When logging out:
Sep 29 10:01:20 qaa kernel: ------------[ cut here ]------------
Sep 29 10:01:20 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.16.8/drivers/gpu/drm/display/drm_dp_mst_topology.c:4574:36
Sep 29 10:01:20 qaa kernel: shift exponent -1 is negative
Sep 29 10:01:20 qaa kernel: CPU: 4 UID: 0 PID: 490795 Comm: Xorg Not tainted 6.16.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.8-1
Sep 29 10:01:20 qaa kernel: Hardware name: Dell Inc. Precision 5570/01Y4G1, BIOS 1.32.1 04/28/2025
Sep 29 10:01:20 qaa kernel: Call Trace:
Sep 29 10:01:20 qaa kernel: <TASK>
Sep 29 10:01:20 qaa kernel: dump_stack_lvl+0x5d/0x80
Sep 29 10:01:20 qaa kernel: ubsan_epilogue+0x5/0x2b
Sep 29 10:01:20 qaa kernel: __ubsan_handle_shift_out_of_bounds.cold+0x5e/0x113
Sep 29 10:01:20 qaa kernel: drm_dp_atomic_release_time_slots.cold+0x18/0x61 [drm_display_helper]
Sep 29 10:01:20 qaa kernel: drm_atomic_helper_check_modeset+0x484/0xe30 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: intel_atomic_check+0xec/0x2b10 [i915]
Sep 29 10:01:20 qaa kernel: drm_atomic_check_only+0x63a/0xab0 [drm]
Sep 29 10:01:20 qaa kernel: drm_atomic_commit+0x71/0xe0 [drm]
Sep 29 10:01:20 qaa kernel: ? __pfx___drm_printfn_info+0x10/0x10 [drm]
Sep 29 10:01:20 qaa kernel: drm_client_modeset_commit_atomic+0x201/0x250 [drm]
Sep 29 10:01:20 qaa kernel: drm_client_modeset_commit_locked+0x5a/0x160 [drm]
Sep 29 10:01:20 qaa kernel: ? drm_setup_crtcs_fb+0xfa/0x150 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: __drm_fb_helper_restore_fbdev_mode_unlocked+0x5e/0xd0 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: drm_fb_helper_hotplug_event+0xe6/0x100 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: __drm_fb_helper_restore_fbdev_mode_unlocked+0xbd/0xd0 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: drm_fb_helper_set_par+0x30/0x40 [drm_kms_helper]
Sep 29 10:01:20 qaa kernel: intel_fbdev_set_par+0x38/0x80 [i915]
Sep 29 10:01:20 qaa kernel: fb_set_var+0x248/0x430
Sep 29 10:01:20 qaa kernel: ? __slab_free+0xdf/0x310
Sep 29 10:01:20 qaa kernel: ? __slab_free+0xdf/0x310
Sep 29 10:01:20 qaa kernel: ? __slab_free+0xdf/0x310
Sep 29 10:01:20 qaa kernel: fbcon_blank+0x28e/0x390
Sep 29 10:01:20 qaa kernel: do_unblank_screen+0xd6/0x1e0
Sep 29 10:01:20 qaa kernel: vt_ioctl+0x583/0x15b0
Sep 29 10:01:20 qaa kernel: tty_ioctl+0xe8/0x8c0
Sep 29 10:01:20 qaa kernel: __x64_sys_ioctl+0x93/0xe0
Sep 29 10:01:20 qaa kernel: do_syscall_64+0x84/0x320
Sep 29 10:01:20 qaa kernel: ? __x64_sys_close+0x3d/0x80
Sep 29 10:01:20 qaa kernel: ? kmem_cache_free+0x3a3/0x450
Sep 29 10:01:20 qaa kernel: ? do_syscall_64+0x30c/0x320
Sep 29 10:01:20 qaa kernel: ? do_user_addr_fault+0x2c3/0x7f0
Sep 29 10:01:20 qaa kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
Sep 29 10:01:20 qaa kernel: RIP: 0033:0x7f8285d648db
Sep 29 10:01:20 qaa kernel: Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
Sep 29 10:01:20 qaa kernel: RSP: 002b:00007ffec1647a00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
Sep 29 10:01:20 qaa kernel: RAX: ffffffffffffffda RBX: 000055fbd6e6ab80 RCX: 00007f8285d648db
Sep 29 10:01:20 qaa kernel: RDX: 0000000000000000 RSI: 0000000000004b3a RDI: 000000000000000e
Sep 29 10:01:20 qaa kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
Sep 29 10:01:20 qaa kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 000055fbd6ea5794
Sep 29 10:01:20 qaa kernel: R13: 00007ffec1647c48 R14: 000055fbd6e90c10 R15: 000055fbd6e90bf8
Sep 29 10:01:20 qaa kernel: </TASK>
Sep 29 10:01:20 qaa kernel: ---[ end trace ]---
What I did:
* Earlier, the laptop was connected to a dock.
