Bug 411730

Created attachment 122548 [details]
Full trace of all threads of powerdevil segmentation fault when logging out of Plasma on Wayland

SUMMARY

I've seen segmentation faults in powerdevil 5.16.4 about 15 times while logging out of Plasma on Wayland in Fedora 31. drkonqi aborted in most cases when trying to process the segmentation faults with command lines like
Command Line: /usr/libexec/drkonqi -platform wayland --appname org_kde_powerdevil --apppath /usr/libexec --signal 11 --pid 1441 --appversion 2.0.0 --programname KDE Power Management System --bugaddress submit@bugs.kde.org --startupid 0 --restarted

powerdevil aborted when trying to restart because the connection to the Wayland compositor had been broken. These crashes have occurred most times I've logged out of Plasma on Wayland. An example of a trace of the segmentation fault of powerdevil using coredumpctl gdb showed that occurred in frame #13 in g_main_context_prepare at ../glib/gmain.c:3530 in glib2-2.61.3-1.fc31.x86_64. kcrash then had a segmentation fault in __strcmp_sse2_unaligned at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31 in glibc-2.30-4.fc31.x86_64 when handling the powerdevil segmentation fault.

Core was generated by `/usr/libexec/org_kde_powerdevil'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __strcmp_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
31              movdqu  (%rdi), %xmm1
[Current thread is 1 (Thread 0x7f77f5549700 (LWP 1578))]

(gdb) bt
#0  __strcmp_sse2_unaligned () at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
#1  0x00007f7808603251 in _nl_make_l10nflist
    (l10nfile_list=l10nfile_list@entry=0x7f780878e738 <_nl_loaded_domains>, dirlist=dirlist@entry=0x7f780875e6f0 <_nl_default_dirname> "/usr/share/locale", dirlist_len=18, mask=mask@entry=0, language=language@entry=0x7f77f5544c60 "en_CA.UTF-8", territory=territory@entry=0x0, codeset=0x0, normalized_codeset=0x0, modifier=0x0, filename=0x7f77f5544c80 "LC_MESSAGES/libc.mo", do_allocate=0)
    at ../intl/l10nflist.c:221
#2  0x00007f7808600fa7 in _nl_find_domain
    (dirname=dirname@entry=0x7f780875e6f0 <_nl_default_dirname> "/usr/share/locale", locale=locale@entry=0x7f77f5544c60 "en_CA.UTF-8", domainname=domainname@entry=0x7f77f5544c80 "LC_MESSAGES/libc.mo", domainbinding=domainbinding@entry=0x0) at finddomain.c:90
#3  0x00007f78086008b5 in __dcigettext
    (domainname=<optimized out>, msgid1=<optimized out>, msgid2=msgid2@entry=0x0, plural=plural@entry=0, n=n@entry=0, category=category@entry=5) at dcigettext.c:703
#4  0x00007f78085ff4c3 in __GI___dcgettext
    (domainname=<optimized out>, msgid=<optimized out>, category=category@entry=5) at dcgettext.c:47
#5  0x00007f780865a092 in __GI___strerror_r
    (errnum=2, buf=buf@entry=0x7f77f5544e10 "", buflen=buflen@entry=1024) at _strerror.c:71
#6  0x00007f78086223c5 in perror_internal
    (fp=0x7f780878d420 <_IO_2_1_stderr_>, s=0x7f7809d9103c "Warning: connect() failed: ", errnum=<optimized out>) at perror.c:37
#7  0x00007f7809d8e4c6 in openSocket ()
    at /usr/src/debug/kf5-kcrash-5.61.0-1.fc31.x86_64/src/kcrash.cpp:862
#8  startFromKdeinit(int, char const**) (argc=argc@entry=20, argv=argv@entry=0x7f77f5548420)
    at /usr/src/debug/kf5-kcrash-5.61.0-1.fc31.x86_64/src/kcrash.cpp:712
--Type <RET> for more, q to quit, c to continue without paging--c
#9  0x00007f7809d8e84d in startProcessInternal(int, char const**, bool, bool) (argc=argc@entry=20, argv=argv@entry=0x7f77f5548420, waitAndExit=waitAndExit@entry=true, directly=directly@entry=false) at /usr/src/debug/kf5-kcrash-5.61.0-1.fc31.x86_64/src/kcrash.cpp:651
#10 0x00007f7809d8f395 in KCrash::startProcess(int, char const**, bool) (argc=argc@entry=20, argv=argv@entry=0x7f77f5548420, waitAndExit=waitAndExit@entry=true) at /usr/src/debug/kf5-kcrash-5.61.0-1.fc31.x86_64/src/kcrash.cpp:637
#11 0x00007f7809d8f847 in KCrash::defaultCrashHandler(int) (sig=11) at /usr/src/debug/kf5-kcrash-5.61.0-1.fc31.x86_64/src/kcrash.cpp:535
#12 0x00007f78086066b0 in <signal handler called> () at /lib64/libc.so.6
#13 0x00007f780720ad50 in g_main_context_prepare (context=context@entry=0x7f77e0000c30, priority=priority@entry=0x7f77f5548be0) at ../glib/gmain.c:3530
#14 0x00007f780720b6cb in g_main_context_iterate (context=context@entry=0x7f77e0000c30, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3897
#15 0x00007f780720b8d3 in g_main_context_iteration (context=0x7f77e0000c30, may_block=may_block@entry=1) at ../glib/gmain.c:3978
#16 0x00007f7808c53bb5 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x7f77e0000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#17 0x00007f7808bfd9db in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7f77f5548d20, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:140
#18 0x00007f7808a56625 in QThread::exec() (this=<optimized out>) at ../../include/QtCore/../../src/corelib/global/qflags.h:120
#19 0x00007f7808a57776 in QThreadPrivate::start(void*) (arg=0x56410973dae0) at thread/qthread_unix.cpp:361
#20 0x00007f7807c9b4e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#21 0x00007f78086cb643 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The screen remained black after this logout. I pressed sysrq+alt+r, sysrq+alt+e,
sysrq+alt+i to get sddm to show up again. The black screen occurred less often than the powerdevil crashes when logging out of Plasma 5.16.x on Wayland. I'll attach the full trace of all threads.

STEPS TO REPRODUCE
1. Boot Fedora 31 KDE Plasma spin fully updated with updates-testing enabled
2. Log in to Plasma on Wayland from sddm
3. Log out of Plasma

OBSERVED RESULT
powerdevil 5.16.4 segmentation faults and aborts when restarting while logging out of Plasma on Wayland

EXPECTED RESULT
No crashes


SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Fedora 31
(available in About System)
KDE Plasma Version: 5.16.4
KDE Frameworks Version: 5.61.0
Qt Version: 5.12.4

glib2-0:2.61.3-1.fc31.x86_64
glibc-0:2.30-4.fc31.x86_64
kernel-0:5.3.0-0.rc7.git0.1.fc31.x86_64
kf5-kwayland-0:5.61.0-1.fc31.x86_64
libwayland-client-0:1.17.0-2.fc31.x86_64
powerdevil-0:5.16.4-1.fc31.x86_64
qt5-qtwayland-0:5.12.4-7.fc31.x86_64

ADDITIONAL INFORMATION

I saw segmentation faults of powerdevil 5.15.5 when logging out of Plasma on Wayland in Fedora 30 which I reported at https://bugs.kde.org/show_bug.cgi?id=408553 The traces were different with Plasma 5.15.5 which is why I've made another report. The underlying invalid reads and writes which were use-after-free errors involving libwayland-client and kwayland I reported in #408553 might be involved.