https://bugs.kde.org/show_bug.cgi?id=523807
Bug ID: 523807
Summary: kded6 crashes with SIGSEGV in networkmanagement.so
during QKeychain::Job::finished, breaking WireGuard
secret retrieval
Classification: Applications
Product: systemsettings
Version First 6.7.3
Reported In:
Platform: Manjaro
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: kcm_networkmanagement
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
kded6 crashes reproducibly with a SIGSEGV whenever the networkmanagement.so
kded module handles a finished QKeychain::Job — i.e. when it reads a stored
WireGuard secret from KWallet. This happens reliably at login, causing systemd
to respawn kded6 in a tight loop (~15 attempts within a few seconds) before
giving up. As a result, no plasma-nm secret agent is registered, and
NetworkManager cannot retrieve WireGuard secrets. Attempting to bring up a
WireGuard connection (e.g. via nmcli connection up) fails with:
Secrets are required to connect WireGuard VPN 'SWLD'
Error: Connection activation failed: Secrets were required, but not provided
The secret itself is confirmed present and readable in KWallet (verified via
KWalletManager and kwallet-query), so this is not a case of a missing/lost
secret — the crash happens specifically while networkmanagement.so is
processing the callback from QtKeychain.
STEPS TO REPRODUCE
Have a WireGuard connection configured in NetworkManager with
wireguard.private-key-flags set to 1 (agent-owned / stored in KWallet via
QtKeychain).
Log into a Plasma 6 Wayland session.
Observe kded6 crashing repeatedly (journalctl --user -u plasma-kded6 or
coredumpctl list kded6).
Attempt to activate the WireGuard connection: nmcli connection up
"<connection-name>".
OBSERVED RESULT
kded6 crashes with SIGSEGV in networkmanagement.so immediately after a
QKeychain::Job finishes. No plasma-nm secret agent remains registered on D-Bus.
WireGuard connection activation fails with "Secrets were required, but not
provided", even though the secret is present and readable in KWallet through
other means (KWalletManager GUI, kwallet-query).
EXPECTED RESULT
kded6/networkmanagement.so should process the QtKeychain callback without
crashing, and successfully hand the WireGuard secret to NetworkManager.
SOFTWARE/OS VERSIONS
Distribution: Manjaro Linux (Arch-based, rolling release)
KDE Plasma Version: 6 (Wayland session)
plasma-nm: 6.7.3-1
plasma-workspace: 6.7.3-1
qtkeychain-qt6: 0.17.0-1
kwallet: 6.28.0-1
ADDITIONAL INFORMATION — BACKTRACE
Signal: 11 (SEGV)
Executable: /usr/bin/kded6
Stack trace of crashing thread:
#0 networkmanagement.so + 0x164e0
#1 networkmanagement.so + 0x30d67
#2 libQt6Core.so.6 + 0x1f081b
#3 QKeychain::Job::finished (libqt6keychain.so.1 + 0x20598)
#4 QKeychain::Job::emitFinished (libqt6keychain.so.1 + 0x14c39)
#5 libQt6Core.so.6 + 0x1f081b
#6 libQt6DBus.so.6 + 0x97f41
#7 QObject::event (libQt6Core.so.6 + 0x1e7d46)
#8 QApplicationPrivate::notify_helper (libQt6Widgets.so.6 + 0x10411f)
#9 QCoreApplication::notifyInternal2 (libQt6Core.so.6 + 0x183658)
#10 QCoreApplicationPrivate::sendPostedEvents (libQt6Core.so.6 + 0x183a61)
#11 libQt6Core.so.6 + 0x49fc98
#12 libglib-2.0.so.0 + 0x61bfd
#13 libglib-2.0.so.0 + 0x63e57
#14 g_main_context_iteration (libglib-2.0.so.0 + 0x63fe5)
#15 QEventDispatcherGlib::processEvents (libQt6Core.so.6 + 0x49d0b2)
#16 QEventLoop::exec (libQt6Core.so.6 + 0x191983)
#17 QCoreApplication::exec (libQt6Core.so.6 + 0x186eaa)
#18 kded6 + 0x5b69
#19 libc.so.6 + 0x27741
#20 __libc_start_main (libc.so.6 + 0x27879)
#21 kded6 + 0x5ff5
Full coredumpctl output with debug symbols available on request.
IMPACT
WireGuard connections stored with agent-owned (KWallet-backed) secrets cannot
be activated at all as long as this crash persists, since no secret agent
survives long enough to serve the request. Workaround: setting
wireguard.private-key-flags to 0 (plain text storage in the NetworkManager
connection file) avoids the crash path entirely, but defeats the purpose of
using KWallet for secret storage.
--
You are receiving this mail because:
You are watching all bug changes.
