Bug 518433

Summary: Dolphin crashed in KConfig::sync when exiting
Product: [Applications] dolphin Reporter: gwdx
Component: generalAssignee: Dolphin Bug Assignee <dolphin-bugs-null>
Status: RESOLVED FIXED    
Severity: crash CC: dolphin-bugs-null
Priority: NOR    
Version First Reported In: 25.04.3   
Target Milestone: ---   
Platform: Debian stable   
OS: Linux   
Latest Commit: https://invent.kde.org/system/dolphin/-/commit/2dce7352c1edfb13c90a8a3b858d113e3a9300b2 Version Fixed/Implemented In:
Sentry Crash Report:

Description gwdx 2026-04-02 11:00:31 UTC 
SUMMARY
Dolphin crashed in the KConfig::sync function when the application exits during a system reboot.
This crash occurred only once and I am unable to reproduce it.


SOFTWARE/OS VERSIONS
Linux: Debian GNU/Linux 13
KDE Plasma Version: 6.3.6
KDE Frameworks Version: 6.13.0
Qt Version: 6.8.2


ADDITIONAL INFORMATION
The stack is a bit similar to https://bugs.kde.org/show_bug.cgi?id=516481


pwndbg> threads
  global_num  name    status    pc              symbol
------------  ------  --------  --------------  ---------------------------------
           1          stopped   0x7f223bea095c  __pthread_kill_implementation+268
          12          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          11          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          10          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           9          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           4          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          13          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           6          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           7          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          14          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          17          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           5          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           3          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           8          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
           2          stopped   0x7f223bf0b6c7  access+7
          15          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          18          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          16          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
          19          stopped   0x7f223bea69ee  __syscall_cancel_arch+46
pwndbg> bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007f223bea09ff in __pthread_kill_internal (threadid=<optimized out>, signo=11) at ./nptl/pthread_kill.c:89
#2  0x00007f223be4bcc2 in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3  0x00007f223e7346e2 in KCrash::defaultCrashHandler(int) () at /lib/x86_64-linux-gnu/libKF6Crash.so.6
#4  0x00007f223be4bdf0 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6
#5  std::local_Rb_tree_increment (__x=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:71
#6  std::local_Rb_tree_increment (__x=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:60
#7  std::_Rb_tree_increment (__x=__x@entry=0x5612795e7e10) at ../../../../../src/libstdc++-v3/src/c++98/tree.cc:85
#8  0x00007f223ddadc05 in std::_Rb_tree_iterator<std::pair<KEntryKey const, KEntry> >::operator++ (this=<synthetic pointer>)
    at /usr/include/c++/14/bits/stl_tree.h:281
#9  KConfig::sync (this=0x56127af96e10) at ./src/core/kconfig.cpp:437
#10 0x000056123b4eaf0a in operator() (__closure=<synthetic pointer>) at ./src/dolphinmainwindow.cpp:764
#11 std::__invoke_impl<void, DolphinMainWindow::slotSaveSession()::<lambda()>&> (__f=<synthetic pointer>...)
    at /usr/include/c++/14/bits/invoke.h:61
#12 std::__invoke<DolphinMainWindow::slotSaveSession()::<lambda()>&> (__fn=<synthetic pointer>...)
