https://bugs.kde.org/show_bug.cgi?id=526700
Bug ID: 526700
Summary: Dolphin crashes in KJob::kill() from a KIOGui timeout
handler while a drag is in progress (use-after-free)
Classification: Applications
Product: dolphin
Version First 26.04.0
Reported In:
Platform: Ubuntu
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
Dolphin segfaults while an item drag is in progress. A timeout timer in
libKF6KIOGui fires inside the drag's nested event loop, and its handler calls
KJob::kill() on a sub-job pointer that has already been destroyed. It happened
twice in two minutes with the same backtrace.
STEPS TO REPRODUCE
1. Open Dolphin with two tabs, previews enabled.
2. Start dragging a folder from the first tab toward the second tab.
3. Keep the mouse button held while moving over the tab bar.
OBSERVED RESULT
Dolphin crashes with SIGSEGV before the drop happens.
EXPECTED RESULT
The folder is moved or copied to the other tab.
SOFTWARE/OS VERSIONS
Dolphin: 25.12.3
KDE Frameworks: 6.24.0
KDE Plasma: 6.6.6
Qt: 6.10.2
OS: Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic
Session: X11
ADDITIONAL INFORMATION
The frame in libKF6KIOGui has no symbol (no debug symbols available for the
Ubuntu package), but its disassembly is a timerEvent-style handler that does,
in order:
if (timer id matches the member at +0x168)
job at +0x170: KJob::kill(Quietly) <- crashes here, pointer is stale
job at +0x178: KJob::kill(Quietly)
setError(104) (KIO::ERR_INTERNAL)
setErrorText(<7 character string>)
This looks like the timeout path of KIO::FilePreviewJob, with the sub-job
pointers held as raw pointers and not cleared when the sub-job finishes or is
deleted. In KJob::kill() the object's first word was 0x600000001, so the
memory had already been freed and reused.
Thumbnail generation was active in the same session; the journal shows
thumbnailer output from Dolphin shortly afterwards (JPEG plugin "Not a JPEG
file", Ghostscript "Unrecoverable error").
Backtrace (identical for both crashes, PIDs 9278 and 418714):
#5 <signal handler called>
#6 KJob::kill(KJob::KillVerbosity) () at libKF6CoreAddons.so.6
#7 ??? () at libKF6KIOGui.so.6
#8 QObject::event(QEvent*) () at libQt6Core.so.6
#9 QApplicationPrivate::notify_helper(QObject*, QEvent*) () at
libQt6Widgets.so.6
#10 QCoreApplication::notifyInternal2(QObject*, QEvent*) () at libQt6Core.so.6
#11 QTimerInfoList::activateTimers() () at libQt6Core.so.6
#12 ??? () at libQt6Core.so.6
#13 g_main_dispatch () at glib/gmain.c:3591
#14 g_main_context_dispatch_unlocked () at glib/gmain.c:4451
#15 g_main_context_iterate_unlocked () at glib/gmain.c:4516
#16 g_main_context_iteration () at glib/gmain.c:4582
#17 QEventDispatcherGlib::processEvents() () at libQt6Core.so.6
#18 QEventLoop::exec() () at libQt6Core.so.6
#19 QBasicDrag::drag(QDrag*) () at libQt6Gui.so.6
#20 QDragManager::drag(QDrag*) () at libQt6Gui.so.6
#21 QDrag::exec(QFlags<Qt::DropAction>, Qt::DropAction) () at libQt6Gui.so.6
#22 KItemListController::startDragging() () at libdolphinprivate.so.6
#23 KItemListController::mouseMoveEvent(QGraphicsSceneMouseEvent*, QTransform
const&) () at libdolphinprivate.so.6
#24 KItemListController::processEvent(QEvent*, QTransform const&) () at
libdolphinprivate.so.6
#25 KItemListView::event(QEvent*) () at libdolphinprivate.so.6
--
You are receiving this mail because:
You are watching all bug changes.
