Created attachment 121046 [details] valgrind run on konsole with two tabs open showing invalid reads and writes after closing SUMMARY I closed konsole 19.04.2-1.fc30 with two tabs in Plasma on Wayland. drkonqi showed a segmentation fault each time, but drkonqi didn't allow the trace to be submitted. When I ran gdb konsole, I opened a second tab, then I closed konsole, I got the following segmentation fault in wl_map_insert_at at wayland-util.c:247 of libwayland-client with more detailed information. Thread 1 "konsole" received signal SIGSEGV, Segmentation fault. 0x00007fffe5466251 in wl_map_insert_at (map=<optimized out>, flags=flags@entry=1, i=80, data=data@entry=0x0) at src/wayland-util.c:247 247 start[i].next |= (flags & 0x1) << 1; (gdb) thread apply all bt full Thread 2 (Thread 0x7fffe4442700 (LWP 2248)): #0 0x00007ffff7e915c7 in __GI___poll (fds=0x7fffdc005260, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29 resultvar = 18446744073709551100 sc_cancel_oldtype = 0 sc_ret = <optimized out> #1 0x00007ffff4be51de in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x7fffdc005260, timeout=<optimized out>, context=0x7fffdc000bf0) at ../glib/gmain.c:4228 ret = <optimized out> errsv = <optimized out> poll_func = 0x7ffff4bf4d50 <g_poll> poll_func = <optimized out> ret = <optimized out> errsv = <optimized out> #2 g_main_context_iterate (context=context@entry=0x7fffdc000bf0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3922 max_priority = 2147483647 timeout = -1 some_ready = <optimized out> nfds = 2 allocated_nfds = <optimized out> fds = 0x7fffdc005260 #3 0x00007ffff4be5313 in g_main_context_iteration (context=0x7fffdc000bf0, may_block=may_block@entry=1) at ../glib/gmain.c:3988 --Type <RET> for more, q to quit, c to continue without paging--c retval = <optimized out> #4 0x00007ffff670e3f5 in QEventDispatcherGlib::processEvents (this=0x7fffdc000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422 d = 0x7fffdc000b40 canWait = true savedFlags = {i = 0} result = <optimized out> #5 0x00007ffff66b82bb in QEventLoop::exec (this=this@entry=0x7fffe4441d30, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:140 d = 0x7fffdc003a00 locker = {val = 93824992564160} ref = {d = 0x7fffdc003a00, locker = @0x7fffe4441cb8, exceptionCaught = true} app = <optimized out> #6 0x00007ffff6511675 in QThread::exec (this=this@entry=0x7ffff5c84060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at ../../include/QtCore/../../src/corelib/global/qflags.h:120 d = 0x5555555a5350 locker = {val = 93824992564160} eventLoop = {<QObject> = {_vptr.QObject = 0x7ffff6969a28 <vtable for QEventLoop+16>, static staticMetaObject = {d = {superdata = 0x0, stringdata = 0x7ffff6858e20 <qt_meta_stringdata_QObject>, data = 0x7ffff6858d00 <qt_meta_data_QObject>, static_metacall = 0x7ffff66eb810 <QObject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}, d_ptr = {d = 0x7fffdc003a00}, static staticQtMetaObject = {d = {superdata = 0x0, stringdata = 0x7ffff685bd40 <qt_meta_stringdata_Qt>, data = 0x7ffff6858f40 <qt_meta_data_Qt>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}}, static staticMetaObject = {d = {superdata = 0x7ffff6961fe0 <QObject::staticMetaObject>, stringdata = 0x7ffff6853260 <qt_meta_stringdata_QEventLoop>, data = 0x7ffff6853200 <qt_meta_data_QEventLoop>, static_metacall = 0x7ffff66b7fd0 <QEventLoop::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}} returnCode = <optimized out> #7 0x00007ffff5c00f4a in QDBusConnectionManager::run (this=0x7ffff5c84060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at qdbusconnection.cpp:178 locker = <optimized out> #8 0x00007ffff65127c6 in QThreadPrivate::start (arg=0x7ffff5c84060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:361 thr = 