External monitors can show hidden content before screen is unlocked

[rostidev]

Distribution

Fedora 41

Package version

6.2.9

Graphics hardware in use

00:02.0 VGA compatible controller [0300]: Intel Corporation Meteor Lake-P [Intel Graphics] [8086:7dd5] (rev 08)
DeviceName: Onboard IGD
Subsystem: Hewlett-Packard Company Device [103c:8c26]

Frequency

Always

Bug description

This is a copy/paste of https://bugzilla.redhat.com/show_bug.cgi?id=2332552 that I reported 8 days ago and still without any reaction.

Connecting a screen locked laptop to a docking station with additional external monitors may expose content of those external monitors before unlocked if the screen was previously locked without docking station connected. Some of those external monitors could sometimes stop working and start showing an error message about the input signal until its power is disconnected and connected again.

In my case the docking station is Dell WD19, connected to HP EliteBook 840 G11 by a Type-C cable. My two external monitors are Dell P2425HE connected to the docking station by DP cables.

Steps to reproduce

1. Lock screen of your laptop (Ctrl+Alt+L) when it's NOT connected to any docking station
2. Connect a docking station with two external monitors by Type-C cable
3. Make any mouse move

Expected behavior

All external monitors should hide their content until the screen is not unlocked.

This works as expected only if the screen locking was done when external monitors are connected.

Additional information

I consider this bug as a security issue. Don't know if this is something Fedora specific or general for all Cinnamon builds.

[rostidev]

After the recent upgrade of Cinnamon in Fedora 41 from version 6.2.9 to 6.4.3 this wrong behavior has changed to other wrong one. In the same scenario the external monitors remain to be locked and this is good (they don't show anything hidden) but the main screen of the laptop shows its hidden contents for 1-2 seconds right after the docking station is connected again.

[kovacsIVgabor]

Similar happened to me today.

Steps to reproduce

Laptop is in sleep, locked.
Connected external monitor via Type-C.
Open lid to wake up.
Unusually slow black screen for about 5sec when I moved the mouse the desktop showed up for a sec, than finally the lock screen covered it.

System details

Asus laptop with Intel i3-10110U integrated gpu
Distro: Arch
Package version: cinnamon-desktop 6.4.1-1

VGA compatible controller: Intel Corporation CometLake-U GT2 [UHD Graphics] (rev 02)
DeviceName: VGA
Subsystem: ASUSTeK Computer Inc. Device 1fb1
Kernel driver in use: i915
Kernel modules: i915

some kernel modul maybe related:
i2c_algo_bit           20480  1 i915
drm_buddy              24576  1 i915
video                  81920  3 asus_wmi,asus_nb_wmi,i915
wmi                    28672  3 video,asus_wmi,wmi_bmof
ttm                   106496  1 i915
intel_gtt              28672  1 i915
drm_display_helper    270336  1 i915
cec                    94208  2 drm_display_helper,i915

[MartinHaeusler]

This happens for me as well. I'm on Linux Mint. Attaching external monitors via USB-C and closing the laptop lid causes a number of side effects, one of them being that the external monitors still show their full content for a while even though the system is supposed to be on lock screen.

System info below.