* I logged out.
* I disconnected the machine from the dock.
* I closed the lid, which suspended the machine as expected:
Sep 29 09:19:53 qaa systemd-logind[1241]: Lid closed.
Sep 29 09:19:53 qaa systemd-logind[1241]: Suspending...
The above occurred after I opened the lid.
Later, after I reconnected the laptop to the dock: When I logged out,
I had crashes in nouveau and Xorg was no longer working. I had to
reboot the machine, which took time, because of more and more crashes
in nouveau. This is probably the following bug (same machine):
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108168
shift-out-of-bounds in drm_dp_mst_topology.c has already been reported several times in the past, everying involving suspend/resume or plugging/unplugging a USB-C dock: 2022-12: https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/1970495/comments/25 "Window manager freezes when plugging in USB-C dock with external monitor…" 2023-03 (for the comment about this error): https://github.com/NixOS/nixpkgs/issues/36392#issuecomment-1461490967 "not sure if related, but saw some new errors popping up when connecting usb c stuff" 2023-11: https://forums.linuxmint.com/viewtopic.php?t=407900 "Cinnamon freezes when unsuspending" 2024-04: https://bugs.launchpad.net/ubuntu/+source/linux-signed-hwe-6.5/+bug/2061091 "Sometimes, when trying to shut down or suspend my laptop, it gets stuck on the console screen"
Hi Vincent, Assuming you can reproduce this, can you test the patch from https://lore.kernel.org/all/20251119094650.799135-1-suraj.kandpal@intel.com/ and report back if that fixes the issue? In case it does, can you please followup to the upstream patch sumission adding your Tested-by (and ideally get as well a Closes tag for this bug for easier tracking). I might be completely wrong on it. Regards, Salvatore
6.16.7+deb14-amd64 kernel: Sep 15 02:48:08 qaa kernel: Linux version 6.16.7+deb14-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-14 (Debian 14.3.0-8) 14.3.0, GNU ld (GNU Binutils for Debian) 2.45) #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) Sep 15 02:48:08 qaa kernel: Command line: BOOT_IMAGE=/vmlinuz-6.16.7+deb14-amd64 root=/dev/mapper/qaa--vg-root ro quiet [...] Sep 15 02:48:09 qaa boltd[1396]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] connected: connected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) [...] Sep 15 03:53:11 qaa systemd-logind[1253]: Lid closed. Sep 15 03:53:11 qaa kernel: ACPI: button: The lid device is not compliant to SW_LID. [...] Sep 15 08:23:19 qaa systemd-logind[1253]: Lid opened. [...] Sep 15 08:23:30 qaa boltd[1396]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] disconnected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) Sep 15 08:23:30 qaa kernel: thunderbolt 0-1: device disconnected [...] Sep 15 08:23:35 qaa systemd-logind[1253]: Lid closed. Sep 15 08:23:35 qaa systemd-logind[1253]: Suspending... [...] Sep 15 08:23:35 qaa wpa_supplicant[1319]: nl80211: deinit ifname=wlp0s20f3 disabled_11b_rates=0 Sep 15 09:02:12 qaa kernel: Freezing user space processes Sep 15 09:02:12 qaa kernel: Freezing user space processes completed (elapsed 0.216 seconds) [...] Sep 15 09:02:12 qaa systemd-logind[1253]: Lid opened. [...] Sep 15 09:53:02 qaa systemd-logind[1253]: Lid closed. Sep 15 09:53:02 qaa systemd-logind[1253]: Suspending... [...] Sep 15 09:53:03 qaa wpa_supplicant[1319]: nl80211: deinit ifname=wlp0s20f3 disabled_11b_rates=0 Sep 15 13:17:55 qaa kernel: Freezing user space processes Sep 15 13:17:55 qaa kernel: Freezing user space processes completed (elapsed 0.001 seconds) Sep 15 13:17:55 qaa kernel: OOM killer disabled. Sep 15 13:17:55 qaa kernel: Freezing remaining freezable tasks Sep 15 13:17:55 qaa kernel: Freezing remaining freezable tasks completed (elapsed 0.001 seconds) Sep 15 13:17:55 qaa kernel: printk: Suspending console(s) (use no_console_suspend to debug) Sep 15 13:17:55 qaa kernel: ------------[ cut here ]------------ Sep 15 13:17:55 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.16.7/drivers/gpu/drm/display/drm_dp_mst_topology.c:4574:36 