0x7ffff5c84060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder> data = <optimized out> __clframe = {__cancel_routine = 0x7ffff6511f00 <QThreadPrivate::finish(void*)>, __cancel_arg = 0x7ffff5c84060 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>, __do_it = 1, __cancel_type = <optimized out>} #9 0x00007ffff54bd5a2 in start_thread (arg=<optimized out>) at pthread_create.c:486 ret = <optimized out> pd = <optimized out> now = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737023059712, -7425004005232201654, 140737488345070, 140737488345071, 140737488345264, 140737023057600, 7424991827868528714, 7425024725548150858}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <optimized out> #10 0x00007ffff7e9c303 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 No locals. Thread 1 (Thread 0x7ffff2530200 (LWP 2244)): #0 0x00007fffe5466251 in wl_map_insert_at (map=<optimized out>, flags=flags@entry=1, i=80, data=data@entry=0x0) at src/wayland-util.c:247 start = 0x4 count = <optimized out> entries = 0x55555557dbc8 #1 0x00007fffe5462152 in proxy_destroy (proxy=0x555555d49b20) at src/wayland-client.c:502 zombie = 0x0 #2 wl_proxy_destroy (proxy=proxy@entry=0x555555d49b20) at src/wayland-client.c:533 display = 0x55555557db50 #3 0x00007fffe519de77 in org_kde_plasma_window_destroy (org_kde_plasma_window=0x555555d49b20) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/x86_64-redhat-linux-gnu/src/client/wayland-plasma-window-management-client-protocol.h:694 No locals. #4 KWayland::Client::WaylandPointer<org_kde_plasma_window, org_kde_plasma_window_destroy>::release (this=0x555555d49670, this=0x555555d49670) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/src/client/wayland_pointer_p.h:53 No locals. #5 KWayland::Client::PlasmaWindow::release (this=this@entry=0x555555d49b70) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/src/client/plasmawindowmanagement.cpp:787 No locals. #6 0x00007fffe519de9f in KWayland::Client::PlasmaWindow::~PlasmaWindow (this=0x555555d49b70, __in_chrg=<optimized out>) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/src/client/plasmawindowmanagement.cpp:777 No locals. #7 0x00007fffe519dfdd in KWayland::Client::PlasmaWindow::~PlasmaWindow (this=0x555555d49b70, __in_chrg=<optimized out>) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/src/client/plasmawindowmanagement.cpp:775 No locals. #8 0x00007ffff66ea54c in QObjectPrivate::deleteChildren (this=this@entry=0x555555a55210) at kernel/qobject.cpp:2006 i = 0 #9 0x00007ffff66eb49f in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at kernel/qobject.cpp:1032 d = <optimized out> sharedRefcount = <optimized out> d = <optimized out> sharedRefcount = <optimized out> signalSlotMutex = <optimized out> locker = <optimized out> node = <optimized out> connectionListsCount = <optimized out> signal = <optimized out> connectionList = <optimized out> c = <optimized out> m = <optimized out> needToUnlock = <optimized out> sender = <optimized out> m = <optimized out> needToUnlock = <optimized out> senderLists = <optimized out> slotObj = <optimized out> #10 0x00007fffe519e77d in KWayland::Client::PlasmaWindowManagement::~PlasmaWindowManagement (this=0x555555b8cce0, __in_chrg=<optimized out>) at /usr/src/debug/kf5-kwayland-5.59.0-1.fc30.x86_64/src/client/plasmawindowmanagement.cpp:255 No locals. #11 0x00007ffff66ea54c in QObjectPrivate::deleteChildren (this=this@entry=0x555555ae2bc0) at kernel/qobject.cpp:2006 i = 4 #12 0x00007ffff66eb49f in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at kernel/qobject.cpp:1032 d = <optimized out> sharedRefcount = <optimized out> d = <optimized out> sharedRefcount = <optimized out> signalSlotMutex = <optimized out> locker = <optimized out> node = <optimized