System:
  Kernel: 6.8.0-51-generic arch: x86_64 bits: 64 compiler: gcc v: 13.3.0 clocksource: tsc
  Desktop: Cinnamon v: 6.2.9 tk: GTK v: 3.24.41 wm: Muffin v: 6.2.0 vt: 7 dm: LightDM v: 1.30.0
    Distro: Linux Mint 22 Wilma base: Ubuntu 24.04 noble
Machine:
  Type: Laptop System: LENOVO product: 21LSCTO1WW v: ThinkPad T14s Gen 5
    serial: <superuser required> Chassis: type: 10 serial: <superuser required>
  Mobo: LENOVO model: 21LSCTO1WW serial: <superuser required>
    part-nu: LENOVO_MT_21LS_BU_Think_FM_ThinkPad T14s Gen 5 uuid: <superuser required> UEFI: LENOVO
    v: N46ET14W (1.04 ) date: 03/13/2024
Battery:
  ID-1: BAT0 charge: 50.4 Wh (90.8%) condition: 55.5/58.0 Wh (95.7%) power: 17.8 W volts: 12.7
    min: 11.6 model: Sunwoda 5B11H56405 type: Li-poly serial: <filter> status: charging cycles: 13
CPU:
  Info: 12-core (2-mt/10-st) model: Intel Core Ultra 7 165U bits: 64 type: MST AMCP smt: enabled
    arch: Meteor Lake rev: 4 cache: L1: 1.2 MiB L2: 10 MiB L3: 12 MiB
  Speed (MHz): avg: 838 high: 1519 min/max: 400/4900:3800:2100 cores: 1: 1344 2: 400 3: 1333
    4: 400 5: 1496 6: 1519 7: 1440 8: 400 9: 400 10: 400 11: 1400 12: 400 13: 400 14: 400
    bogomips: 75264
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx
Graphics:
  Device-1: Intel Meteor Lake-P [Intel Graphics] vendor: Lenovo driver: i915 v: kernel arch: Gen-13
    ports: active: DP-1,DP-3,eDP-1 empty: DP-2,DP-4,HDMI-A-1 bus-ID: 00:02.0 chip-ID: 8086:7d45
    class-ID: 0300
  Device-2: Logitech HD Pro Webcam C920 driver: snd-usb-audio,uvcvideo type: USB rev: 2.0
    speed: 480 Mb/s lanes: 1 bus-ID: 3-3.2:9 chip-ID: 046d:082d class-ID: 0102 serial: <filter>
  Device-3: Luxvisions Innotech Integrated Camera driver: uvcvideo type: USB rev: 2.0
    speed: 480 Mb/s lanes: 1 bus-ID: 3-9:8 chip-ID: 30c9:00cd class-ID: fe01 serial: <filter>
  Display: x11 server: X.Org v: 21.1.11 with: Xwayland v: 23.2.6 driver: X: loaded: modesetting
    unloaded: fbdev,vesa dri: iris gpu: i915 display-ID: :0 screens: 1
  Screen-1: 0 s-res: 9600x2160 s-dpi: 96 s-size: 2540x572mm (100.00x22.52")
    s-diag: 2604mm (102.5")
  Monitor-1: DP-1 pos: center model: Dell S2722QC serial: <filter> res: 3840x2160 hz: 60 dpi: 163
    size: 597x336mm (23.5x13.23") diag: 685mm (27") modes: max: 3840x2160 min: 720x400
  Monitor-2: DP-3 pos: right model: Dell S2722QC serial: <filter> res: 3840x2160 hz: 60 dpi: 163
    size: 597x336mm (23.5x13.23") diag: 685mm (27") modes: max: 3840x2160 min: 720x400
  Monitor-3: Unknown-1 mapped: None-5-1 note: disabled size-res: N/A modes: 1920x1200
  Monitor-4: eDP-1 pos: primary,left model: ChiMei InnoLux 0x1472 res: 1920x1200 hz: 60 dpi: 162
    size: 301x188mm (11.85x7.4") diag: 355mm (14") modes: 1920x1200
  API: EGL v: 1.5 hw: drv: intel iris platforms: device: 0 drv: iris device: 1 drv: swrast gbm:
    drv: kms_swrast surfaceless: drv: iris x11: drv: iris inactive: wayland
  API: OpenGL v: 4.6 compat-v: 4.5 vendor: intel mesa v: 24.0.9-0ubuntu0.3 glx-v: 1.4
    direct-render: yes renderer: Mesa Intel Graphics (MTL) device-ID: 8086:7d45
Audio:
  Device-1: Intel Meteor Lake-P HD Audio vendor: Lenovo driver: sof-audio-pci-intel-mtl
