Bug 498067 - SIGSEGV in IdentityManager::commit
Summary: SIGSEGV in IdentityManager::commit
Status: RESOLVED FIXED
Alias: None
Product: kidentitymanagement
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: git
Platform: NixOS Linux
: NOR crash
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-12-30 22:08 UTC by Gauvain Roussel-Tarbouriech
Modified: 2025-01-11 19:40 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gauvain Roussel-Tarbouriech 2024-12-30 22:08:29 UTC
SUMMARY

Trying to remove an account in either kontact or kmail leads to a crash in KIdentityManagementCore, at IdentityManager::commit().
I can reproduce this crash every time on my environment. The crash seems to be related to a wrong seed value being forwarded to QHashPrivate, leading to a SIGSEGV.

You'll find attached the relevant backtrace, assembly, registers and struct info.


STEPS TO REPRODUCE
1. Add an account
2. Try to remove the account
3. Can be reproduced every single time on my environment

OBSERVED RESULT

Crash

EXPECTED RESULT
No crash

SOFTWARE/OS VERSIONS
Operating System: NixOS 25.05
KDE Plasma Version: 6.2.4
KDE Frameworks Version: 6.8.0
Qt Version: 6.8.0
Kernel Version: 6.6.30-rt30 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 7840HS w/ Radeon 780M Graphics
Memory: 60.6 GiB of RAM
Graphics Processor: AMD Radeon 780M

ADDITIONAL INFORMATION
Thread 1 ".kmail-wrapped" received signal SIGSEGV, Segmentation fault.
0x00007ffff7f8f203 in QHashPrivate::Data<QHashPrivate::Node<QString, QVariant> >::findBucket<QString> (key=..., this=0x7111)
    at /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/include/QtCore/qhash.h:686
686             size_t hash = QHashPrivate::calculateHash(key, seed);
(gdb) bt
#0  0x00007ffff7f8f203 in QHashPrivate::Data<QHashPrivate::Node<QString, QVariant> >::findBucket<QString> (key=..., this=0x7111)
    at /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/include/QtCore/qhash.h:686
#1  QHashPrivate::Data<QHashPrivate::Node<QString, QVariant> >::findNode<QString> (key=..., this=0x7111) at /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/include/QtCore/qhash.h:705
#2  QHash<QString, QVariant>::valueImpl<QString> (this=<optimized out>, key=...) at /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/include/QtCore/qhash.h:1058
#3  QHash<QString, QVariant>::value (this=0x7ffffffedb00, key=...) at /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/include/QtCore/qhash.h:1067
#4  KIdentityManagementCore::Identity::property (this=this@entry=0x71116a0, key=...) at /tmp/kidentitymanagement-24.12.0/src/core/identity.cpp:284
#5  0x00007ffff7f8fbd5 in KIdentityManagementCore::Identity::uoid (this=this@entry=0x71116a0) at /tmp/kidentitymanagement-24.12.0/src/core/identity.cpp:346
#6  0x00007ffff7f9d9b0 in KIdentityManagementCore::IdentityManager::commit (
    this=0x7ffff7fbb4d0 <QGlobalStatic<QtGlobalStatic::Holder<KIdentityManagementCore::(anonymous namespace)::Q_QGS_s_self> >::instance()::holder>)
    at /tmp/kidentitymanagement-24.12.0/src/core/identitymanager.cpp:386
#7  0x00007ffff7d4064a in KMail::IdentityNgPage::save() [clone .part.0] () from /nix/store/yazs6vyy35wz72l9v7r4jpd7kvjzfssb-kmail-24.12.0/lib/libkmailprivate.so.6
#8  0x00007ffff7d41458 in KMail::IdentityNgPage::slotRemoveIdentity() () from /nix/store/yazs6vyy35wz72l9v7r4jpd7kvjzfssb-kmail-24.12.0/lib/libkmailprivate.so.6
#9  0x00007fffe6eeb61b in void doActivate<false>(QObject*, int, void**) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#10 0x00007fffe8384db6 in QAbstractButton::clicked(bool) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#11 0x00007fffe838504e in QAbstractButtonPrivate::emitClicked() () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#12 0x00007fffe83867bb in QAbstractButtonPrivate::click() () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#13 0x00007fffe83869dc in QAbstractButton::mouseReleaseEvent(QMouseEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#14 0x00007fffe82ba540 in QWidget::event(QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#15 0x00007fffe8258749 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#16 0x00007fffe8261ea2 in QApplication::notify(QObject*, QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#17 0x00007fffe6e88948 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#18 0x00007fffe8260ae8 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool, bool) ()
   from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#19 0x00007fffe82ce048 in QWidgetWindow::handleMouseEvent(QMouseEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#20 0x00007fffe82d0670 in QWidgetWindow::event(QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#21 0x00007fffe8258749 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Widgets.so.6
#22 0x00007fffe6e88948 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#23 0x00007fffe793dc9b in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Gui.so.6
#24 0x00007fffe79a28d4 in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Gui.so.6
#25 0x00007fffe7e97e24 in userEventSourceDispatch(_GSource*, int (*)(void*), void*) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Gui.so.6
#26 0x00007fffe1d02571 in g_main_context_dispatch_unlocked () from /nix/store/26hcp8h792wl0h52c5r94qakhvk6q717-glib-2.82.1/lib/libglib-2.0.so.0
#27 0x00007fffe1d046b0 in g_main_context_iterate_unlocked.isra () from /nix/store/26hcp8h792wl0h52c5r94qakhvk6q717-glib-2.82.1/lib/libglib-2.0.so.0
#28 0x00007fffe1d04e9c in g_main_context_iteration () from /nix/store/26hcp8h792wl0h52c5r94qakhvk6q717-glib-2.82.1/lib/libglib-2.0.so.0
#29 0x00007fffe7166f30 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#30 0x00007fffe6e959fa in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#31 0x00007fffe6e91166 in QCoreApplication::exec() () from /nix/store/9prg7kzx3689q4ki17c6g1bwk4wj6wz2-qtbase-6.8.0/lib/libQt6Core.so.6
#32 0x000000000040687f in main ()


