Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #93236

Bug#1141541: linux: i915 kernel BUG in i915_drm_client_remove_object from Xorg causing hard lock on 6.12.94+deb13-amd64

Cross-posted to 2 groups.

Show all headers | View raw

Source: linux
Version: 6.12.94-1
Severity: important
X-Debbugs-Cc: mole@morris.net

Dear Maintainer,

Subject: i915 kernel BUG when freeing GEM object (Xorg, xfwm4 compositor, hard lock)

Package: src:linux
Version: 6.12.94-1
Severity: important

Hi,

I’m seeing reproducible hard lockups on Debian 13 (trixie) with the
stock 6.12.94+deb13-amd64 kernel when running Xfce with the Xfwm4
compositor enabled on a System76 Serval WS laptop (Intel iGPU + NVIDIA dGPU).

Symptom
=======

Roughly once per session (sometimes more), the system suddenly freezes:

- The *mouse cursor still moves* on screen.
- *Keyboard input stops working completely* (no response to any keys,
  including Ctrl+Alt+Fx to switch VTs, and SysRq combos).
- The only way out is a hard power-off via holding the power button.

On the next boot, the previous boot’s journal shows a kernel BUG in the
i915 driver called from Xorg.

System
======

- Debian GNU/Linux 13 (trixie)
- Kernel versions installed:
  - 6.12.94+deb13-amd64 (linux-image-6.12.94+deb13-amd64 6.12.94-1)
  - 6.1.0-50-amd64 (linux-image-6.1.0-50-amd64 6.1.176-1)
- Currently running when the bug occurs:

  uname -a
  ----------
- Linux muricanthus 6.12.94+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.94-1 (2026-06-20) x86_64 GNU/Linux

- Hardware:

  lspci | grep -Ei 'vga|3d|display'
  ---------------------------------
  OUTPUT OF `lspci` HERE

This is a System76 Serval WS laptop with both Intel iGPU and NVIDIA dGPU.
The logs below show the X server (Xorg) using the Intel stack with the
modesetting/i915 drivers.

- Desktop: Xfce
- Xfwm4 compositor:

  xfconf-query -c xfwm4 -p /general/use_compositing
  -------------------------------------------------
  true

Proprietary NVIDIA modules are also loaded (so the kernel is tainted P,O,E),
but the crash trace is in i915 and drm_gem code.

Crash trace
===========

From the previous boot (journalctl -b -1), around the time of the freeze:

  journalctl -b -1 --since "2026-07-05 19:05" --until "2026-07-05 19:15"
  ----------------------------------------------------------------------

