https://bugs.kde.org/show_bug.cgi?id=523606
Bug ID: 523606
Summary: Lock screen stays locked when a fingerprint or
smartcard succeeds while the outputs are momentarily
gone
Classification: Plasma
Product: plasmashell
Version First 6.7.3
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Screen locking
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
On Wayland, a session that wakes a monitor up can go through a moment with no
output at all: every Qt application logs "There are no outputs - creating
placeholder screen". The greeter deletes the view of every removed screen, and
handleScreen() skips the placeholder screen Qt puts in their place because its
geometry is null, so for the length of that gap there is no view and no lock
screen QML.
The unlock lives in the theme: LockScreenUi.qml handles onSucceeded and calls
Qt.quit(), and the greeter only reacts to QQmlEngine::quit. So a PAM success
that
arrives inside that gap is emitted to nobody and the session stays locked.
Worse,
the conversation is over by then, the authenticator reports itself unavailable,
and the reader is dead for the rest of that lock: the password is the only way
back in.
Journal of one occurrence. The outputs go away 352ms before the finger matches,
on a single DisplayPort monitor that renegotiates its link on wake up:
11:20:02.228915 kscreenlocker_greet: There are no outputs - creating
placeholder screen
11:20:02.580591 pam_fprintd(kde-fingerprint:auth): Verify result: verify-match
(done: 1)
11:20:02.580708 [PAM worker kde-fingerprint] Authenticate: Authentication
done, result code: 0 (Success)
11:20:02.580787 PamAuthenticators: Success from non-interactive authenticator
kde-fingerprint
11:20:02.580794 PamAuthenticators: Availability changed for non-interactive
authenticator kde-fingerprint false
11:20:15.072565 PamAuthenticators: Success from interactive authenticator kde
PAM said yes at 11:20:02 and the session stayed locked. The last line is the
password, typed 13 seconds later, which is what actually unlocked it.
STEPS TO REPRODUCE
1. Enable fingerprint unlock, or any other noninteractive PAM authenticator
2. Lock the screen and let the monitor go to sleep
3. Wake it up and touch the reader within the first second, while the outputs
are
still coming back
It is a race, so it takes a few tries on real hardware. It reproduces
deterministically with a lock screen theme that has no onSucceeded handler at
all, which puts the greeter in the same situation as having no view:
authentication succeeds and the greeter just stays up.
OBSERVED RESULT
The session stays locked, and the fingerprint reader does not respond for the
rest of that lock.
EXPECTED RESULT
The session unlocks. Whether a view happens to exist at that instant should not
matter.
This is not specific to fingerprint: any noninteractive authenticator that
finishes inside that window is lost the same way.
--
You are receiving this mail because:
You are watching all bug changes.