out> connectionListsCount = <optimized out> signal = <optimized out> connectionList = <optimized out> c = <optimized out> m = <optimized out> needToUnlock = <optimized out> sender = <optimized out> m = <optimized out> needToUnlock = <optimized out> senderLists = <optimized out> slotObj = <optimized out> #13 0x00007fffe3226387 in WaylandIntegration::~WaylandIntegration (this=<optimized out>, __in_chrg=<optimized out>) at /usr/src/debug/kwayland-integration-5.15.5-1.fc30.x86_64/src/windowsystem/waylandintegration.cpp:54 No locals. #14 WaylandIntegrationSingleton::~WaylandIntegrationSingleton (this=<optimized out>, __in_chrg=<optimized out>) at /usr/src/debug/kwayland-integration-5.15.5-1.fc30.x86_64/src/windowsystem/waylandintegration.cpp:40 No locals. #15 (anonymous namespace)::Q_QGS_privateWaylandIntegrationSelf::Holder::~Holder (this=<optimized out>, __in_chrg=<optimized out>) at /usr/src/debug/kwayland-integration-5.15.5-1.fc30.x86_64/src/windowsystem/waylandintegration.cpp:46 No locals. #16 0x00007ffff7ddb670 in __run_exit_handlers (status=0, listp=0x7ffff7f61738 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:108 atfct = <optimized out> onfct = <optimized out> cxafct = <optimized out> f = <optimized out> new_exitfn_called = 2017 cur = 0x555555af32e0 #17 0x00007ffff7ddb7b0 in __GI_exit (status=<optimized out>) at exit.c:139 No locals. #18 0x00007ffff7dc4f3a in __libc_start_main (main=0x555555555070 <main>, argc=1, argv=0x7fffffffddd8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffddc8) at ../csu/libc-start.c:342 result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 3629827189853663306, 93824992235648, 140737488346576, 0, 0, 7425004006348959818, 7425021310155501642}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7fffffffdde8, 0x7ffff7ffe150}, data = {prev = 0x0, cleanup = 0x0, canceltype = -8728}}} not_first_call = <optimized out> #19 0x00005555555550ae in _start () No symbol table info available. The pointer start = 0x4 in wl_map_insert_at appeared to be invalid, and start[i] pointed to an inaccessible address 0x284. (gdb) p start $1 = (union map_entry *) 0x4 (gdb) p start[i] Cannot access memory at address 0x284 (gdb) p start[i].next Cannot access memory at address 0x284 wl_map_insert was as follows. 224 int 225 wl_map_insert_at(struct wl_map *map, uint32_t flags, uint32_t i, void *data) 226 { 227 union map_entry *start; 228 uint32_t count; 229 struct wl_array *entries; 230 231 if (i < WL_SERVER_ID_START) { 232 entries = &map->client_entries; 233 } else { 234 entries = &map->server_entries; 235 i -= WL_SERVER_ID_START; 236 } 237 238 count = entries->size / sizeof *start; 239 if (count < i) 240 return -1; 241 242 if (count == i) 243 wl_array_add(entries, sizeof *start); 244 245 start = entries->data; 246 start[i].data = data; 247 start[i].next |= (flags & 0x1) << 1; 248 249 return 0; 250 } I ran valgrind --log-file=valgrind-konsole-wayland-2.txt konsole & (in konsole) opened a second tab, and closed konsole. valgrind's log showed 21 invalid reads and writes starting at wl_proxy_unref (wayland-client.c:229). 20 of those invalid reads/writes seemed to be use-after-free errors since they contained lines like "Address 0xa48852c is 44 bytes inside a block of size 72 free'd". ==2387== Invalid read of size 4 ==2387== at 0x177ABBB4: wl_proxy_unref (wayland-client.c:229) ==2387== by 0x177ABCB3: destroy_queued_closure (wayland-client.c:291) ==2387== by 0x177ABEC7: dispatch_event.isra.0 (wayland-client.c:1436) ==2387== by 0x177AD46B: dispatch_queue (wayland-client.c:1576) ==2387== by 0x177AD46B: wl_display_dispatch_queue_pending (wayland-client.c:1818) ==2387== by 0x177AD8AA: wl_display_roundtrip_queue (wayland-client.c:1241) ==2387== by 