518433 2026-04-02 11:00:31 +0000 Dolphin crashed in KConfig::sync when exiting 2026-04-26 10:53:07 +0000 1 1 2 Applications dolphin general 25.04.3 Debian stable Linux RESOLVED FIXED NOR crash --- 1 gwdx dolphin-bugs-null dolphin-bugs-null https://invent.kde.org/system/dolphin/-/commit/2dce7352c1edfb13c90a8a3b858d113e3a9300b2 0 oldest_to_newest 2507614 0 gwdx 2026-04-02 11:00:31 +0000 SUMMARY Dolphin crashed in the KConfig::sync function when the application exits during a system reboot. This crash occurred only once and I am unable to reproduce it. SOFTWARE/OS VERSIONS Linux: Debian GNU/Linux 13 KDE Plasma Version: 6.3.6 KDE Frameworks Version: 6.13.0 Qt Version: 6.8.2 ADDITIONAL INFORMATION The stack is a bit similar to https://bugs.kde.org/show_bug.cgi?id=516481 pwndbg> threads global_num name status pc symbol ------------ ------ -------- -------------- --------------------------------- 1 stopped 0x7f223bea095c __pthread_kill_implementation+268 12 stopped 0x7f223bea69ee __syscall_cancel_arch+46 11 stopped 0x7f223bea69ee __syscall_cancel_arch+46 10 stopped 0x7f223bea69ee __syscall_cancel_arch+46 9 stopped 0x7f223bea69ee __syscall_cancel_arch+46 4 stopped 0x7f223bea69ee __syscall_cancel_arch+46 13 stopped 0x7f223bea69ee __syscall_cancel_arch+46 6 stopped 0x7f223bea69ee __syscall_cancel_arch+46 7 stopped 0x7f223bea69ee __syscall_cancel_arch+46 14 stopped 0x7f223bea69ee __syscall_cancel_arch+46 17 stopped 0x7f223bea69ee __syscall_cancel_arch+46 5 stopped 0x7f223bea69ee __syscall_cancel_arch+46 3 stopped 0x7f223bea69ee __syscall_cancel_arch+46 8 stopped 0x7f223bea69ee __syscall_cancel_arch+46 2 stopped 0x7f223bf0b6c7 access+7 15 stopped 0x7f223bea69ee __syscall_cancel_arch+46 18 stopped 0x7f223bea69ee __syscall_cancel_arch+46 16 stopped 0x7f223bea69ee __syscall_cancel_arch+46 19 stopped 0x7f223bea69ee __syscall_cancel_arch+46 pwndbg> bt #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 #1 0x00007f223bea09ff in __pthread_kill_internal (threadid=<optimized out>, signo=11) at ./nptl/pthread_kill.c:89 #2 0x00007f223be4bcc2 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26 #3 0x00007f223e7346e2 in KCrash::defaultCrashHandler(int) () at /lib/x86_64-linux-gnu/libKF6Crash.so.6 #4 0x00007f223be4bdf0 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6 #5 std::local_Rb_tree_increment (__x=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:71 #6 std::local_Rb_tree_increment (__x=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:60 #7 std::_Rb_tree_increment (__x=__x@entry=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:85 #8 0x00007f223ddadc05 in std::_Rb_tree_iterator<std::pair<KEntryKey const, KEntry> >::operator++ (this=<synthetic pointer>) at /usr/include/c++/14/bits/stl_tree.h:281 #9 KConfig::sync (this=0x56127af96e10) at ./src/core/kconfig.cpp:437 #10 0x000056123b4eaf0a in operator() (__closure=<synthetic pointer>) at ./src/dolphinmainwindow.cpp:764 #11 std::__invoke_impl<void, DolphinMainWindow::slotSaveSession()::<lambda()>&> (__f=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:61 #12 std::__invoke<DolphinMainWindow::slotSaveSession()::<lambda()>&> (__fn=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:96 #13 std::invoke<DolphinMainWindow::slotSaveSession()::<lambda()>&> (__fn=<synthetic pointer>...) at /usr/include/c++/14/functional:120 #14 operator() (__closure=<synthetic pointer>, function=...) at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentstoredfunctioncall.h:116 #15 