modesetting: SIGSEGV in ms_tearfree_dri_abort on window destroy when TearFree is off (hybrid Intel + NVIDIA) #3968

Select the version

25.0.0.X

Describe your issue

Disclosure: This bug was found by an AI assistant (opencode, model grok-4.7) while investigating session crashes on the reporter's machine. The findings were checked against the live journal and the xlibre-xserver-25.0.0.25 source. The reporter confirmed the crashes.

Possible duplicate of #3678.
The same fault address (0x2b1) and the same path (DeleteWindow → ms_present_abort_vblank → ms_tearfree_dri_abort) appear there on XLibre 25.1.2 with a hybrid Intel and NVIDIA setup. This report is on 25.0.0.25, and the crash still happens with Option "TearFree" "off".

On a ThinkPad P52 (Intel UHD 630 + NVIDIA Quadro P3200, PRIME render offload), XLibre 25.0.0.25 dies with SIGSEGV at address 0x2b1 when a client destroys a window.

The crash is in ms_tearfree_dri_abort(), called from ms_present_abort_vblank() during ProcDestroyWindow. ms_present_abort_vblank() calls ms_tearfree_dri_abort() unconditionally. That function walks trf->dri_flip_list with xorg_list_for_each_entry. The list is only initialized when TearFree is enabled, so with TearFree off dri_flip_list.next is NULL and the walk faults.

Option "TearFree" "off" is not a workaround. The log shows the option is applied, and the server still crashes in ms_tearfree_dri_abort.

Steps to reproduce

1. ThinkPad P52, NixOS 26.05, SDDM, Sonic-DE.
2. Intel UHD Graphics 630 drives the internal panel (eDP-1-1) via modesetting. Quadro P3200 (driver 580.178.04, nvidia-drm.modeset=1) is the PRIME render-offload GPU and drives the external monitors.
3. XLibre pinned to 25.0.0.25, TearFree disabled:

configuration.nix :

nixpkgs.overlays = lib.mkAfter [
  (final: prev: {
    xorg-server = prev.xorg-server.overrideAttrs (prevAttrs: {
      version = "25.0.0.25";
      src = prev.fetchurl {
        url = "https://github.com/X11Libre/xserver/archive/refs/tags/xlibre-xserver-25.0.0.25.tar.gz";
        sha256 = "sha256-+lWuIU0Qdb7BVRRssQ1Ghm5KXwunQy+tzfntFqRRjSw=";
      };
    });
  })
];

gpu.nix

{
  hardware.graphics.enable = true;
  services.xserver.videoDrivers = [ "nvidia" ];
  services.xserver.deviceSection = ''
    Option "TearFree" "off"
  '';
  hardware.nvidia = {
    modesetting.enable = true;
    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
    open = false;
    prime = {
      intelBusId = "PCI:0:2:0";
      nvidiaBusId = "PCI:1:0:0";
      offload.enable = true;
    };
  };
}

4. Start Steam. Its update UI opens an X window and closes it within a few seconds.
5. The X server segfaults and SDDM restarts the session.
   Same crash when starting Parsec, which also creates and then destroys a GLX window.

What did you expect?

Destroying a window does not kill the X server. ms_present_abort_vblank() should not call ms_tearfree_dri_abort() unless the TearFree list was initialized. Steam and Parsec should start normally.

Additional Information

Server start, TearFree confirmed off:

XLibre X Server 1.25.0

(II) NVIDIA dlloader X Driver  580.178.04
(**) modeset(0): Option "TearFree" "off"
(II) modeset(0): glamor X acceleration enabled on Mesa Intel(R) UHD Graphics 630 (CFL GT2)
(II) NVIDIA(G0): NVIDIA GPU Quadro P3200 with Max-Q Design (GP104GL-A)
(WW) NVIDIA(G0): Option "TearFree" is not used

Crash while Steam's update window was being destroyed (2026-10-14 14:56:36). Same stack for the two Parsec crashes at 14:28:57 and 14:30:55:
ms_tearfree_dri_abort
ms_present_abort_vblank
present_scmd_abort_vblank
present_destroy_window
DeleteWindow
ProcDestroyWindow

Segmentation fault at address 0x2b1
Caught signal 11 (Segmentation fault). Server aborting

Extra fields

• I have checked the existing issues
• I have read the Contributing Guidelines
• I'd like to work on this issue