0x17A7BB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290) ==2387== by 0x178AE189: KWaylandIntegration::init() (kwaylandintegration.cpp:74) ==2387== by 0x178940C0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84) ==2387== by 0x178B0DFA: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37) ==2387== by 0x5A781B8: QPlatformTheme* qLoadPlugin<QPlatformTheme, QPlatformThemePlugin, QStringList&>(QFactoryLoader const*, QString const&, QStringList&) (qfactoryloader_p.h:108) ==2387== by 0x5A77B55: QPlatformThemeFactory::create(QString const&, QString const&) (qplatformthemefactory.cpp:73) ==2387== by 0x5A813FF: init_platform (qguiapplication.cpp:1239) ==2387== by 0x5A813FF: QGuiApplicationPrivate::createPlatformIntegration() (qguiapplication.cpp:1384) ==2387== Address 0xa48852c is 44 bytes inside a block of size 72 free'd ==2387== at 0x4839A0C: free (vg_replace_malloc.c:540) ==2387== by 0x17A92C14: destroy (wayland_pointer_p.h:63) ==2387== by 0x17A92C14: KWayland::Client::Registry::Private::globalSync(void*, wl_callback*, unsigned int) (registry.cpp:539) ==2387== by 0x485CB27: ffi_call_unix64 (in /usr/lib64/libffi.so.6.0.2) ==2387== by 0x485C338: ffi_call (in /usr/lib64/libffi.so.6.0.2) ==2387== by 0x177AF606: wl_closure_invoke (connection.c:1014) ==2387== by 0x177ABF17: dispatch_event.isra.0 (wayland-client.c:1430) ==2387== by 0x177AD46B: dispatch_queue (wayland-client.c:1576) ==2387== by 0x177AD46B: wl_display_dispatch_queue_pending (wayland-client.c:1818) ==2387== by 0x177AD8AA: wl_display_roundtrip_queue (wayland-client.c:1241) ==2387== by 0x17A7BB73: KWayland::Client::ConnectionThread::roundtrip() (connection_thread.cpp:290) ==2387== by 0x178AE189: KWaylandIntegration::init() (kwaylandintegration.cpp:74) ==2387== by 0x178940C0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84) ==2387== by 0x178B0DFA: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37) ==2387== Block was alloc'd at ==2387== at 0x483AB1A: calloc (vg_replace_malloc.c:762) ==2387== by 0x177ABD42: UnknownInlinedFun (wayland-private.h:236) ==2387== by 0x177ABD42: proxy_create.isra.0 (wayland-client.c:421) ==2387== by 0x177AC42B: create_outgoing_proxy (wayland-client.c:650) ==2387== by 0x177AC42B: wl_proxy_marshal_array_constructor_versioned (wayland-client.c:735) ==2387== by 0x177AC782: wl_proxy_marshal_constructor (wayland-client.c:824) ==2387== by 0x17A930BD: wl_display_sync (wayland-client-protocol.h:958) ==2387== by 0x17A930BD: KWayland::Client::Registry::create(wl_display*) (registry.cpp:470) ==2387== by 0x17A9313A: KWayland::Client::Registry::create(KWayland::Client::ConnectionThread*) (registry.cpp:479) ==2387== by 0x178AE10D: KWaylandIntegration::init() (kwaylandintegration.cpp:56) ==2387== by 0x178940C0: KdePlatformTheme::KdePlatformTheme() (kdeplatformtheme.cpp:84) ==2387== by 0x178B0DFA: KdePlatformThemePlugin::create(QString const&, QStringList const&) (main.cpp:37) ==2387== by 0x5A781B8: QPlatformTheme* qLoadPlugin<QPlatformTheme, QPlatformThemePlugin, QStringList&>(QFactoryLoader const*, QString const&, QStringList&) (qfactoryloader_p.h:108) ==2387== by 0x5A77B55: QPlatformThemeFactory::create(QString const&, QString const&) (qplatformthemefactory.cpp:73) ==2387== by 0x5A813FF: init_platform (qguiapplication.cpp:1239) ==2387== by 0x5A813FF: QGuiApplicationPrivate::createPlatformIntegration() (qguiapplication.cpp:1384) One invalid write in wl_map_insert_at (wayland-util.c:247) at 0x284 mentioned above as what start[i] was pointing to showed up later in the valgrind log. ==2387== Invalid write of size 8 ==2387== at 0x177B0251: wl_map_insert_at (wayland-util.c:247) ==2387== by 0x177AC151: proxy_destroy (wayland-client.c:502) ==2387== by 0x177AC151: wl_proxy_destroy (wayland-client.c:533) ==2387== by 0x17A8CE76: org_kde_plasma_window_destroy (wayland-plasma-window-management-client-protocol.h:694) ==2387== by 0x17A8CE76: release (wayland_pointer_p.h:53) ==2387== by 0x17A8CE76: KWayland::Client::PlasmaWindow::release() (plasmawindowmanagement.cpp:787) ==2387== by 0x17A8CE9E: KWayland::Client::PlasmaWindow::~PlasmaWindow() (plasmawindowmanagement.cpp:777) ==2387== by 0x17A8CFDC: KWayland::Client::PlasmaWindow::~PlasmaWindow() (plasmawindowmanagement.cpp:778) ==2387== by 0x613654B: QObjectPrivate::deleteChildren() (qobject.cpp:2006) ==2387== by 0x613749E: QObject::~QObject() (qobject.cpp:1032) ==2387== by 0x17A8D77C: KWayland::Client::PlasmaWindowManagement::~PlasmaWindowManagement() (plasmawindowmanagement.cpp:258) ==2387== by 0x613654B: QObjectPrivate::deleteChildren() (qobject.cpp:2006) ==2387== by 0x613749E: QObject::~QObject() (qobject.cpp:1032) ==2387== by 0x1A1E7386: (anonymous namespace)::Q_QGS_privateWaylandIntegrationSelf::innerFunction()::Holder::~Holder() (waylandintegration.cpp:54) ==2387== by 0x48E666F: __run_exit_handlers (exit.c:108) ==2387== Address 0x284 is not stack'd, malloc'd or (recently) free'd The invalid reads/writes might have led to memory corruption which ended with the segmentation faults. I'll attach the full valgrind log. STEPS TO REPRODUCE 1. Install Fedora 30 Plasma spin 2. boot into Plasma spin 3. start Plasma on Wayland from sddm 4. sudo dnf upgrade --refresh --enablerepo=updates-testing 5. reboot 6. start Plasma on Wayland from sddm 7. start konsole 8. open a second tab in konsole 9. close konsole by clicking x at the top right then answering yes 10. start konsole 11. gdb konsole 12. r (in gdb) 13. open a second tab in konsole running in gdb 14. close the konsole running in gdb as above 15. thread apply all bt full (in gdb) 16. q (in gdb) 17. valgrind --log-file=valgrind-konsole-wayland-2.txt konsole & (in konsole) 18. opened a second tab in konsole running under valgrind 19. close konsole running under valgrind 20. read valgrind-konsole-wayland-2.txt OBSERVED RESULT Closing konsole with two tabs open in Plasma on Wayland led to segmentation faults and invalid reads/writes. The segmentation faults have happened each of a few times I've closed konsole with two tabs opened. EXPECTED RESULT No crashes of konsole. SOFTWARE/OS VERSIONS Linux/KDE Plasma: Fedora 30, 5.1.12 kernel (available in About System) KDE Plasma Version: 5.15.5 KDE Frameworks Version: 5.59.0 Qt Version: 5.12.1 kf5-kwayland-0:5.59.0-1.fc30.x86_64 konsole5-0:19.04.2-1.fc30.x86_64 libwayland-client-0:1.17.0-1.fc30.x86_64 plasma-desktop-0:5.15.5-1.fc30.x86_64 qt5-qtbase-0:5.12.1-7.fc30.x86_64 ADDITIONAL INFORMATION I first saw these crashes with konsole-18.12.3-2.fc30 and kf5-kwayland-5.58.0-1.fc30. The crashes didn't happen when only one tab was opened or in Plasma on X. The following reports have segmentation faults in konsole with similar traces https://bugs.kde.org/show_bug.cgi?id=394484 https://bugs.kde.org/show_bug.cgi?id=385633 The report at https://bugs.kde.org/show_bug.cgi?id=390151 has many similar traces in programs like systemsettings. The segmentation faults in powerdevil when logging out of Plasma on Wayland I reported at https://bugzilla.redhat.com/show_bug.cgi?id=1713467#c15 also had invalid reads/writes starting in wl_proxy_unref (wayland-client.c:229). I have seen crashes in akonadi_sendlater_agent and kglobalaccel5 with invalid reads/writes starting in wl_proxy_unref (wayland-client.c:229) which I have not reported elsewhere yet in full. These use-after-free errors involving libwayland-client, kf5-kwayland, and other packages might be involved in those and other crashes when closing KDE programs on Wayland.
*** This bug has been marked as a duplicate of bug 390151 ***