Fedora Account System
Red Hat Associate
Red Hat Customer
kmscon crashes with SIGSEGV during shutdown on Raspberry Pi 4 Model B. The RPi4 has two DRM devices: /dev/dri/card0 (vc4, display output) and /dev/dri/card1 (v3d, 3D-only, no dumb buffer support). When seat_go_foreground calls seat_video_init for the v3d device and it fails with -EOPNOTSUPP, the error handling frees the kmscon_video struct and unlinks it from the seat's video list, but does not clear the monitor device's data pointer (uterm_monitor_set_dev_data(vid->udev, NULL) is missing). This leaves a dangling pointer in the uterm_monitor_dev. During shutdown, uterm_monitor_unref iterates all monitor devices and passes the dangling pointer to kmscon_seat_remove_video, which dereferences freed memory and crashes. Reproducible: Always Steps to Reproduce: 1. Boot Minimal Fedora 45 Branched 20260826.n.0 on Raspberry Pi 4 Model B 2. Run kmscon in oneshot mode so it exits after the child process finishes, e.g.: kmscon --vt 7 --no-issue --oneshot --login /bin/true 3. kmscon encounters /dev/dri/card1 (v3d) which lacks dumb buffer support, fails to init the video device (-EOPNOTSUPP), but continues on /dev/dri/card0 4. The child process exits, kmscon shuts down 5. kmscon crashes with SIGSEGV during cleanup in kmscon_seat_free Note: Long-running kmscon instances (e.g. kmsconvt@tty1 providing login prompts) hit the same v3d init error but do not crash because they don't go through the shutdown/cleanup path during normal operation. Actual Results: kmscon on tty7 runs with --oneshot --login. It spawns the child (run-initial-setup), the child fails (SELinux denials), kmscon exits, triggering kmscon_seat_free → uterm_monitor_unref which hits the dangling pointer. Expected Results: kmscon on tty7 does not crash regardless on intial-setup status Additional Information: Version-Release number of selected component: kmscon-10.0.2-2.fc45.aarch64 Crash stack trace: #0 kmscon_seat_remove_video.part.0 (kmscon + 0x12470) #1 mon_free_dev (kmscon + 0x15fbc) #2 uterm_monitor_unref (kmscon + 0x1f544) #3 kmscon_seat_free.part.0 (kmscon + 0x152d0) #4 main (kmscon + 0x9fcc) Relevant journal output: kmscon[817]: [0000.144541] ERROR: drm_shared: Device /dev/dri/card1 doesn't support universal planes, using legacy kmscon[817]: [0000.144591] WARNING: drm_shared: Device /dev/dri/card1 doesn't support atomic modesetting, using legacy kmscon[817]: [0000.144626] ERROR: video_drm2d: driver does not support dumb buffers kmscon[817]: [0000.144694] ERROR: seat: cannot create video device /dev/dri/card1 on seat seat0: -95 kmscon[817]: [0000.211832] NOTICE: terminal: Display [HDMI-A] with backend [drm2d] text renderer [bbulk] font engine [unifont] audit[817]: ANOM_ABEND auid=0 uid=0 gid=0 ses=3 pid=817 comm="kmscon" exe="/usr/bin/kmscon" sig=11 Coredump registers at crash: PC=0x12470 (str x0, [x1, #8] -- NULL pointer dereference, writing to address 0x8) x0=0x0 x1=0x0 (vid->list.prev and vid->list.next, both NULL from freed memory) x20=0xaaaaf2e85600 (dangling vid pointer, memory already freed) Suggested fix in src/seat.c, seat_go_foreground(): Add uterm_monitor_set_dev_data(vid->udev, NULL) before free(vid) in the seat_video_init failure handling block.
Pull request: https://github.com/kmscon/kmscon/pull/512
I get the feeling we'll want to fix this in Beta if possible.
In discussing https://bugzilla.redhat.com/show_bug.cgi?id=2526278 , Jeremy Linton thought there might be a lower-level issue: "the simpldrm framebuffer being provided, should be taken over by the vc4 drm driver". It occurred to me that might also be relevant here, so CCing him.
+4 in https://forge.fedoraproject.org/quality/blocker-review/issues/2154 , marking accepted - the crash on shutdown is clearly FE-worthy, whether or not the LLM analysis/solution holds.
Well vc4 has the usual https://elixir.bootlin.com/linux/v7.2.2/source/drivers/gpu/drm/vc4/vc4_drv.c#L362 which means the simpledrm devices should be removed, but its probably racy, even scanning /sys probably is.
FEDORA-2026-45ebe41ba6 (kmscon-10.0.3-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6
FEDORA-2026-45ebe41ba6 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-45ebe41ba6` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-45ebe41ba6 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Jaroslav, can you test this? Most convenient way will probably be to test the next Rawhide compose, as that will have the change in it.
I can confirm that on Fedora-Minimal-Rawhide-20260903.n.0.aarch64 kmscon no longer crashes. Also SELinux policy seems to be fixed since I was able to complete initial-setup and login just fine. Attaching bootlog.
Created attachment 2156524 [details] Fedora-Minimal-Rawhide-20260903.n.0.aarch64 bootlog
Verified also on Fedora-Minimal-45_Beta-1.2.aarch64, works out of the box on RPi4.
Created attachment 2156655 [details] Fedora-Minimal-45_Beta-1.2.aarch64 bootlog
Setting verified per comment 11
FEDORA-2026-756d8c0914 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-756d8c0914` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-756d8c0914 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.