Bug 2463712 - gnome-shell crashes on startup: libwacom assertion "bus_to_str: code should not be reached" on Microsoft Surface (i2c-hid touch/pen)
Summary: gnome-shell crashes on startup: libwacom assertion "bus_to_str: code should n...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libwacom
Version: 44
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Peter Hutterer
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-29 01:30 UTC by noahjjenkins
Modified: 2026-05-24 02:27 UTC (History)
2 users (show)

Fixed In Version: libwacom-2.18.0-2.fc44
Clone Of:
Environment:
Last Closed: 2026-05-24 02:27:41 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Output of "sudo libinput list-devices" (10.07 KB, text/plain)
2026-04-30 01:40 UTC, noahjjenkins
no flags Details
Output of "udevadm info --export-db" (364.07 KB, text/plain)
2026-04-30 01:41 UTC, noahjjenkins
no flags Details
Output of sudo libwacom-list-local-devices > libwacom-list.txt 2>&1 && echo "exit code: $?" >> libwacom-list.txt (208 bytes, text/plain)
2026-05-06 01:56 UTC, noahjjenkins
no flags Details
Output of gdb -batch -ex run -ex bt -ex 'bt full'` with libwacom and glib2 debuginfo installed (5.79 KB, text/plain)
2026-05-06 21:49 UTC, noahjjenkins
no flags Details

Description noahjjenkins 2026-04-29 01:30:57 UTC
After upgrading from Fedora 43 to Fedora 44 via interactive software upgrade, gnome-shell
crashes immediately on startup, both for the GDM greeter (org.gnome.Shell)
and for user sessions. GDM enters a crash loop and eventually gives up with
"GdmLocalDisplayFactory: maximum number of display failures reached", leaving the
system at a text login on tty.

The crash is a SIGABRT triggered by a g_assert_not_reached() in libwacom:

  gnome-shell[PID]: libwacom:ERROR:../libwacom/libwacom-database.c:186:bus_to_str:
                    code should not be reached
  gnome-shell[PID]: Bail out! libwacom:ERROR:../libwacom/libwacom-database.c:186:
                    bus_to_str: code should not be reached

The hardware is a Microsoft Surface laptop Go (1943). Touch and pen are exposed via i2c-hid
(driver: i2c_hid_acpi, device i2c-MELF0411:00). I am running the stock Fedora
kernel, not linux-surface.

Removing the libwacom database (`mv /usr/share/libwacom /usr/share/libwacom.bak`)
is a complete workaround: gnome-shell starts normally and GDM presents a
graphical login. This points to libwacom encountering a bus type in one of its
.tablet files (or returned from the kernel for an enumerated device) that
bus_to_str() does not have a case for, hitting the unreachable branch.

This appears to be a regression introduced in F44, as the same machine ran F43
without issue.

Reproducible: Didn't try

Steps to Reproduce:
1. Install Fedora 43 Workstation on a Microsoft Surface device.
2. Upgrade to Fedora 44 via GNOME Software app (interactively)
3. After the upgrade reboots into the F44 kernel, observe that no graphical
   login appears.
4. Switch to a TTY (Ctrl+Alt+F3), log in, and inspect:
     systemctl status gdm
     journalctl -u gdm -b
     coredumpctl info <gnome-shell PID>
Actual Results:
gnome-shell aborts on startup with the libwacom assertion above. GDM retries,
hits its failure ceiling, and gives up. No graphical session is reachable.

Expected Results:
gnome-shell starts. If libwacom encounters a device or .tablet entry with a bus
type it doesn't recognize, it should log a warning and skip that entry, not
abort the calling process.

Additional Information:
To work around this issue, I was able to run the following:

sudo mv /usr/share/libwacom /usr/share/libwacom.bak
sudo systemctl restart gdm

Restoring the directory reproduces the crash, confirming that the trigger lives
in the libwacom .tablet database (or in how libwacom enumerates a device whose
bus is recorded there). I have not yet identified which specific .tablet file
or which bus type triggers it.