    bus-ID: 00:1f.3 chip-ID: 8086:7e28 class-ID: 0403
  Device-2: Logitech HD Pro Webcam C920 driver: snd-usb-audio,uvcvideo type: USB rev: 2.0
    speed: 480 Mb/s lanes: 1 bus-ID: 3-3.2:9 chip-ID: 046d:082d class-ID: 0102 serial: <filter>
  API: ALSA v: k6.8.0-51-generic status: kernel-api
  Server-1: PipeWire v: 1.0.5 status: active with: 1: pipewire-pulse status: active
    2: wireplumber status: active 3: pipewire-alsa type: plugin
Network:
  Device-1: Intel Meteor Lake PCH CNVi WiFi driver: iwlwifi v: kernel bus-ID: 00:14.3
    chip-ID: 8086:7e40 class-ID: 0280
  IF: wlp0s20f3 state: up mac: <filter>
  IF-ID-1: br-25281f6c08db state: down mac: <filter>
  IF-ID-2: br-bc33efacf957 state: down mac: <filter>
  IF-ID-3: docker0 state: down mac: <filter>
Bluetooth:
  Device-1: Intel AX211 Bluetooth driver: btusb v: 0.8 type: USB rev: 2.0 speed: 12 Mb/s lanes: 1
    bus-ID: 3-10:10 chip-ID: 8087:0033 class-ID: e001
  Report: hciconfig ID: hci0 rfk-id: 1 state: up address: <filter> bt-v: 5.3 lmp-v: 12
    sub-v: 3a27 hci-v: 12 rev: 3a27 class-ID: 7c010c
Drives:
  Local Storage: total: 953.87 GiB used: 279.77 GiB (29.3%)
  ID-1: /dev/nvme0n1 vendor: Lenovo model: UMIS RPETJ1T24MHP2QDQ size: 953.87 GiB
    speed: 63.2 Gb/s lanes: 4 tech: SSD serial: <filter> fw-rev: 1.0Q0660 temp: 43.9 C scheme: GPT
Partition:
  ID-1: / size: 913.75 GiB used: 279.12 GiB (30.5%) fs: ext4 dev: /dev/dm-1 mapped: vgmint-root
  ID-2: /boot size: 1.61 GiB used: 658.6 MiB (40.0%) fs: ext4 dev: /dev/nvme0n1p2
  ID-3: /boot/efi size: 511 MiB used: 6.1 MiB (1.2%) fs: vfat dev: /dev/nvme0n1p1
Swap:
  ID-1: swap-1 type: partition size: 1.91 GiB used: 0 KiB (0.0%) priority: -2 dev: /dev/dm-2
    mapped: vgmint-swap_1
USB:
  Hub-1: 1-0:1 info: hi-speed hub with single TT ports: 1 rev: 2.0 speed: 480 Mb/s lanes: 1
    chip-ID: 1d6b:0002 class-ID: 0900
  Hub-2: 2-0:1 info: super-speed hub ports: 4 rev: 3.1 speed: 20 Gb/s lanes: 2 chip-ID: 1d6b:0003
    class-ID: 0900
  Hub-3: 2-1:2 info: Realtek Hub ports: 2 rev: 3.2 speed: 5 Gb/s lanes: 1 chip-ID: 0bda:0411
    class-ID: 0900
  Hub-4: 2-3:3 info: Realtek Hub ports: 2 rev: 3.2 speed: 5 Gb/s lanes: 1 chip-ID: 0bda:0411
    class-ID: 0900
  Hub-5: 3-0:1 info: hi-speed hub with single TT ports: 12 rev: 2.0 speed: 480 Mb/s lanes: 1
    chip-ID: 1d6b:0002 class-ID: 0900
  Hub-6: 3-1:2 info: Realtek RTS5411 Hub ports: 4 rev: 2.1 speed: 480 Mb/s lanes: 1
    chip-ID: 0bda:5411 class-ID: 0900
  Device-1: 3-1.1:4 info: Logitech M90/M100 Optical Mouse type: mouse driver: hid-generic,usbhid
    interfaces: 1 rev: 2.0 speed: 1.5 Mb/s lanes: 1 power: 100mA chip-ID: 046d:c05a class-ID: 0301
  Device-2: 3-1.4:6 info: Realtek HID Device type: HID driver: hid-generic,usbhid interfaces: 1
    rev: 2.0 speed: 480 Mb/s lanes: 1 power: 100mA chip-ID: 0bda:1101 class-ID: 0300
  Hub-7: 3-3:3 info: Realtek RTS5411 Hub ports: 4 rev: 2.1 speed: 480 Mb/s lanes: 1
    chip-ID: 0bda:5411 class-ID: 0900
  Device-1: 3-3.1:7 info: Fujitsu Siemens s KB955 USB Keyboard type: keyboard,HID
    driver: hid-generic,usbhid interfaces: 2 rev: 1.1 speed: 1.5 Mb/s lanes: 1 power: 100mA