    at /usr/include/c++/14/bits/invoke.h:96
#13 std::invoke<DolphinMainWindow::slotSaveSession()::<lambda()>&> (__fn=<synthetic pointer>...) at /usr/include/c++/14/functional:120
#14 operator() (__closure=<synthetic pointer>, function=...)
    at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentstoredfunctioncall.h:116
#15 std::__invoke_impl<void, const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, DolphinMainWindow::slotSaveSession()::<lambda()> >
    (__f=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:61
#16 std::__invoke<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, DolphinMainWindow::slotSaveSession()::<lambda()> >
    (__fn=<synthetic pointer>...) at /usr/include/c++/14/bits/invoke.h:96
#17 std::__apply_impl<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, std::tuple<DolphinMainWindow::slotSaveSession()::<lambda()> >, 0>
    (__f=<synthetic pointer>..., __t=...) at /usr/include/c++/14/tuple:2923
#18 std::apply<const QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor()::<lambda(std::decay_t<DolphinMainWindow::slotSaveSession()::<lambda()> >)>&, std::tuple<DolphinMainWindow::slotSaveSession()::<lambda()> > >
    (__f=<synthetic pointer>..., __t=...) at /usr/include/c++/14/tuple:2938
#19 QtConcurrent::StoredFunctionCall<DolphinMainWindow::slotSaveSession()::<lambda()> >::runFunctor (this=0x56127a390460)
    at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentstoredfunctioncall.h:120
#20 QtConcurrent::RunFunctionTaskBase<void>::run (this=0x56127a390460)
    at /usr/include/x86_64-linux-gnu/qt6/QtConcurrent/qtconcurrentrunbase.h:83
#21 0x00007f223c6e2a5d in QThreadPoolThread::run (this=0x56127b0b8690) at ./src/corelib/thread/qthreadpool.cpp:71
#22 0x00007f223c6e11ea in operator() (__closure=<optimized out>) at ./src/corelib/thread/qthread_unix.cpp:375
#23 (anonymous namespace)::terminate_on_exception<QThreadPrivate::start(void*)::<lambda()> > (t=<optimized out>)
    at ./src/corelib/thread/qthread_unix.cpp:311
#24 QThreadPrivate::start (arg=0x56127b0b8690) at ./src/corelib/thread/qthread_unix.cpp:339
#25 0x00007f223be9eb7b in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
#26 0x00007f223bf1c7f8 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
pwndbg> t 2
[Switching to thread 2 (Thread 0x7f2234a80280 (LWP 3357969))]
#0  __GI___access (file=0x561279688ff0 "/home/gwd/.config/session/dolphin_106777640000177484819700000054631367_1774848230_54645", 
    type=0) at ../sysdeps/unix/sysv/linux/access.c:27
warning: 27     ../sysdeps/unix/sysv/linux/access.c: 没有那个文件或目录
pwndbg> bt
#0  __GI___access
    (file=0x561279688ff0 "/home/gwd/.config/session/dolphin_106777640000177484819700000054631367_1774848230_54645", type=0)
    at ../sysdeps/unix/sysv/linux/access.c:27
#1  0x00007f223c6d35d3 in QFileSystemEngine::fillMetaData (entry=..., data=..., what=...)
    at ./src/corelib/io/qfilesystemengine_unix.cpp:972
#2  0x00007f223c551414 in QFileInfo::exists (this=<optimized out>) at ./src/corelib/io/qfileinfo.cpp:727
#3  0x00007f223c57590d in QSaveFile::open (this=this@entry=0x7fff2ecaa450, mode=..., mode@entry=...)
    at ./src/corelib/io/qsavefile.cpp:179
#4  0x00007f223ddc31b2 in KConfigIniBackend::writeConfig
    (this=0x56127b0657a0, locale=<optimized out>, entryMap=<optimized out>, options=...)
    at /usr/include/x86_64-linux-gnu/qt6/QtCore/qflags.h:74
#5  0x00007f223ddae0f5 in KConfig::sync (this=0x561279340d10) at ./src/core/kconfig.cpp:478
#6  0x00007f223e4aab15 in ??? () at /lib/x86_64-linux-gnu/libKF6XmlGui.so.6
#7  0x00007f223c5e4443 in QtPrivate::QSlotObjectBase::call
    (this=<optimized out>, r=0x7f223e52c980, a=0x7fff2ecaa8d0, this=<optimized out>, r=<optimized out>, a=<optimized out>)
    at ./src/corelib/kernel/qobjectdefs_impl.h:486
#8  doActivate<false> (sender=0x7fff2ecab5d0, signal_index=18, argv=0x7fff2ecaa8d0) at ./src/corelib/kernel/qobject.cpp:4115
