Bug 465243 - Dolphin crashes while setting up a new KWallet password store for network share credentials
Summary: Dolphin crashes while setting up a new KWallet password store for network sha...
Status: CONFIRMED
Alias: None
Product: frameworks-kio
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: 5.105.0
Platform: unspecified Linux
: NOR crash
Target Milestone: ---
Assignee: KIO Bugs
URL:
Keywords: drkonqi
Depends on:
Blocks:
 
Reported: 2023-02-03 20:07 UTC by Gigaman
Modified: 2023-06-21 09:52 UTC (History)
4 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
New crash information added by DrKonqi (4.73 KB, text/plain)
2023-04-29 09:23 UTC, Frank Schaefer
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gigaman 2023-02-03 20:07:50 UTC
Application: dolphin (22.12.1)

Qt Version: 5.15.8
Frameworks Version: 5.102.0
Operating System: Linux 6.1.8-1-default x86_64
Windowing System: X11
Distribution: openSUSE Tumbleweed
DrKonqi: 5.26.5 [KCrashBackend]

-- Information about the crash:
Steps to reproduce:
1) I have opened Dolphin.
2) I opened KWallet.
3) I deleted the password vault in KWallet. It also contained the credentials for a network share.
4) In Dolphin, I clicked on a previously set up shortcut to the network share.
5) KWallet appeared and prompted me to set up a new password vault.
6) I have set up a new password vault.

Result:
Dolphin crashed in the background.

The reporter is unsure if this crash is reproducible.

-- Backtrace:
Application: Dolphin (dolphin), signal: Segmentation fault

[KCrash Handler]
#4  0x00007f82915a1a00 in QListData::begin (this=<optimized out>) at /usr/include/qt5/QtCore/qlist.h:118
#5  QList<KFileItem>::begin (this=<optimized out>, this=<optimized out>) at /usr/include/qt5/QtCore/qlist.h:339
#6  KCoreDirListerCache::slotUpdateResult (this=0x7f829161b4c0 <_ZZN12_GLOBAL__N_121Q_QGS_kDirListerCache13innerFunctionEvE6holder.lto_priv.0>, j=<optimized out>) at /usr/src/debug/kio-5.102.0/src/core/kcoredirlister.cpp:1751
#7  0x00007f828f9132dd in QtPrivate::QSlotObjectBase::call (a=0x7ffd90ca1640, r=0x7f829161b4c0 <_ZZN12_GLOBAL__N_121Q_QGS_kDirListerCache13innerFunctionEvE6holder.lto_priv.0>, this=0x55fcc9ceb050) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#8  doActivate<false> (sender=0x55fcc9d3a350, signal_index=6, argv=0x7ffd90ca1640) at kernel/qobject.cpp:3923
#9  0x00007f828f90c75f in QMetaObject::activate (sender=sender@entry=0x55fcc9d3a350, m=<optimized out>, local_signal_index=local_signal_index@entry=3, argv=argv@entry=0x7ffd90ca1640) at kernel/qobject.cpp:3983
#10 0x00007f8290d75e15 in KJob::result (this=this@entry=0x55fcc9d3a350, _t1=<optimized out>, _t1@entry=0x55fcc9d3a350, _t2=...) at /usr/src/debug/kcoreaddons-5.102.0/build/src/lib/KF5CoreAddons_autogen/include/moc_kjob.cpp:633
#11 0x00007f8290d7a07b in KJob::finishJob (this=0x55fcc9d3a350, emitResult=<optimized out>) at /usr/src/debug/kcoreaddons-5.102.0/src/lib/jobs/kjob.cpp:98
#12 0x00007f828f9132dd in QtPrivate::QSlotObjectBase::call (a=0x7ffd90ca1700, r=0x55fcc9d3a350, this=0x55fcc96eb8a0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#13 doActivate<false> (sender=0x55fcc9645540, signal_index=7, argv=0x7ffd90ca1700) at kernel/qobject.cpp:3923
#14 0x00007f828f90c75f in QMetaObject::activate (sender=sender@entry=0x55fcc9645540, m=<optimized out>, local_signal_index=local_signal_index@entry=4, argv=argv@entry=0x0) at kernel/qobject.cpp:3983
#15 0x00007f8291546b03 in KIO::SlaveInterface::finished (this=this@entry=0x55fcc9645540) at /usr/src/debug/kio-5.102.0/build/src/core/KF5KIOCore_autogen/include/moc_slaveinterface.cpp:464
#16 0x00007f829154b6d0 in KIO::SlaveInterface::dispatch (this=0x55fcc9645540, _cmd=104, rawdata=...) at /usr/src/debug/kio-5.102.0/src/core/slaveinterface.cpp:149
#17 0x00007f82915468f6 in KIO::SlaveInterface::dispatch (this=0x55fcc9645540) at /usr/src/debug/kio-5.102.0/src/core/slaveinterface.cpp:78
#18 0x00007f8291549119 in KIO::Slave::gotInput (this=0x55fcc9645540) at /usr/src/debug/kio-5.102.0/src/core/slave.cpp:346
#19 0x00007f828f9132dd in QtPrivate::QSlotObjectBase::call (a=0x7ffd90ca1930, r=0x55fcc9645540, this=0x55fcc9bc6ec0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#20 doActivate<false> (sender=0x55fcc9619310, signal_index=3, argv=0x7ffd90ca1930) at kernel/qobject.cpp:3923
#21 0x00007f828f907c50 in QObject::event (this=0x55fcc9619310, e=0x55fcc9c704d0) at kernel/qobject.cpp:1347
#22 0x00007f82905a544e in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x55fcc9619310, e=0x55fcc9c704d0) at kernel/qapplication.cpp:3640
#23 0x00007f828f8dc138 in QCoreApplication::notifyInternal2 (receiver=0x55fcc9619310, event=0x55fcc9c704d0) at kernel/qcoreapplication.cpp:1064
#24 0x00007f828f8df0d1 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55fcc91c4f50) at kernel/qcoreapplication.cpp:1821
#25 0x00007f828f934363 in postEventSourceDispatch (s=0x55fcc92e0530) at kernel/qeventdispatcher_glib.cpp:277
#26 0x00007f828d51ba90 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#27 0x00007f828d51be48 in ?? () from /lib64/libglib-2.0.so.0
#28 0x00007f828d51bedc in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#29 0x00007f828f933b66 in QEventDispatcherGlib::processEvents (this=0x55fcc92ea9b0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#30 0x00007f828f8dabab in QEventLoop::exec (this=this@entry=0x7ffd90ca1d20, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#31 0x00007f828f8e2d16 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#32 0x000055fcc7669719 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dolphin-22.12.1/src/main.cpp:235
[Inferior 1 (process 10444) detached]