    chip-ID: 0bf8:102e class-ID: 0300
  Device-2: 3-3.2:9 info: Logitech HD Pro Webcam C920 type: video,audio
    driver: snd-usb-audio,uvcvideo interfaces: 4 rev: 2.0 speed: 480 Mb/s lanes: 1 power: 500mA
    chip-ID: 046d:082d class-ID: 0102 serial: <filter>
  Device-3: 3-3.4:11 info: Realtek HID Device type: HID driver: hid-generic,usbhid interfaces: 1
    rev: 2.0 speed: 480 Mb/s lanes: 1 power: 100mA chip-ID: 0bda:1101 class-ID: 0300
  Device-4: 3-7:5 info: Synaptics type: <vendor specific> driver: N/A interfaces: 1 rev: 2.0
    speed: 12 Mb/s lanes: 1 power: 100mA chip-ID: 06cb:00f9 class-ID: ff00 serial: <filter>
  Device-5: 3-9:8 info: Luxvisions Innotech Integrated Camera type: video driver: uvcvideo
    interfaces: 5 rev: 2.0 speed: 480 Mb/s lanes: 1 power: 500mA chip-ID: 30c9:00cd class-ID: fe01
    serial: <filter>
  Device-6: 3-10:10 info: Intel AX211 Bluetooth type: bluetooth driver: btusb interfaces: 2
    rev: 2.0 speed: 12 Mb/s lanes: 1 power: 100mA chip-ID: 8087:0033 class-ID: e001
  Hub-8: 4-0:1 info: super-speed hub ports: 2 rev: 3.1 speed: 20 Gb/s lanes: 2 chip-ID: 1d6b:0003
    class-ID: 0900
Sensors:
  Src: /sys System Temperatures: cpu: 57.0 C mobo: N/A
  Fan Speeds (rpm): cpu: 3364
  Power: 12v: N/A 5v: 5 3.3v: N/A vbat: N/A
Repos:
  Packages: pm: dpkg pkgs: 2102
  No active apt repos in: /etc/apt/sources.list
  Active apt repos in: /etc/apt/sources.list.d/dockerce.list
    1: deb [arch=amd64 signed-by=/usr/share/keyrings/dockerce.gpg] https: //download.docker.com/linux/ubuntu jammy stable
  Active apt repos in: /etc/apt/sources.list.d/google-chrome.list
    1: deb [arch=amd64] https: //dl.google.com/linux/chrome/deb/ stable main
  Active apt repos in: /etc/apt/sources.list.d/official-package-repositories.list
    1: deb http: //packages.linuxmint.com wilma main upstream import backport
    2: deb http: //archive.ubuntu.com/ubuntu noble main restricted universe multiverse
    3: deb http: //archive.ubuntu.com/ubuntu noble-updates main restricted universe multiverse
    4: deb http: //archive.ubuntu.com/ubuntu noble-backports main restricted universe multiverse
    5: deb http: //security.ubuntu.com/ubuntu/ noble-security main restricted universe multiverse
  Active apt repos in: /etc/apt/sources.list.d/spotify.list
    1: deb http: //repository.spotify.com stable non-free
  Active apt repos in: /etc/apt/sources.list.d/synaptics.list
    1: deb [signed-by=/usr/share/keyrings/synaptics-repository-keyring.gpg] https: //www.synaptics.com/sites/default/files/Ubuntu stable main
    2: deb [signed-by=/usr/share/keyrings/synaptics-repository-keyring.gpg] https: //www.synaptics.com/sites/default/files/Ubuntu stable non-free
  Active apt repos in: /etc/apt/sources.list.d/vscode.list
    1: deb [arch=amd64,arm64,armhf] https: //packages.microsoft.com/repos/code stable main
Info:
  Memory: total: 64 GiB available: 62.39 GiB used: 4.09 GiB (6.5%)
  Processes: 430 Power: uptime: 4m states: freeze,mem,disk suspend: s2idle wakeups: 0
    hibernate: platform Init: systemd v: 255 target: graphical (5) default: graphical
  Compilers: gcc: 13.3.0 Client: Cinnamon v: 6.2.9 inxi: 3.3.34