(gdb) print key
$2 = (const QString &) @0x7ffffffedaf0: {d = {d = 0x10e8f90, ptr = 0x10e8fa0 u"uoid", size = 4}, static _empty = 0 u'\000'}

(gdb) x/-10i $pc
   0x7ffff7f8f1da <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+138>:     cmp    %rax,%rdi
   0x7ffff7f8f1dd <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+141>:     je     0x7ffff7f8f1ed <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+157>
   0x7ffff7f8f1df <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+143>:     mov    0x40(%rsp),%rax
   0x7ffff7f8f1e4 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+148>:     lea    0x1(%rax),%rsi
   0x7ffff7f8f1e8 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+152>:     call   0x7ffff7f8b1e0 <_ZdlPvm@plt>
   0x7ffff7f8f1ed <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+157>:     mov    0x10(%r12),%r13
   0x7ffff7f8f1f2 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+162>:     test   %r13,%r13
   0x7ffff7f8f1f5 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+165>:     je     0x7ffff7f8f2e0 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+400>
   0x7ffff7f8f1fb <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+171>:     mov    0x8(%rbx),%r12
   0x7ffff7f8f1ff <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+175>:     mov    0x10(%rbx),%r14

(gdb) x/i $pc
=> 0x7ffff7f8f203 <_ZNK23KIdentityManagementCore8Identity8propertyERK7QString+179>:     mov    0x18(%r13),%rdx


(gdb) info registers
rax            0x7ffffffeda90      140737488280208
rbx            0x7ffffffedaf0      140737488280304
rcx            0x0                 0
rdx            0x0                 0
rsi            0x0                 0
rdi            0x7ffffffeda90      140737488280208
rbp            0x7ffffffedb10      0x7ffffffedb10
rsp            0x7ffffffeda50      0x7ffffffeda50
r8             0x0                 0
r9             0x0                 0
r10            0x0                 0
r11            0x0                 0
r12            0x10e8fa0           17731488
r13            0x7111              28945
r14            0x4                 4
r15            0x19601f0           26608112
rip            0x7ffff7f8f203      0x7ffff7f8f203 <KIdentityManagementCore::Identity::property(QString const&) const+179>
eflags         0x10206             [ PF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0
k0             0xa3012             667666
k1             0xffffffff          4294967295
k2             0x7fffffff          2147483647
k3             0xffffffbf          4294967231
k4             0xffffffff          4294967295
k5             0x1d8               472
k6             0x3b000             241664
k7             0x0                 0
fs_base        0x7fffcbb101c0      140736610763200
gs_base        0x0                 0
Comment 1 Gauvain Roussel-Tarbouriech 2024-12-31 14:26:11 UTC
I made a draft MR that fixes said bug but does not fix the feature yet (deletion is still broken and add multiple entries currently) 

https://invent.kde.org/pim/kidentitymanagement/-/merge_requests/30