std::__invoke_impl<void, const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, DolphinMainWindow::slotSaveSession()::<lambda()> > (__f=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:61 #16 std::__invoke<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, DolphinMainWindow::slotSaveSession()::<lambda()> > (__fn=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:96 #17 std::__apply_impl<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, std::tuple<DolphinMainWindow::slotSaveSession()::<lambda()> >, 0> (__f=<synthetic pointer>..., __t=...) at /usr/include/c++/14/tuple:2923 #18 std::apply<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, std::tuple<DolphinMainWindow::slotSaveSession()::<lambda()> > > (__f=<synthetic pointer>..., __t=...) at /usr/include/c++/14/tuple:2938 #19 QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor (this=0x56127a390460) at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentstoredfunctioncall.h:120 #20 QtConcurrent::RunFunctionTaskBase<void>::run (this=0x56127a390460) at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentrunbase.h:83 #21 0x00007f223c6e2a5d in QThreadPoolThread::run (this=0x56127b0b8690) at ./src/corelib/thread/qthreadpool.cpp:71 #22 0x00007f223c6e11ea in operator() (__closure=<optimized out>) at ./src/corelib/thread/qthread_unix.cpp:375 #23 (anonymous namespace)::terminate_on_exception<QThreadPrivate::start(void*)::<lambda()> > (t=<optimized out>) at ./src/corelib/thread/qthread_unix.cpp:311 #24 QThreadPrivate::start (arg=0x56127b0b8690) at ./src/corelib/thread/qthread_unix.cpp:339 #25 0x00007f223be9eb7b in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448 #26 0x00007f223bf1c7f8 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 pwndbg> t 2 [Switching to thread 2 (Thread 0x7f2234a80280 (LWP 3357969))] #0 __GI___access (file=0x561279688ff0 "/home/gwd/.config/session/dolphin_106777640000177484819700000054631367_1774848230_54645", type=0) at ../sysdeps/unix/sysv/linux/access.c:27 warning: 27 ../sysdeps/unix/sysv/linux/access.c: 没有那个文件或目录 pwndbg> bt #0 __GI___access (file=0x561279688ff0 "/home/gwd/.config/session/dolphin_106777640000177484819700000054631367_1774848230_54645", type=0) at ../sysdeps/unix/sysv/linux/access.c:27 #1 0x00007f223c6d35d3 in QFileSystemEngine::fillMetaData (entry=..., data=..., what=...) at ./src/corelib/io/qfilesystemengine_unix.cpp:972 #2 0x00007f223c551414 in QFileInfo::exists (this=<optimized out>) at ./src/corelib/io/qfileinfo.cpp:727 #3 0x00007f223c57590d in QSaveFile::open (this=this@entry=0x7fff2ecaa450, mode=..., mode@entry=...) at ./src/corelib/io/qsavefile.cpp:179 #4 0x00007f223ddc31b2 in KConfigIniBackend::writeConfig (this=0x56127b0657a0, locale=<optimized out>, entryMap=<optimized out>, options=...) at /usr/include/x86_64-linux-gnu/qt6/QtCore/qflags.h:74 #5 0x00007f223ddae0f5 in KConfig::sync (this=0x561279340d10) at ./src/core/kconfig.cpp:478 #6 0x00007f223e4aab15 in ??? () at /lib/x86_64-linux-gnu/libKF6XmlGui.so.6 #7 0x00007f223c5e4443 in QtPrivate::QSlotObjectBase::call (this=<optimized out>, r=0x7f223e52c980, a=0x7fff2ecaa8d0, this=<optimized out>, r=<optimized out>, a=<optimized out>) at ./src/corelib/kernel/qobjectdefs_impl.h:486 #8 doActivate<false> (sender=0x7fff2ecab5d0, signal_index=18, argv=0x7fff2ecaa8d0) at ./src/corelib/kernel/qobject.cpp:4115 #9 0x00007f223cbe4329 in QGuiApplication::saveStateRequest(QSessionManager&) () at /lib/x86_64-linux-gnu/libQt6Gui.so.6 #10 0x00007f223cbe50af in QGuiApplicationPrivate::saveState() () at /lib/x86_64-linux-gnu/libQt6Gui.so.6 #11 0x00007f223430eda8 in ??? () at /lib/x86_64-linux-gnu/libQt6XcbQpa.so.6 #12 0x00007f223430ef47 in ??? () at /lib/x86_64-linux-gnu/libQt6XcbQpa.so.6 #13 0x00007f2234a36c73 in _SmcProcessMessage () at /lib/x86_64-linux-gnu/libSM.so.6 #14 0x00007f22342850a5 in IceProcessMessages () at /lib/x86_64-linux-gnu/libICE.so.6 #15 0x00007f223c5e46e8 in doActivate<false> (sender=0x56127924c670, signal_index=3, argv=0x7fff2ecab0d0) at ./src/corelib/kernel/qobject.cpp:4127 #16 0x00007f223c5e6db3 in QSocketNotifier::activated (this=this@entry=0x56127924c670, _t1=..., _t2=<optimized out>, _t3=...) at ./obj-x86_64-linux-gnu/src/corelib/Core_autogen/include/moc_qsocketnotifier.cpp:198 #17 0x00007f223c5e98fb in QSocketNotifier::event (this=0x56127924c670, e=<optimized out>) at ./src/corelib/kernel/qsocketnotifier.cpp:327 #18 0x00007f223d5b49b5 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt6Widgets.so.6 #19 0x00007f223c5965b0 in QCoreApplication::notifyInternal2 (receiver=0x56127924c670, event=0x7fff2ecab210) at ./src/corelib/kernel/qcoreapplication.cpp:1172 #20 0x00007f223c7ae5ef in socketNotifierSourceDispatch (source=0x56127916d160) at ./src/corelib/kernel/qeventdispatcher_glib.cpp:77 #21 0x00007f2239459385 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #22 0x00007f223945b5b7 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #23 0x00007f223945bd20 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0 #24 0x00007f223c7a6323 in QEventDispatcherGlib::processEvents (this=0x5612791834d0, flags=...) at ./src/corelib/kernel/qeventdispatcher_glib.cpp:399 #25 0x00007f223c598893 in QEventLoop::exec (this=this@entry=0x7fff2ecab4b0, flags=..., flags@entry=...) at ./src/corelib/global/qflags.h:34 #26 0x00007f223c59a18a in QCoreApplication::exec () at ./src/corelib/global/qflags.h:74 #27 0x000056123b4c7c7b in main (argc=<optimized out>, argc@entry=4, argv=argv@entry=0x7fff2ecab898) at ./src/main.cpp:273 #28 0x00007f223be35ca8 in __libc_start_call_main (main=main@entry=0x56123b4c5ba0 <main(int, char**)>, argc=argc@entry=4, argv=argv@entry=0x7fff2ecab898) at ../sysdeps/nptl/libc_start_call_main.h:58 #29 0x00007f223be35d65 in __libc_start_main_impl (main=0x56123b4c5ba0 <main(int, char**)>, argc=4, argv=0x7fff2ecab898, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff2ecab888) at ../csu/libc-start.c:360 #30 0x000056123b4c8581 in _start () 2507627 1 bug-janitor 2026-04-02 12:30:35 +0000 A possibly relevant merge request was started @ https://invent.kde.org/system/dolphin/-/merge_requests/1238 2512182 2 meven 2026-04-26 10:53:07 +0000 Git commit 2dce7352c1edfb13c90a8a3b858d113e3a9300b2 by Méven Car, on behalf of Wendi Gan. Committed on 26/04/2026 at 09:42. Pushed by meven into branch 'master'. Fix occasional UAF crashes in KConfig::sync() during exit Previously, c035e95 introduced `QtConcurrent::run` to execute `KConfig::sync()` in a separate thread. However, this introduced thread-safety issue: BUG 518433 (UAF caused by RC): During application exit, the main thread frees the old `s_sessionConfig` in `KMWSessionManager::saveState()` to create a new one. Meanwhile, the worker thread is still iterating over the old instance's entryMap during `KConfig::sync()`, leading to a Use-After-Free (UAF) crash. Changes: Copy the `config` in the main thread so `KConfig::sync()` can safely run in the worker. Related: bug 516481, bug 425627 M +5 -2 src/dolphinmainwindow.cpp https://invent.kde.org/system/dolphin/-/commit/2dce7352c1edfb13c90a8a3b858d113e3a9300b2