Bug 475636

Created attachment 162313 [details]
Full trace of all threads of the third System Monitor crash

SUMMARY

I was using GNOME 45.0 on Wayland in a Fedora 39 KDE Plasma installation. I clicked on the button at top left of the screen. I entered monitor in the search bar and clicked on Plasma System Monitor. System Monitor crashed sometimes when starting in GNOME with the error "stack smashing detected" in the journal and the trace. This problem happened three times each of which were on the first time I ran System Monitor in different GNOME sessions. System Monitor briefly appeared and then crashed. System Monitor ran normally on subsequent times I ran it in the same GNOME session. drkonqi didn't appear the first two crashes. I removed plasma-drkonqi and reproduced the crash a third time so that the core dump would be saved. coredumpctl gdb showed that System Monitor aborted with the "stack smashing detected" error shown in __GI___fortify_fail in frame 5.

Core was generated by `/usr/bin/plasma-systemmonitor'.
Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, 
    no_tid=no_tid@entry=0) at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
[Current thread is 1 (Thread 0x7f27ed48ba00 (LWP 49125))]
(gdb) bt
#0  __pthread_kill_implementation
    (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007f27eb8aa8a3 in __pthread_kill_internal (signo=6, threadid=<optimized out>)
    at pthread_kill.c:78
#2  0x00007f27eb8588ee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f27eb8408ff in __GI_abort () at abort.c:79
#4  0x00007f27eb8417d0 in __libc_message (fmt=fmt@entry=0x7f27eb9be309 "*** %s ***: terminated\n")
    at ../sysdeps/posix/libc_fatal.c:150
#5  0x00007f27eb93dcd9 in __GI___fortify_fail
    (msg=msg@entry=0x7f27eb9be321 "stack smashing detected") at fortify_fail.c:24
#6  0x00007f27eb93ef64 in __stack_chk_fail () at stack_chk_fail.c:24
#7  0x00007f27ed7c463b in loadProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const&)
    (v4=0x55c03f8eba30, object=<optimized out>, property=<optimized out>)
    at jsruntime/qv4qobjectwrapper.cpp:207
#8  0x00007f27ed7c5525 in QV4::QObjectWrapper::virtualResolveLookupGetter(QV4::Object const*, QV4::ExecutionEngine*, QV4::Lookup*) (object=0x7f27d02d35c0, engine=0x55c03f8eba30, lookup=0x55c0409f0d10)
    at jsruntime/qv4qobjectwrapper.cpp:880
#9  0x00007f27ed7e5b0a in QV4::Moth::VME::interpret(QV4::CppStackFrame*, QV4::ExecutionEngine*, char const*) (frame=0xbfe5, frame@entry=0x7ffd40e123d0, engine=0x55c03f8eba30, code=0x7f277e9e2e2e "")
    at jsruntime/qv4vme_moth.cpp:641
#10 0x00007f27ed7ea59f in QV4::Moth::VME::exec(QV4::CppStackFrame*, QV4::ExecutionEngine*)
    (frame=frame@entry=0x7ffd40e123d0, engine=engine@entry=0x55c03f8eba30)
    at jsruntime/qv4vme_moth.cpp:466
--Type <RET> for more, q to quit, c to continue without paging--c
#11 0x00007f27ed77a512 in QV4::Function::call(QV4::Value const*, QV4::Value const*, int, QV4::ExecutionContext const*)
    (this=this@entry=0x55c0408e3df0, thisObject=<optimized out>, argv=argv@entry=0x7f27d02d35b0, argc=<optimized out>, context=<optimized out>) at jsruntime/qv4function.cpp:69
#12 0x00007f27ed910760 in QQmlJavaScriptExpression::evaluate(QV4::CallData*, bool*)
    (this=this@entry=0x55c0409f1ff0, callData=0x7f27d02d3580, isUndefined=isUndefined@entry=0x7ffd40e125bf) at qml/qqmljavascriptexpression.cpp:212
#13 0x00007f27ed916ee7 in QQmlBinding::evaluate(bool*)
    (this=this@entry=0x55c0409f1ff0, isUndefined=isUndefined@entry=0x7ffd40e125bf)
    at ../../include/QtQml/5.15.10/QtQml/private/../../../../../src/qml/jsruntime/qv4jscall_p.h:95
#14 0x00007f27ed91b49b in QQmlNonbindingBinding::doUpdate(QQmlJavaScriptExpression::DeleteWatcher const&, QFlags<QQmlPropertyData::WriteFlag>, QV4::Scope&)
    (this=0x55c0409f1ff0, watcher=..., flags=..., scope=...) at qml/qqmlbinding.cpp:254
#15 0x00007f27ed918d35 in QQmlBinding::update(QFlags<QQmlPropertyData::WriteFlag>)
    (this=0x55c0409f1ff0, flags=...) at qml/qqmlbinding.cpp:194
#16 0x00007f27ed8f4527 in QQmlNotifier::emitNotify(QQmlNotifierEndpoint*, void**)
    (endpoint=<optimized out>, a=0x0) at qml/qqmlnotifier.cpp:104
#17 0x00007f27ec0e81c0 in doActivate<false>(QObject*, int, void**)
    (sender=0x55c0409f1910, signal_index=15, argv=0x0) at kernel/qobject.cpp:3817
#18 0x00007f27ec0e3417 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=sender@entry=0x55c0409f1910, m=m@entry=0x7f27b238e320 <QQuickItem::staticMetaObject>, local_signal_index=local_signal_index@entry=12, argv=argv@entry=0x0) at kernel/qobject.cpp:3985
#19 0x00007f27b2085e47 in QQuickItem::childrenChanged() (this=this@entry=0x55c0409f1910)