Comment 1 Peter Hutterer 2026-04-29 06:04:05 UTC
can you attach the libnput record output (no events needed, just the static description) for the tablet device on your machine? That should give us enough information to reproduce the issue, thanks.

Comment 2 noahjjenkins 2026-04-29 12:27:15 UTC
I've included the output of libinput record. The touchscreen was listed under event8 node. Let me know if I can help provide any addition information. Thanks so much for your help!

# libinput record
version: 1
ndevices: 1
libinput:
  version: "1.31.1"
  git: "unknown"
system:
  os: "fedora:44"
  kernel: "6.19.14-300.fc44.x86_64"
  dmi: "unknown"
devices:
- node: /dev/input/event8
  evdev:
    # Name: MELF0411:00 1FD2:9005
    # ID: bus 0x0018 (i2c) vendor 0x1fd2 product 0x9005 version 0x0100
    # Size in mm: 255x178
    # Supported Events:
    # Event type 0 (EV_SYN)
    # Event type 1 (EV_KEY)
    #   Event code 330 (BTN_TOUCH)
    # Event type 3 (EV_ABS)
    #   Event code 0 (ABS_X)
    #       Value         453
    #       Min             0
    #       Max          4095
    #       Fuzz            0
    #       Flat            0
    #       Resolution     16
    #   Event code 1 (ABS_Y)
    #       Value        1966
    #       Min             0
    #       Max          4095
    #       Fuzz            0
    #       Flat            0
    #       Resolution     23
    #   Event code 47 (ABS_MT_SLOT)
    #       Value           0
    #       Min             0
    #       Max             9
    #       Fuzz            0
    #       Flat            0
    #       Resolution      0
    #   Event code 53 (ABS_MT_POSITION_X)
    #       Value           0
    #       Min             0
    #       Max          4095
    #       Fuzz            0
    #       Flat            0
    #       Resolution     16
    #   Event code 54 (ABS_MT_POSITION_Y)
    #       Value           0
    #       Min             0
    #       Max          4095
    #       Fuzz            0
    #       Flat            0
    #       Resolution     23
    #   Event code 57 (ABS_MT_TRACKING_ID)
    #       Value           0
    #       Min             0
    #       Max         65535
    #       Fuzz            0
    #       Flat            0
    #       Resolution      0
    # Event type 4 (EV_MSC)
    #   Event code 5 (MSC_TIMESTAMP)
    # Properties:
    #    Property 1 (INPUT_PROP_DIRECT)
    name: "MELF0411:00 1FD2:9005"
    id: [24, 8146, 36869, 256]
    codes:
      0: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15] # EV_SYN
      1: [330] # EV_KEY
      3: [0, 1, 47, 53, 54, 57] # EV_ABS
      4: [5] # EV_MSC
    absinfo:
      0: [0, 4095, 0, 0, 16]
      1: [0, 4095, 0, 0, 23]
      47: [0, 9, 0, 0, 0]
      53: [0, 4095, 0, 0, 16]
      54: [0, 4095, 0, 0, 23]
      57: [0, 65535, 0, 0, 0]
    properties: [1]
  hid: [
    0x05, 0x0d, 0x09, 0x04, 0xa1, 0x01, 0x85, 0x10, 0x09, 0x54, 0x75, 0x08, 0x95, 0x01, 0x15, 0x00, 
    0x25, 0x0a, 0x81, 0x02, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 
    0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 
    0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 
    0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 
    0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 
    0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 
    0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 
    0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 
    0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 
    0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 
    0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 
    0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 
    0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 
    0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 
    0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 
    0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 
    0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 
    0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 
    0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 
    0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 
    0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 
    0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 
    0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 
    0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 
    0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 
    0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 
    0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 
    0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 
    0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 
    0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 
    0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 
    0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 
    0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x22, 
    0xa1, 0x02, 0x09, 0x51, 0x75, 0x08, 0x25, 0x0a, 0x81, 0x02, 0x09, 0x42, 0x75, 0x01, 0x25, 0x01, 
    0x81, 0x02, 0x95, 0x07, 0x81, 0x03, 0x05, 0x01, 0x75, 0x10, 0x95, 0x01, 0x26, 0xff, 0x0f, 0x35, 
    0x00, 0x55, 0x0e, 0x65, 0x11, 0x09, 0x30, 0x46, 0x47, 0x0a, 0x81, 0x02, 0x09, 0x31, 0x46, 0xda, 
    0x06, 0x81, 0x02, 0x45, 0x00, 0xc0, 0x05, 0x0d, 0x09, 0x56, 0x75, 0x10, 0x95, 0x01, 0x55, 0x0c, 
    0x66, 0x01, 0x10, 0x47, 0xff, 0xff, 0x00, 0x00, 0x27, 0xff, 0xff, 0x00, 0x00, 0x81, 0x02, 0x85, 
    0x08, 0x09, 0x55, 0x75, 0x08, 0x25, 0x0a, 0xb1, 0x02, 0x85, 0x04, 0x06, 0x00, 0xff, 0x09, 0xc5, 
    0x96, 0x00, 0x01, 0x26, 0xff, 0x00, 0xb1, 0x02, 0xc0, 0x06, 0x00, 0xff, 0x09, 0xff, 0xa1, 0x01, 
    0x85, 0x09, 0x09, 0xff, 0x75, 0x08, 0x95, 0x3f, 0x15, 0x00, 0x26, 0xff, 0x00, 0x91, 0x00, 0x85, 
    0x0a, 0x09, 0xff, 0x81, 0x00, 0xc0
  ]
  udev:
    properties:
    - ID_INPUT=1
    - ID_INPUT_HEIGHT_MM=178
    - ID_INPUT_TOUCHSCREEN=1
    - ID_INPUT_WIDTH_MM=255
    - LIBINPUT_DEVICE_GROUP=18/1fd2/9005:i2c-MELF0411:00
    - DRIVER=hid-multitouch
    virtual: false
  quirks:
  events:
  # Current time is 08:21:43