[Vonsild]

Ditto. The issue is persistant.

I'm on Nixos/Cinnamon. If I put my laptop to sleep without external screens attached, the laptop displays my desktop contents/open documents, until I manage to login. Getting the login prompt to appear on the external screens can sometimes be difficult, so my content is visible to the entire office.

External monitors are connected with hdmi and displayport, not type C, as other users mention.

Not sure what data is relevant, but some hardware info I assume could be related:

00:00.0 Host bridge: Intel Corporation Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor Host Bridge/DRAM Registers (rev 07)
00:01.0 PCI bridge: Intel Corporation 6th-10th Gen Core Processor PCIe Controller (x16) (rev 07)
00:02.0 VGA compatible controller: Intel Corporation HD Graphics 530 (rev 06)
	Subsystem: ASUSTeK Computer Inc. Device 1d6d
	Flags: bus master, fast devsel, latency 0, IRQ 131
	Memory at dd000000 (64-bit, non-prefetchable) [size=16M]
	Memory at b0000000 (64-bit, prefetchable) [size=256M]
	I/O ports at f000 [size=64]
	Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
	Capabilities: [40] Vendor Specific Information: Len=0c <?>
	Capabilities: [70] Express Root Complex Integrated Endpoint, IntMsgNum 0
	Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable- 64bit-
	Capabilities: [d0] Power Management version 2
	Capabilities: [100] Process Address Space ID (PASID)
	Capabilities: [200] Address Translation Service (ATS)
	Capabilities: [300] Page Request Interface (PRI)
	Kernel driver in use: i915
	Kernel modules: i915

00:04.0 Signal processing controller: Intel Corporation Xeon E3-1200 v5/E3-1500 v5/6th Gen Core Processor Thermal Subsystem (rev 07)
00:14.0 USB controller: Intel Corporation 100 Series/C230 Series Chipset Family USB 3.0 xHCI Controller (rev 31)
00:14.2 Signal processing controller: Intel Corporation 100 Series/C230 Series Chipset Family Thermal Subsystem (rev 31)
00:15.0 Signal processing controller: Intel Corporation 100 Series/C230 Series Chipset Family Serial IO I2C Controller #0 (rev 31)
00:15.1 Signal processing controller: Intel Corporation 100 Series/C230 Series Chipset Family Serial IO I2C Controller #1 (rev 31)
00:16.0 Communication controller: Intel Corporation 100 Series/C230 Series Chipset Family MEI Controller #1 (rev 31)
00:17.0 SATA controller: Intel Corporation HM170/QM170 Chipset SATA Controller [AHCI Mode] (rev 31)
00:1c.0 PCI bridge: Intel Corporation 100 Series/C230 Series Chipset Family PCI Express Root Port #3 (rev f1)
00:1c.3 PCI bridge: Intel Corporation 100 Series/C230 Series Chipset Family PCI Express Root Port #4 (rev f1)
00:1f.0 ISA bridge: Intel Corporation HM170 Chipset LPC/eSPI Controller (rev 31)
00:1f.2 Memory controller: Intel Corporation 100 Series/C230 Series Chipset Family Power Management Controller (rev 31)
00:1f.3 Audio device: Intel Corporation 100 Series/C230 Series Chipset Family HD Audio Controller (rev 31)
00:1f.4 SMBus: Intel Corporation 100 Series/C230 Series Chipset Family SMBus (rev 31)
01:00.0 3D controller: NVIDIA Corporation GM107M [GeForce GTX 960M] (rev a2)
	Subsystem: ASUSTeK Computer Inc. Device 1d6d
	Flags: bus master, fast devsel, latency 0, IRQ 132
	Memory at de000000 (32-bit, non-prefetchable) [size=16M]
	Memory at c0000000 (64-bit, prefetchable) [size=256M]
	Memory at d0000000 (64-bit, prefetchable) [size=32M]
	I/O ports at e000 [size=128]
	Expansion ROM at df000000 [virtual] [disabled] [size=512K]
	Capabilities: [60] Power Management version 3
	Capabilities: [68] MSI: Enable+ Count=1/1 Maskable- 64bit+
	Capabilities: [78] Express Endpoint, IntMsgNum 0
	Capabilities: [100] Virtual Channel
	Capabilities: [250] Latency Tolerance Reporting
	Capabilities: [258] L1 PM Substates
	Capabilities: [128] Power Budgeting <?>
	Capabilities: [600] Vendor Specific Information: ID=0001 Rev=1 Len=024 <?>
	Capabilities: [900] Secondary PCI Express
	Kernel driver in use: nvidia
	Kernel modules: nvidiafb, nouveau, nvidia_drm, nvidia

02:00.0 Network controller: Intel Corporation Wireless 8260 (rev 3a)
03:00.0 Unassigned class [ff00]: Realtek Semiconductor Co., Ltd. RTL8411B PCI Express Card Reader (rev 01)
03:00.1 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8211/8411 PCI Express Gigabit Ethernet Controller (rev 12)

[q6276270]

I tested this some months ago as well. I've even tested inputting text into a texteditor opened and focused in the background. Not only content is exposed but interaction is possible while the programs readjusts for change screen connection or resolution.