#9  0x00007f223cbe4329 in QGuiApplication::saveStateRequest(QSessionManager&) () at /lib/x86_64-linux-gnu/libQt6Gui.so.6
#10 0x00007f223cbe50af in QGuiApplicationPrivate::saveState() () at /lib/x86_64-linux-gnu/libQt6Gui.so.6
#11 0x00007f223430eda8 in ??? () at /lib/x86_64-linux-gnu/libQt6XcbQpa.so.6
#12 0x00007f223430ef47 in ??? () at /lib/x86_64-linux-gnu/libQt6XcbQpa.so.6
#13 0x00007f2234a36c73 in _SmcProcessMessage () at /lib/x86_64-linux-gnu/libSM.so.6
#14 0x00007f22342850a5 in IceProcessMessages () at /lib/x86_64-linux-gnu/libICE.so.6
#15 0x00007f223c5e46e8 in doActivate<false> (sender=0x56127924c670, signal_index=3, argv=0x7fff2ecab0d0)
    at ./src/corelib/kernel/qobject.cpp:4127
#16 0x00007f223c5e6db3 in QSocketNotifier::activated (this=this@entry=0x56127924c670, _t1=..., _t2=<optimized out>, _t3=...)
    at ./obj-x86_64-linux-gnu/src/corelib/Core_autogen/include/moc_qsocketnotifier.cpp:198
#17 0x00007f223c5e98fb in QSocketNotifier::event (this=0x56127924c670, e=<optimized out>)
    at ./src/corelib/kernel/qsocketnotifier.cpp:327
#18 0x00007f223d5b49b5 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /lib/x86_64-linux-gnu/libQt6Widgets.so.6
#19 0x00007f223c5965b0 in QCoreApplication::notifyInternal2 (receiver=0x56127924c670, event=0x7fff2ecab210)
    at ./src/corelib/kernel/qcoreapplication.cpp:1172
#20 0x00007f223c7ae5ef in socketNotifierSourceDispatch (source=0x56127916d160) at ./src/corelib/kernel/qeventdispatcher_glib.cpp:77
#21 0x00007f2239459385 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#22 0x00007f223945b5b7 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#23 0x00007f223945bd20 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#24 0x00007f223c7a6323 in QEventDispatcherGlib::processEvents (this=0x5612791834d0, flags=...)
    at ./src/corelib/kernel/qeventdispatcher_glib.cpp:399
#25 0x00007f223c598893 in QEventLoop::exec (this=this@entry=0x7fff2ecab4b0, flags=..., flags@entry=...)
    at ./src/corelib/global/qflags.h:34
#26 0x00007f223c59a18a in QCoreApplication::exec () at ./src/corelib/global/qflags.h:74
#27 0x000056123b4c7c7b in main (argc=<optimized out>, argc@entry=4, argv=argv@entry=0x7fff2ecab898) at ./src/main.cpp:273
#28 0x00007f223be35ca8 in __libc_start_call_main
    (main=main@entry=0x56123b4c5ba0 <main(int, char**)>, argc=argc@entry=4, argv=argv@entry=0x7fff2ecab898)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#29 0x00007f223be35d65 in __libc_start_main_impl
    (main=0x56123b4c5ba0 <main(int, char**)>, argc=4, argv=0x7fff2ecab898, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff2ecab888) at ../csu/libc-start.c:360
#30 0x000056123b4c8581 in _start ()
Comment 1 Bug Janitor Service 2026-04-02 12:30:35 UTC 
A possibly relevant merge request was started @ https://invent.kde.org/system/dolphin/-/merge_requests/1238
Comment 2 Méven 2026-04-26 10:53:07 UTC 
Git commit 2dce7352c1edfb13c90a8a3b858d113e3a9300b2 by Méven Car, on behalf of Wendi Gan.
Committed on 26/04/2026 at 09:42.
Pushed by meven into branch 'master'.

Fix occasional UAF crashes in KConfig::sync() during exit

Previously, c035e95 introduced `QtConcurrent::run` to execute `KConfig::sync()` in a separate thread. However, this introduced thread-safety issue:

BUG 518433 (UAF caused by RC):
During application exit, the main thread frees the old `s_sessionConfig` in `KMWSessionManager::saveState()` to create a new one. Meanwhile, the worker thread is still iterating over the old instance's entryMap during `KConfig::sync()`, leading to a Use-After-Free (UAF) crash.

Changes:
Copy the `config` in the main thread so `KConfig::sync()` can safely run in the worker.
Related: bug 516481, bug 425627

M  +5    -2    src/dolphinmainwindow.cpp

https://invent.kde.org/system/dolphin/-/commit/2dce7352c1edfb13c90a8a3b858d113e3a9300b2