Reported using DrKonqi
Comment 1 Frank Schaefer 2023-04-29 09:23:25 UTC
Created attachment 158532 [details]
New crash information added by DrKonqi

dolphin (23.04.0) using Qt 5.15.9

Steps to reproduce:
1) open Dolphin
2) enter SMB share location (smb://mysambaserver/myusername)
3) enter authentification data in authentification dialog

Result:
Dolphin crashes

-- Backtrace (Reduced):
#4  0x00007f8a8a049e40 in QListData::begin (this=<optimized out>) at /usr/include/qt5/QtCore/qlist.h:118
#5  QList<KFileItem>::begin (this=<optimized out>, this=<optimized out>) at /usr/include/qt5/QtCore/qlist.h:339
#6  KCoreDirListerCache::slotUpdateResult (this=0x7f8a8a0c44c0 <_ZZN12_GLOBAL__N_121Q_QGS_kDirListerCache13innerFunctionEvE6holder.lto_priv.0>, j=<optimized out>) at /usr/src/debug/kio-5.105.0/src/core/kcoredirlister.cpp:1750
#7  0x00007f8a88525232 in QtPrivate::QSlotObjectBase::call (a=0x7fff57862970, r=0x7f8a8a0c44c0 <_ZZN12_GLOBAL__N_121Q_QGS_kDirListerCache13innerFunctionEvE6holder.lto_priv.0>, this=0x55b373974b00) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#8  doActivate<false> (sender=0x55b37388ada0, signal_index=6, argv=0x7fff57862970) at kernel/qobject.cpp:3923
Comment 2 Frank Schaefer 2023-04-29 09:41:58 UTC
(In reply to Frank Schaefer from comment #1)
> Steps to reproduce:
> ...
> 2) enter SMB share location (smb://mysambaserver/myusername)
> ...

Correction:
It happens only if  I enter "smb://mysambaserver".
Entering "smb://mysambaserver/myusername" doesn't result in a crash.

Additional notes:
I have KWallet disabled.
Samba server version is 4.13.13.
Comment 3 Frank Schaefer 2023-04-29 11:09:27 UTC
Looking int https://invent.kde.org/frameworks/kio/-/blob/v5.105.0/src/core/kcoredirlister.cpp:
...
KCoreDirListerCache::slotUpdateResult():
{
...
    DirItem *dir = itemsInUse.value(jobUrl, nullptr);
    if (!dir) {
        qCWarning(KIO_CORE) << "Internal error: itemsInUse did not contain" << jobUrl;
#ifndef NDEBUG
        printDebug();
#endif
        Q_ASSERT(dir);
    } else {
        dir->complete = true;
    }
    ...
// => so dir can be nullptr and we go on
    ...
    for (const KFileItem &item : std::as_const(dir->lstItems)) {
// => BOOM. dir is dereferenced without nullptr check.
        fileItems.insert(item.name(), item);
    }
   ...
}

Looks like it is enough to embrace this loop with a nullptr check, but someone who knows KIO better should validate that.
Comment 4 Frank Schaefer 2023-04-29 18:26:39 UTC
(In reply to Frank Schaefer from comment #3)
> Looks like it is enough to embrace this loop with a nullptr check, but
> someone who knows KIO better should validate that.

Unfortunately it isn't.
Looks like KCoreDirListerCache::slotUpdateResult() is supposed to never be called with a KJob whose url isn't on the itemsInUse list.

smb:///MyServer is changed to smb://username@MyServer after user name and password have been entered.
Apparently this change isn't handled properly, but I failed to track this down further.
I'm neither familiar with the KIO caching concept nor do I know all the different use cases in kio-extra components.
Comment 5 Frank Schaefer 2023-05-01 15:20:00 UTC
Changing product to frameworks-kio because the bug is located there.
Comment 6 postix 2023-06-21 09:52:48 UTC
Sounds like a duplicate of bug #451050.