https://bugs.kde.org/show_bug.cgi?id=525530
Bug ID: 525530
Summary: Crash on exit (SIGABRT) in OPENSSL_cleanup /
OPENSSL_sk_pop_free, likely related to
libngtcp2_crypto_ossl
Classification: Applications
Product: ktorrent
Version First 26.08.0
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
SUMMARY
ktorrent crashes with SIGABRT every time it exits (not during normal
operation — the crash happens after the application has already shut
down and is unwinding via exit()). The crash occurs inside OpenSSL's
atexit-registered cleanup routine (OPENSSL_cleanup), specifically in
OPENSSL_sk_pop_free, called from libcrypto.so.3.
The system links ktorrent's QUIC-capable component against
libngtcp2_crypto_ossl.so.0, an experimental OpenSSL backend for
ngtcp2. Upstream ngtcp2 documents that this backend has strict
object-lifetime requirements (the ngtcp2_conn must stay alive until
the SSL object is freed via SSL_free, or SSL_set_app_data(ssl, NULL)
must be called before SSL_free). If libktorrent's QUIC/µTP handling
does not fully satisfy this at process-exit time, it could explain a
race between a background network thread still touching libcrypto
objects and the main thread's atexit-triggered OPENSSL_cleanup() —
this is also a known general class of issue in OpenSSL when
multi-threaded applications call OPENSSL_cleanup() while another
thread still holds libcrypto objects.
STEPS TO REPRODUCE
1. Start ktorrent normally (with torrents active/seeding)
2. Close ktorrent (Quit)
OBSERVED RESULT
ktorrent aborts with SIGABRT during shutdown; KCrash handler
triggers, dumping the backtrace below.
EXPECTED RESULT
Clean exit with no crash.
SOFTWARE/OS VERSIONS
- ktorrent: 26.08.0-1 (Arch/Manjaro)
- libktorrent: 26.08.0-1
- openssl: 3.6.4-1
- Distribution: Manjaro/Arch Linux, x86_64
ADDITIONAL INFORMATION
ldd on ktorrent and its QUIC component shows:
libssl.so.3 => /usr/lib/libssl.so.3
libngtcp2_crypto_ossl.so.0 => /usr/lib/libngtcp2_crypto_ossl.so.0
BACKTRACE
Application: ktorrent (ktorrent), signal: Aborted
#4 0x00007f8864c9a17c in ?? () from /usr/lib/libc.so.6
#5 0x00007f8864c3e5d0 in raise () from /usr/lib/libc.so.6
#6 0x00007f8864c25685 in abort () from /usr/lib/libc.so.6
#7 0x00007f8864c26704 in ?? () from /usr/lib/libc.so.6
#8 0x00007f8864ca482c in ?? () from /usr/lib/libc.so.6
#9 0x00007f8864ca62bc in ?? () from /usr/lib/libc.so.6
#10 0x00007f8864ca6337 in ?? () from /usr/lib/libc.so.6
#11 0x00007f88647b42f0 in ?? () from /usr/lib/libcrypto.so.3
#12 0x00007f88647b62ea in ?? () from /usr/lib/libcrypto.so.3
#13 0x00007f88647b4837 in ?? () from /usr/lib/libcrypto.so.3
#14 0x00007f88647b326b in ?? () from /usr/lib/libcrypto.so.3
#15 0x00007f88647b44bb in ?? () from /usr/lib/libcrypto.so.3
#16 0x00007f8864813855 in OPENSSL_sk_pop_free () from /usr/lib/libcrypto.so.3
#17 0x00007f88647b419e in ?? () from /usr/lib/libcrypto.so.3
#18 0x00007f88647a2616 in ?? () from /usr/lib/libcrypto.so.3
#19 0x00007f88647a369e in ?? () from /usr/lib/libcrypto.so.3
#20 0x00007f88647a9b1c in OPENSSL_cleanup () from /usr/lib/libcrypto.so.3
#21 0x00007f8864c40fbf in ?? () from /usr/lib/libc.so.6
#22 0x00007f8864c4109e in exit () from /usr/lib/libc.so.6
#23 0x00007f8864c27788 in ?? () from /usr/lib/libc.so.6
#24 0x00007f8864c278b9 in __libc_start_main () from /usr/lib/libc.so.6
--
You are receiving this mail because:
You are watching all bug changes.