Comment 3 Peter Hutterer 2026-04-30 01:12:32 UTC
I don't think this is the device that causes the issue, check if you have any device that has ID_INPUT_TABLET set in udev (udevadm info --export-db and search through that). This one is connected via i2c which is supported by libwacom so I'd expect this device to work either way (but it should be ignored anyway since it doesn't have ID_INPUT_TABLET set)

Comment 4 noahjjenkins 2026-04-30 01:40:19 UTC
Created attachment 2138780 [details]
Output of "sudo libinput list-devices"

Comment 5 noahjjenkins 2026-04-30 01:41:19 UTC
Created attachment 2138781 [details]
Output of "udevadm info --export-db"

Comment 6 noahjjenkins 2026-04-30 01:44:23 UTC
Running udevadm info --export-db | grep -B 15 "ID_INPUT_TABLET=1" returns nothing; udev isn't flagging any devices as a tablet on this machine.

The issue must be something else related to libwacom, but to help narrow down what's going on, I've captured the output of libinput list-devices and my full udev database and attached them above.

Comment 7 Peter Hutterer 2026-05-06 01:02:35 UTC
This is... weird. there's no tablet device that I can see and libwacom should filter on that. I also don't see any weird ID_BUS settings in the udev db.

After logging in, symlink the wacom database to the .bak directory (so it can be quickly removed again) and run libwacom-list-local-devices, I wonder if that gives us something more useful. As a final fallback, if you grab libwacom from git it builds a helper tool that you can run against each event node: ./build/debug-device /dev/input/event0 - repeat that until it fails on one device and we have at least narrowed down which device it is.