Sep 15 13:17:55 qaa kernel: shift exponent -1 is negative [...] then various crashes when rebooting at 17:50:57. Recall of the issue on September 29: Sep 25 17:46:18 qaa kernel: Linux version 6.16.8+deb14-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-14 (Debian 14.3.0-8) 14.3.0, GNU ld (GNU Binutils for Debian) 2.45) #1 SMP PREEMPT_DYNAMIC Debian 6.16.8-1 (2025-09-21) Sep 25 17:46:18 qaa kernel: Command line: BOOT_IMAGE=/vmlinuz-6.16.8+deb14-amd64 root=/dev/mapper/qaa--vg-root ro quiet [...] Sep 25 17:46:19 qaa boltd[1361]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] connected: connected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) [...] Sep 25 17:46:38 qaa systemd-logind[1241]: Lid closed. Sep 25 17:46:38 qaa kernel: ACPI: button: The lid device is not compliant to SW_LID. [...] Sep 29 09:19:16 qaa systemd-logind[1241]: Lid opened. [...] Sep 29 09:19:47 qaa kernel: thunderbolt 0-1: device disconnected Sep 29 09:19:47 qaa boltd[1361]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] disconnected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) [...] Sep 29 09:19:53 qaa systemd-logind[1241]: Lid closed. Sep 29 09:19:53 qaa systemd-logind[1241]: Suspending... [...] Sep 29 09:19:53 qaa wpa_supplicant[1297]: nl80211: deinit ifname=wlp0s20f3 disabled_11b_rates=0 Sep 29 10:00:39 qaa kernel: Freezing user space processes Sep 29 10:00:39 qaa systemd-logind[1241]: Lid opened. Sep 29 10:00:39 qaa rtkit-daemon[1845]: The canary thread is apparently starving. Taking action. Sep 29 10:00:39 qaa kernel: Freezing user space processes completed (elapsed 0.001 seconds) [...] Sep 29 10:00:59 qaa systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully. Sep 29 10:01:18 qaa lightdm[490939]: Failed to write utmpx: No such file or directory Sep 29 10:01:18 qaa lightdm[490939]: pam_unix(lightdm:session): session closed for user vinc17 Sep 29 10:01:18 qaa systemd-logind[1241]: Session 818 logged out. Waiting for processes to exit. [...] Sep 29 10:01:20 qaa kernel: ------------[ cut here ]------------ Sep 29 10:01:20 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.16.8/drivers/gpu/drm/display/drm_dp_mst_topology.c:4574:36 Sep 29 10:01:20 qaa kernel: shift exponent -1 is negative [...] Lines to look at: lid (closed|opened)|thunderbolt.*connect|suspend The only other time I did something similar later was with the older kernel 6.7.12-amd64, and the issue did not occur. And previously: Jul 18 15:40:15 qaa kernel: Linux version 6.12.38+deb13-amd64 (debian-kernel@lists.debian.org) (x86_64-linux-gnu-gcc-14 (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #1 SMP PREEMPT_DYNAMIC Debian 6.12.38-1 (2025-07-16) Jul 18 15:40:15 qaa kernel: Command line: BOOT_IMAGE=/vmlinuz-6.12.38+deb13-amd64 root=/dev/mapper/qaa--vg-root ro quiet [...] Jul 19 08:41:15 qaa kernel: thunderbolt 0-1: device disconnected Jul 19 08:41:15 qaa boltd[1592]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] disconnected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) [...] Jul 19 08:41:20 qaa systemd-logind[1450]: Lid closed. Jul 19 08:41:20 qaa systemd-logind[1450]: Suspending... [...] Jul 19 08:41:21 qaa wpa_supplicant[1523]: nl80211: deinit ifname=wlp0s20f3 disabled_11b_rates=0 Jul 19 11:52:32 qaa kernel: Freezing user space processes [...] Jul 19 11:52:32 qaa systemd-logind[1450]: Lid opened. [...] Jul 28 10:30:45 qaa systemd-logind[1450]: Lid closed. Jul 28 10:30:45 qaa systemd-logind[1450]: Suspending... [...] Jul 28 10:30:45 qaa kernel: Freezing user space processes Jul 28 12:08:43 qaa kernel: Freezing user space processes completed (elapsed 0.002 seconds) [...] Jul 28 12:08:43 qaa boltd[1592]: [41ba8780-0029-WD22TB4 Thunderbolt Dock ] connected: connected (/sys/devices/pci0000:00/0000:00:0d.2/domain0/0-0/0-1) [...] Jul 28 12:08:46 qaa systemd-logind[1450]: Lid opened. but I got no crashes either. If I can still reproduce the issue, I hope I can try next week (this is not very practical as there is space for only 2 initrd.img in /boot).
