Bug 2545406

Summary: kmscon crashes with kernel-7.3.0-0.rc5.45.fc46 or higher, tty1-5 work with agetty fallback but tty6 does not
Product: [Fedora] Fedora Reporter: Adam Williamson (Fedora) <rhbz>
Component: kmsconAssignee: Jocelyn Falempe <jfalempe>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: rawhideCC: jfalempe, jforbes
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kmscon-10.0.4-5.fc45 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-13 03:39:27 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Adam Williamson (Fedora) 2026-10-02 21:17:33 UTC
Kernels since kernel-7.3.0-0.rc5.45.fc46 are failing openQA tests. The problem seems to be that tests fail when switching VT and attempting to log in.

I can reproduce this in a local VM. Install Rawhide, update to current, install the current gated kernel update - https://bodhi.fedoraproject.org/updates/FEDORA-2026-acf69ef47b - and reboot. VT 1 appears not to be using kmscon - you can log in on it successfully, but it's using old school fonts, indicating it's not kmscon. Switch to VT 6 (ctrl-alt-f6), again you see old-school fonts. If you try to log in here, it fails, it cycles back to the login prompt.

After doing this, coredumpctl shows three kmscon crashes. Here is the backtrace of the most recent one:


Thread 1 (Thread 0x7f4ba962a8c0 (LWP 865)):
#0  get_property_value (fd=fd@entry=16, props=props@entry=0x0, name=0x55fe521b3818 "type") at ../src/video/drm_shared.c:83
        prop = <optimized out>
        value = <optimized out>
        j = 0
#1  0x000055fe521dad32 in modeset_find_plane (fd=16, disp=0x55fe5ec6d230) at ../src/video/drm_shared.c:258
        props = 0x0
        plane_id = 36
        plane_type = <optimized out>
        plane = 0x55fe5ec587a0
        ddrm = <optimized out>
        plane_res = 0x55fe5ec58b20
        found_primary = true
        found_cursor = false
        i = 1
        ret = <optimized out>
#2  bind_display (video=0x55fe5ec585c0, res=<optimized out>, conn=<optimized out>) at ../src/video/drm_shared.c:1416
        vdrm = 0x55fe5ec58450
        disp = 0x55fe5ec6d230
        ddrm = <optimized out>
        name = <optimized out>
        ret = 0
        err_unref = <optimized out>
#3  drm_video_hotplug (video=0x55fe5ec585c0, read_dpms=read_dpms@entry=true, modeset=modeset@entry=true) at ../src/video/drm_shared.c:1509
        found = false
        __ptr = <optimized out>
        vdrm = <optimized out>
        res = <optimized out>
        conn = <optimized out>
        disp = <optimized out>
        ddrm = <optimized out>
        ret = <optimized out>
        i = <optimized out>
        dpms = <optimized out>
        tmp = <optimized out>
        needs_modeset = true
#4  0x000055fe521db490 in drm_video_wake_up (video=video@entry=0x55fe5ec585c0) at ../src/video/drm_shared.c:1552
        ret = <optimized out>
        vdrm = 0x55fe5ec58450
#5  0x000055fe521df094 in drm2d_video_wake_up (video=0x55fe5ec585c0) at ../src/video/drm2d_video.c:317
        ret = <optimized out>
#6  0x000055fe521d55b3 in video_wake_up (video=0x55fe5ec585c0) at ../src/video/video.c:573
        ret = <optimized out>
#7  video_wake_up (video=0x55fe5ec585c0) at ../src/video/video.c:561
        ret = 0
#8  0x000055fe521cc0a9 in seat_video_init (vid=vid@entry=0x55fe5ec57e60) at ../src/seat.c:948
        seat = 0x55fe5eb1e6e0
        width = 0
        height = 0
        backend = 0x55fe521b82da <be_drm2d> "drm2d"
        ret = <optimized out>
#9  0x000055fe521cc2e4 in kmscon_seat_add_video (seat=<optimized out>, type=<optimized out>, flags=<optimized out>, node=0x55fe5ec57020 "/dev/dri/card0", udev=0x55fe5ec58390) at ../src/seat.c:985
        vid = <optimized out>
        ret = -12
#10 seat_monitor_new_dev (node=0x55fe5ec57020 "/dev/dri/card0", type=<optimized out>, flags=<optimized out>, data=<optimized out>, udev=0x55fe5ec58390) at ../src/seat.c:650
        seat = <optimized out>
#11 0x000055fe521d660d in uterm_monitor_scan (mon=0x55fe5eb50870, seat_name=<optimized out>) at ../src/uterm/monitor.c:687
        e = 0x55fe5ec11fc0
        entry = 0x55fe5ec74f90
        dev = 0x55fe5ec56e50
        path = <optimized out>
        ret = <optimized out>
#12 0x000055fe521c68e5 in uterm_monitor_scan (mon=<optimized out>, seat_name=<optimized out>) at ../src/uterm/monitor.c:639
        e = <optimized out>
        entry = <optimized out>
        dev = <optimized out>
        path = <optimized out>
        ret = <optimized out>
        out_enum = <optimized out>
#13 kmscon_seat_startup (seat=<optimized out>) at ../src/seat.c:1053
No locals.
#14 setup_seat (app=0x7fff63d753b0) at ../src/main.c:93
        ret = 0
#15 main (argc=<optimized out>, argv=<optimized out>) at ../src/main.c:221
        ret = <optimized out>
        conf_ctx = 0x55fe5eb18560
        conf = <optimized out>
        app = {conf_ctx = 0x55fe5eb18560, conf = 0x55fe5eb183c0, exiting = false, eloop = 0x55fe5eb1ae80, seat_ctx = 0x55fe5eb1ec90, seat_conf = 0x55fe5eb1eaf0, seat = 0x55fe5eb1e6e0, dbus = 0x55fe5eb1b3d0}

Line 83 of drm_shared.c is:

            for (j = 0; j < props->count_props: j++) {

If I'm reading the trace right, props is null, which is likely the issue?

Comment 1 Adam Williamson (Fedora) 2026-10-02 21:20:45 UTC
For some reason, the 'cycles back to the login prompt' element is specific to tty6. tty1 through tty5 all work fine with the fallback kernel console. I see active getty@ services on tty1 through tty6, and failed kmsconvt@ services on tty1 through tty6. Not sure what's special about 6.

Comment 2 Jocelyn Falempe 2026-10-02 22:26:04 UTC
Thanks for looking into this.

I agree, there is a missing check if props in NULL.
I can make a patch for that.
At the same time, it's a bit surprising to have a drm driver that has no properties at all.
It certainly won't be functional.

Comment 3 Jocelyn Falempe 2026-10-02 22:31:48 UTC
I've made this pull request upstream, https://github.com/kmscon/kmscon/pull/543 and will push a bodhi update next week.

Comment 4 Fedora Update System 2026-10-08 14:21:21 UTC
FEDORA-2026-0a823ffaca (kmscon-10.0.4-4.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-0a823ffaca

Comment 5 Adam Williamson (Fedora) 2026-10-08 15:54:00 UTC
Thank you! The fix does appear to work in Rawhide. I don't know what's going on with the drm driver, but with this fix, we don't have crashes in Rawhide any more and the consoles work.

Comment 6 Fedora Update System 2026-10-09 02:09:09 UTC
FEDORA-2026-0a823ffaca has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0a823ffaca`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0a823ffaca

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-13 03:39:27 UTC
FEDORA-2026-40aeea1b96 (kmscon-10.0.4-5.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.