    at .moc/moc_qquickitem.cpp:1152
#20 0x00007f27b209bf0b in QQuickItemPrivate::addChild(QQuickItem*)
    (this=0x55c0409f19e0, child=<optimized out>, child@entry=0x55c0409fa640)
    at items/qquickitem.cpp:2945
#21 0x00007f27b209de70 in QQuickItem::setParentItem(QQuickItem*)
    (this=this@entry=0x55c0409fa640, parentItem=<optimized out>) at items/qquickitem.h:468
#22 0x00007f27b21adbf6 in QQuickRepeater::initItem(int, QObject*)
    (this=0x55c0409f2080, index=0, object=<optimized out>) at items/qquickrepeater.cpp:441
#23 0x00007f27b21ae6a2 in QQuickRepeater::qt_metacall(QMetaObject::Call, int, void**)
    (this=0x55c0409f2080, _c=QMetaObject::InvokeMetaMethod, _id=6, _a=0x7ffd40e14310)
    at .moc/moc_qquickrepeater_p.cpp:267
#24 0x00007f27ec0e83bf in doActivate<false>(QObject*, int, void**)
    (sender=0x55c0409f2620, signal_index=6, argv=0x7ffd40e14310) at kernel/qobject.cpp:3951
#25 0x00007f27ec0e3417 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=<optimized out>, m=m@entry=0x7f27d0094b80 <QQmlInstanceModel::staticMetaObject>, local_signal_index=local_signal_index@entry=3, argv=argv@entry=0x7ffd40e14310) at kernel/qobject.cpp:3985
#26 0x00007f27d0035409 in QQmlInstanceModel::initItem(int, QObject*)
    (this=<optimized out>, _t1=<optimized out>, _t2=<optimized out>)
    at .moc/moc_qqmlobjectmodel_p.cpp:277
#27 0x00007f27ed8b8fd5 in QQmlIncubatorPrivate::incubate(QQmlInstantiationInterrupt&)
    (this=this@entry=0x55c03fd75320, i=...) at qml/qqmlincubator.cpp:332
#28 0x00007f27ed8b9210 in QQmlEnginePrivate::incubate(QQmlIncubator&, QQmlContextData*)
    (this=0x55c03f7f1c90, i=<optimized out>, forContext=<optimized out>) at qml/qqmlincubator.cpp:89
#29 0x00007f27d00640c0 in QQmlDelegateModelPrivate::object(QQmlListCompositor::Group, int, QQmlIncubator::IncubationMode)
    (this=0x55c040985ac0, group=QQmlListCompositor::Default, index=0, incubationMode=<optimized out>)
    at qqmldelegatemodel.cpp:1324
#30 0x00007f27b21ab1d0 in QQuickRepeaterPrivate::requestItems() (this=0x55c03ff1be80)
    at items/qquickrepeater.cpp:403
#31 0x00007f27b21ae4bc in QQuickRepeater::componentComplete() (this=0x55c0409f2080)
    at items/qquickrepeater.cpp:347
#32 0x00007f27ed926d5b in QQmlObjectCreator::finalize(QQmlInstantiationInterrupt&)
    (this=0x55c040902ed0, interrupt=...) at qml/qqmlobjectcreator.cpp:1413
#33 0x00007f27ed8b23c7 in QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*) (state=0x55c03fd768f8, enginePriv=0x55c03f7f1c90)
    at /usr/include/qt5/QtCore/qscopedpointer.h:116
#34 QQmlComponentPrivate::complete(QQmlEnginePrivate*, QQmlComponentPrivate::ConstructionState*)
    (enginePriv=0x55c03f7f1c90, state=0x55c03fd768f8) at qml/qqmlcomponent.cpp:996
#35 0x00007f27ed8b43c9 in QQmlComponentPrivate::completeCreate() (this=0x55c03fd76870)
    at qml/qqmlcomponent.cpp:1092
#36 0x00007f27b16bbc3e in KSysGuard::SensorFaceControllerPrivate::createGui(QString const&)
    (this=this@entry=0x55c03ffd87a0, qmlPath=...)
    at /usr/src/debug/libksysguard-5.27.8-1.fc39.x86_64/faces/SensorFaceController.cpp:330
#37 0x00007f27b16bc359 in KSysGuard::SensorFaceController::fullRepresentation() (this=0x55c0408ed150)
    at /usr/src/debug/libksysguard-5.27.8-1.fc39.x86_64/faces/SensorFaceController.cpp:743
#38 KSysGuard::SensorFaceController::fullRepresentation() (this=0x55c0408ed150)
    at /usr/src/debug/libksysguard-5.27.8-1.fc39.x86_64/faces/SensorFaceController.cpp:735
#39 0x00007f27b16bf906 in KSysGuard::SensorFaceController::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)
    (_o=_o@entry=0x55c0408ed150, _c=_c@entry=QMetaObject::ReadProperty, _id=_id@entry=15, _a=_a@entry=0x7ffd40e14a10)
    at /usr/src/debug/libksysguard-5.27.8-1.fc39.x86_64/redhat-linux-build/faces/SensorFaces_autogen/include/moc_SensorFaceController.cpp:375
#40 0x00007f27b16bfc12 in KSysGuard::SensorFaceController::qt_metacall(QMetaObject::Call, int, void**) (this=0x55c0408ed150, _c=QMetaObject::ReadProperty, _id=15, _a=0x7ffd40e14a10)
    at /usr/src/debug/libksysguard-5.27.8-1.fc39.x86_64/redhat-linux-build/faces/SensorFaces_autogen/include/moc_SensorFaceController.cpp:447
#41 0x00007f27ed7c40fc in QQmlPropertyData::readProperty(QObject*, void*) const
    (property=0x7ffd40e149f0, target=<optimized out>, this=0x55c04025cb88)
    at ../../include/QtQml/5.15.10/QtQml/private/../../../../../src/qml/qml/qqmlpropertydata_p.h:373
#42 loadProperty(QV4::ExecutionEngine*, QObject*, QQmlPropertyData const&)
    (v4=0x55c03f8eba30, object=0x55c0408ed150, property=...) at jsruntime/qv4qobjectwrapper.cpp:138
#43 0x00007f278c05a935 in  ()
#44 0x0000000000000000 in  ()