Hi Vincent, Were you able to reproduce the issue and if yes test that patch? Regards, Salvatore
Hi Salvatore, Sorry, I could not try yet. This has been a busy period, and still until at least around February 9.
At https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6303 there is no indication that the bug was fixed upstream. FYI, I got this error only 3 times: 2025-09-15T13:17:55+02:00 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.16.7/drivers/gpu/drm/display/drm_dp_mst_topology.c:4574:36 2025-09-15T13:17:55+02:00 qaa kernel: shift exponent -1 is negative 2025-09-15T13:17:55+02:00 qaa kernel: CPU: 9 UID: 0 PID: 41777 Comm: kworker/u64:1 Not tainted 6.16.7+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.7-1 2025-09-29T10:01:20+02:00 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.16.8/drivers/gpu/drm/display/drm_dp_mst_topology.c:4574:36 2025-09-29T10:01:20+02:00 qaa kernel: shift exponent -1 is negative 2025-09-29T10:01:20+02:00 qaa kernel: CPU: 4 UID: 0 PID: 490795 Comm: Xorg Not tainted 6.16.8+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.8-1 2025-12-02T09:56:26+01:00 qaa kernel: UBSAN: shift-out-of-bounds in /build/reproducible-path/linux-6.17.9/drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 2025-12-02T09:56:26+01:00 qaa kernel: shift exponent -1 is negative 2025-12-02T09:56:26+01:00 qaa kernel: CPU: 4 UID: 0 PID: 34480 Comm: Xorg Not tainted 6.17.9+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.9-1
I forgot to remove the "fixed-upstream" tag.
Hi, The fix upstream would be: v7.0-rc1: 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa drm/display/dp_mst: Add protection against 0 vcpi which got backported in turn as well to v6.1.165: 95dbd525efce2a9e9e1c50ad15213de644c85ad0 drm/display/dp_mst: Add protection against 0 vcpi v6.6.128: ac9a7c329a5610051fc476644c9b9145a5965ecb drm/display/dp_mst: Add protection against 0 vcpi v6.12.75: 3f44cdb5371faf225af37d5caba8f21ec0572469 drm/display/dp_mst: Add protection against 0 vcpi v6.18.16: 4d2ccdea18b564e3f73e3e543854acea64e6277d drm/display/dp_mst: Add protection against 0 vcpi (but that is less relevant for this bug, if you are running unstable kernel, so moving to the last kernel in unstable includes the above). Regards, Salvatore
Control: tags -1 fixed-upstream - moreinfo https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=342ccffd9f77fc29fe1c05fd145e4d842bd2feaa which was committed on 2025-11-28, so the last time I got the issue (only a few days later), the kernel (6.*) did not have the fix. BTW, this is CVE-2025-71305: https://nvd.nist.gov/vuln/detail/CVE-2025-71305 Yes, the machine in question is running unstable (though I sometimes uses an older kernel due to another bug, which is not fixed yet). So I suppose that this bug could now be closed.
Source: linux Source-Version: 6.19.4-1~exp1 Thanks for the confirmation, I'm closing it with the corresponding version (actually the fix was as well already in 6.19.4). Regards, Salvatore