL check exists, but itd
+ Note that the very next instruction (`test rbx,rbx`) *does* check the loaded
+ value for NULL. So a NULL check exists, but it is on the field that was read
rather than on the pointer that was returned.
Kernel message:
```
- gnome-shell[…]: segfault at 40 ip …15f7d816 sp
+ gnome-shell[…]: segfault at 40 ip …15f7d816 sp …0bbe9e00 error 4
in libmutter-14.so.0.0.0[17d816,…+167000]
```
### Timeline (kernel monotonic clock)
```
[29860.346] xhci_hcd 0000:00:0d.0: xHC error in resume, USBSTS 0x411, Reinit
- [29860.346] usb usb1/usb2: root hub lost powe
+ [29860.346] usb usb1/usb2: root hub lost power or was reset
[29861.006] Restarting tasks: Starting
- [29861.006] usb 3-3: USB disconnect, device n
- [29861.013] Restarting tasks: Done
- [29861.120] usb 3-3: new full-speed USB devic
- [29861.137] psmouse serio1: synaptics: querie
- [29861.169] psmouse serio1: synaptics: querie
- [29861.175] gnome-shell segfault
- [29861.233] usb 2-1: new SuperSpeed USB devic crash)
+ [29861.006] usb 3-3: USB disconnect, device number 19
+ [29861.013] Restarting tasks: Done ← userspace unfrozen
+ [29861.120] usb 3-3: new full-speed USB device number 20
+ [29861.137] psmouse serio1: synaptics: queried max coordinates
+ [29861.169] psmouse serio1: synaptics: queried min coordinates
+ [29861.175] gnome-shell segfault ← 162 ms after unfreeze
+ [29861.233] usb 2-1: new SuperSpeed USB device number 6 (dock, AFTER the
crash)
```
- The crash lands in the middle of device re-enunput
+ The crash lands in the middle of device re-enumeration, immediately after
input
devices are re-probed, and **before** the dock's own devices appear — so
- `GetResources` is being served while output/KM
+ `GetResources` is being served while output/KMS state is still in flux.
### Impact
- The whole Wayland session dies and every open
- requires a fresh login. On a laptop that is re
+ The whole Wayland session dies and every open application is lost; recovery
+ requires a fresh login. On a laptop that is resumed daily this is severe.
### What was ruled out
- **Not a regression from a recent update.** The same kernel (7.0.0-31) and
the
- same mutter (46.2-…16, released 2026-06-17) clean
- reinstall of the machine, on which the crash
- - **Not a third-party GNOME extension.** The f
- installation of the only two third-party ext
- - **Not local systemd sleep hooks.** They run rash.
+ same mutter (46.2-…16, released 2026-06-17) were already in use before a
clean
+ reinstall of the machine, on which the crash had never been observed.
+ - **Not a third-party GNOME extension.** The first crash predates the
+ installation of the only two third-party extensions by three hours.
+ - **Not local systemd sleep hooks.** They run 0.4 s and 2.6 s *after* the
crash.
- **Not the dock's own re-enumeration.** Its devices appear after the crash.
### Related but distinct
- - LP #2148655 — same class (NULL deref on monime)
- but a different function (`meta_logical_monitter
+ - LP #2148655 — same class (NULL deref on monitor state during hotplug/resume)
+ but a different function (`meta_logical_monitor_get_layout`), and only
mutter
50.x / Ubuntu 26.04. Fixed in 50.1-0ubuntu2.1; no equivalent fix exists for
46.2 in noble.
- - mutter MR !172 — adds a NULL check when `drmULL.
+ - mutter MR !172 — adds a NULL check when `drmModeGetResources()` returns
NULL.
+
+ A 48 MB core dump is available and can be attached on request
+ (privately).
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166959
Title:
gnome-shell crashed with SIGSEGV in meta_output_kms_read_edid when
GetResources is called during resu me from suspend
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2166959/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