The problem might be in Qt since frames 7 to 35 looked to be in Qt functions. I'm attaching the full trace of all threads. 

The journal during the first System Monitor crash had some other errors involving the radeonsi and amdgpu drivers. There were some errors like "plasma-systemmonitor[28200]: kf.service.sycoca: Invalid Service :  "/usr/share/applications/org.freedesktop.Xwayland.desktop"" before the crash. Those radeonsi and amdgpu errors weren't shown in the second and third crashes.

STEPS TO REPRODUCE
1. Boot a Fedora 39 KDE Plasma installation with the GNOME desktop enviroment installed
2. Log in to GNOME 45.0 on Wayland from sddm
3. Click on the button at the top left of the screen to show the search bar
4. Enter monitor in the search bar
5. Click on Plasma System Monitor in the search results to start it

OBSERVED RESULT
System Monitor crashed sometimes when starting in GNOME with the error "stack smashing detected"

EXPECTED RESULT
System Monitor should've started normally in GNOME

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Fedora 39
(available in About System)
KDE Plasma Version: 5.27.8
KDE Frameworks Version:  5.110.0
Qt Version: 5.15.10

ADDITIONAL INFORMATION
I didn't see this problem when running System Monitor in Plasma 5.27.8 on Wayland. The stack smashing detected error might be due to a stack buffer overflow being detected. This error might've been detected by the glibc _FORTIFY_SOURCE=3 option used in the build flags in Fedora 38 and later https://fedoraproject.org/wiki/Changes/Add_FORTIFY_SOURCE%3D3_to_distribution_build_flags or by the strong stack protector used by gcc.