  Jul 05 19:09:13 muricanthus kernel: perf: interrupt took too long (3138 > 3127), lowering kernel.perf_event_max_sample_rate to 63500
  Jul 05 19:09:46 muricanthus kernel: BUG: unable to handle page fault for address: 0000000000800018
  Jul 05 19:09:46 muricanthus kernel: #PF: supervisor write access in kernel mode
  Jul 05 19:09:46 muricanthus kernel: #PF: error_code(0x0002) - not-present page
  Jul 05 19:09:46 muricanthus kernel: PGD 0 P4D 0
  Jul 05 19:09:46 muricanthus kernel: Oops: Oops: 0002 [#3] PREEMPT SMP NOPTI
  Jul 05 19:09:46 muricanthus kernel: CPU: 31 UID: 0 PID: 2027 Comm: Xorg Tainted: P      D    OE      6.12.94+deb13-amd64 #1  Debian 6.12.94-1
  Jul 05 19:09:46 muricanthus kernel: Tainted: [P]=PROPRIETARY_MODULE, [D]=DIE, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
  Jul 05 19:09:46 muricanthus kernel: Hardware name: System76 Serval WS/Serval WS, BIOS 2023-09-19_16ef69c 09/15/2023
  Jul 05 19:09:46 muricanthus kernel: RIP: 0010:_raw_spin_lock_irqsave+0x27/0x50
  Jul 05 19:09:46 muricanthus kernel: Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 53 9c 58 0f 1f 40 00 48 89 c3 fa 0f 1f 44 00 00 65 ff 05 98 a4 72 52 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 09 48 89 d8 5b c3 cc cc cc cc 89 c6 e8 a3 08 00 00
  Jul 05 19:09:46 muricanthus kernel: RSP: 0018:ffffd22206b3bb20 EFLAGS: 00010046
  Jul 05 19:09:46 muricanthus kernel: RAX: 0000000000000000 RBX: 0000000000000206 RCX: 0000000080400030
  Jul 05 19:09:46 muricanthus kernel: RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000800018
  Jul 05 19:09:46 muricanthus kernel: Call Trace:
  Jul 05 19:09:46 muricanthus kernel:  <TASK>
  Jul 05 19:09:46 muricanthus kernel:  i915_drm_client_remove_object+0x35/0xc0 [i915]
  Jul 05 19:09:46 muricanthus kernel:  i915_gem_free_object+0x17/0x60 [i915]
  Jul 05 19:09:46 muricanthus kernel:  drm_gem_object_release_handle+0x59/0xb0 [drm]
  Jul 05 19:09:46 muricanthus kernel:  drm_gem_handle_delete+0x5d/0xa0 [drm]
  Jul 05 19:09:46 muricanthus kernel:  drm_ioctl_kernel+0xad/0x100 [drm]
  Jul 05 19:09:46 muricanthus kernel:  drm_ioctl+0x277/0x4d0 [drm]
  Jul 05 19:09:46 muricanthus kernel:  __x64_sys_ioctl+0x94/0xc0
  Jul 05 19:09:46 muricanthus kernel:  do_syscall_64+0x87/0x1b0
  Jul 05 19:09:46 muricanthus kernel:  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  Jul 05 19:09:46 muricanthus kernel: RIP: 0033:0x7fc1d8d3e91b
  ...
  Jul 05 19:09:46 muricanthus kernel: note: Xorg[2027] exited with irqs disabled
  Jul 05 19:09:46 muricanthus kernel: note: Xorg[2027] exited with preempt_count 1

After this, the system was effectively unresponsive (no VT switch, no SysRq keys),
and I had to hold the power button to force a reboot.

Repro / pattern
===============

- Using Xfce with xfwm4 compositor enabled:

  xfconf-query -c xfwm4 -p /general/use_compositing
  -------------------------------------------------
  true

- Xorg is using the modesetting/i915 stack (see Xorg.0.log; can provide full log on request).
- Running normal desktop workloads (web browser, PyTorch/transformers app using NVIDIA GPU).
- After some time (tens of minutes to hours), the BUG above appears and the machine hard-freezes.

I have also seen similar freezes on Debian 12 with xfwm4 compositor enabled, but there I did not capture the kernel BUG trace.

Next steps / questions
======================

- Is this a known regression in the i915 driver in the 6.12.94 Debian kernel?
- Are there any recommended workarounds besides disabling xfwm4 compositing or downgrading to the 6.1.0-50-amd64 kernel?
- I can test:
  - Running with xfwm4 compositing disabled on 6.12.94.
  - Running with 6.1.0-50-amd64 on the same hardware.
  - Providing full dmesg, Xorg.0.log and additional traces as needed.

Thank you for looking into this.

-- System Information:
Debian Release: 13.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.94+deb13-amd64 (SMP w/32 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1141541: linux: i915 kernel BUG in i915_drm_client_remove_object from Xorg causing hard lock on 6.12.94+deb13-amd64 "Paul J. Morris" <mole@morris.net> - 2026-07-06 02:00 +0200
  Bug#1141541: linux: i915 kernel BUG in i915_drm_client_remove_object from Xorg causing hard lock on 6.12.94+deb13-amd64 Ben Hutchings <ben@decadent.org.uk> - 2026-07-06 15:20 +0200
  Processed: Re: Bug#1141541: linux: i915 kernel BUG in  i915_drm_client_remove_object from Xorg causing hard lock on  6.12.94+deb13-amd64 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-07-06 15:20 +0200

csiph-web