Comment 8 noahjjenkins 2026-05-06 01:55:09 UTC
I've ran the following commands and attached libwacom-list.txt. 

sudo ln -s /usr/share/libwacom.bak /usr/share/libwacom
sudo libwacom-list-local-devices > libwacom-list.txt 2>&1
echo "exit code: $?" >> libwacom-list.txt
sudo rm /usr/share/libwacom

The libwacom-list-local-devices still seems to abort with the same assertion. The exit code "134" also matches the original crash. Let me know if it's still helpful for me to rebuild frim git.

Comment 9 noahjjenkins 2026-05-06 01:56:31 UTC
Created attachment 2139625 [details]
Output of sudo libwacom-list-local-devices > libwacom-list.txt 2>&1 && echo "exit code: $?" >> libwacom-list.txt

Comment 10 Peter Hutterer 2026-05-06 05:34:23 UTC
well, that at least narrowed it down even though it doesn't actually give us any hint of what the device is :(

If you install the debuginfo packages (or build from git) and run this through gdb, there's a while loop in main that looks like this:

	while ((filename = g_dir_read_name(dir))) {
		WacomDevice *dev;
		char fname[PATH_MAX];
		GList *found;

		if (!g_str_has_prefix(filename, "event"))
			continue;
		snprintf(fname, sizeof(fname), "/dev/input/%s", filename);

		dev = libwacom_new_from_path(db, fname, WFALLBACK_NONE, NULL);

And then gdb the tool:
$ gdb libwacom-list-local-devices
gdb> break libwacom_new_from_path
gdb> run
# and when it stops at that line:
gdb> display fname
gdb> continue

This should print each /dev/input/event node (repeat the `continue` or `c` for short) and the last one it prints before it blows up is the one we're interested in. Then do a libinput record on that event node, attach it here and hopefully that tells us what is going wrong.

Comment 11 noahjjenkins 2026-05-06 21:48:17 UTC
I deviated slightly from your suggestion — the breakpoint on libwacom_new_from_path never fires on this machine because the crash happens during database load (load_tablet_files / libwacom_parse_tablet_keyfile), before the device-iteration loop is reached. So I ran gdb in batch mode and grabbed `bt full` at the abort site instead. The trace can be found in gdb-trace.log.

If I'm reading the trace correctly, I think the issue is that the system can't read the bus type of the surfact-book.tablet entry - and this is ultimately causing the crash.

To provide more info on this device I also ran: 

grep -n -E "1b96|005e|0x5e" /usr/share/libwacom.bak/surface-book.tablet

6:DeviceMatch=virt|1b96|005e;mei|1b96|005e

I also checked the versions of libwacom just to be sure:

libwacom - version 2.18.0-1.fc44.x86_64

Comment 12 noahjjenkins 2026-05-06 21:49:33 UTC
Created attachment 2139911 [details]
Output of gdb -batch -ex run -ex bt -ex 'bt full'` with libwacom and glib2 debuginfo installed

Comment 13 Peter Hutterer 2026-05-06 23:51:49 UTC
> grep -n -E "1b96|005e|0x5e" /usr/share/libwacom.bak/surface-book.tablet

uhm, where does this tablet file come from? The `virt` and `mei` prefixes arent' supported by libwacom which is why the assertion triggers but neither upstream nor F44 libwacom here have that file. Did you write that yourself or did some other package install that?

Comment 14 Peter Hutterer 2026-05-07 05:16:59 UTC
Upstream fix https://github.com/linuxwacom/libwacom/pull/974

Comment 15 Peter Hutterer 2026-05-08 05:32:27 UTC
F44 build is in https://koji.fedoraproject.org/koji/taskinfo?taskID=145209070 but hanging because of the s390x builder outage. Will submit the update when that's resolved.

Comment 16 Fedora Update System 2026-05-08 23:20:48 UTC
FEDORA-2026-f717384b34 (libwacom-2.18.0-2.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-f717384b34

Comment 17 Fedora Update System 2026-05-09 01:26:06 UTC
FEDORA-2026-f717384b34 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-f717384b34`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-f717384b34

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 18 Fedora Update System 2026-05-24 02:27:41 UTC
FEDORA-2026-f717384b34 (libwacom-2.18.0-2.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.