https://bugs.kde.org/show_bug.cgi?id=527107
Bug ID: 527107
Summary: Possible stack overflow on windows using KDE Connect
with bluetooth as backend
Classification: Applications
Product: kdeconnect
Version First 26.08.1
Reported In:
Platform: Other
OS: Other
Status: REPORTED
Severity: normal
Priority: NOR
Component: windows-application
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
STEPS TO REPRODUCE
1. Activate bluetooth backend in KDE Connect on Android and Windows
2. Deactivate WiFi on the phone and pair with Windows PC via bluetooth
settings.
OBSERVED RESULT
The phone automatically disconnects from the computer within 5 seconds.
In the event log a stack overflow error appears.
My interpretation of the error:
1. `ConnectionMultiplexer` connects the socket’s `bytesWritten` signal to its
own slot `bytesWritten()`
(https://github.com/KDE/kdeconnect-kde/blob/af7e56748f0016b561b41f313fb58d0ed2b1b142/core/backends/bluetooth/connectionmultiplexer.cpp#L37).
2. That slot calls `mSocket->write(to_write_bytes)`
(https://github.com/KDE/kdeconnect-kde/blob/af7e56748f0016b561b41f313fb58d0ed2b1b142/core/backends/bluetooth/connectionmultiplexer.cpp#L322)
and only removes the written data from `to_write_bytes` after `write()` has
returned (L327-331).
3. On Windows, `QBluetoothSocketPrivateWinRT::writeData()` (qtconnectivity,
`src/bluetooth/qbluetoothsocket_winrt.cpp`) writes synchronously and emits
`bytesWritten` before it returns.
4. So the slot is re-entered while `to_write_bytes` is still unchanged, writes
the same data again, which emits `bytesWritten` again, and so on until the
stack overflows.
There is the text from the crash dump:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for Qt6Bluetooth.dll
*** WARNING: Unable to verify checksum for Qt6Widgets.dll
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4984
Key : Analysis.Elapsed.mSec
Value: 96720
Key : Analysis.IO.Other.Mb
Value: 15
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 77
Key : Analysis.Init.CPU.mSec
Value: 968
Key : Analysis.Init.Elapsed.mSec
Value: 143023
Key : Analysis.Memory.CommitPeak.Mb
Value: 952
Key : Analysis.Version.DbgEng
Value: 10.0.29661.1004
Key : Analysis.Version.Description
Value: 10.2608.26.1 amd64fre
Key : Analysis.Version.Ext
Value: 1.2608.26.1
Key : Failure.Bucket
Value: STACK_OVERFLOW_c00000fd_msvcrt.dll!malloc
Key : Failure.Exception.Code
Value: 0xc00000fd
Key : Failure.Exception.IP.Address
Value: 0x7ffde79ed562
Key : Failure.Exception.IP.Module
Value: Qt6Core
Key : Failure.Exception.IP.Offset
Value: 0x6d562
Key : Failure.Hash
Value: {27975aa2-36ea-061b-f28e-5dd1dabd3671}
Key : Failure.ProblemClass.Primary
Value: STACK_OVERFLOW
Key : Faulting.IP.Type
Value: Paged
Key : Timeline.OS.Boot.DeltaSec
Value: 13431
Key : Timeline.Process.Start.DeltaSec
Value: 13122
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
FILE_IN_CAB: kdeconnectd.exe.10140.dmp
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=00000000000000fe rbx=0000000000000058 rcx=0000016278270000
rdx=0000000000000005 rsi=0000000000000006 rdi=00000162782e0000
rip=00007ffe743e6e62 rsp=0000000e6b304000 rbp=0000000000000040
r8=0000000000000058 r9=0000000000000000 r10=0000000000000000
r11=0000000e6b3040a8 r12=0000000000000060 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200
ntdll!RtlpLowFragHeapAllocFromContext+0x12:
00007ffe`743e6e62 57 push rdi
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffe743e6e62
(ntdll!RtlpLowFragHeapAllocFromContext+0x0000000000000012)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000e6b303ff8
PROCESS_NAME: kdeconnectd.exe
RECURRING_STACK: From frames 0x8 to 0x16
ERROR_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel kann
nicht erstellt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel
kann nicht erstellt werden.
EXCEPTION_CODE_STR: c00000fd
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000e6b303ff8
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute
[Is_OriginalExceptionThread] from Frame:[ffffffff] on thread:[3688]
STACK_TEXT:
0000000e`6b304000 00007ffe`743e6844 : 00000162`78270000 00000000`00000000
00000000`00000058 00000000`00000000 :
ntdll!RtlpLowFragHeapAllocFromContext+0x12
0000000e`6b304020 00007ffe`743e670b : 00000000`00000002 00000000`00000000
00000000`00000000 00000162`78270cc0 : ntdll!RtlpAllocateNTHeapInternal+0xe4
0000000e`6b3040b0 00007ffe`72a9d6b0 : 00000000`00000000 00000162`7ac036b0
00000162`7a942280 00007ffe`3f5b4139 : ntdll!RtlAllocateHeap+0xabb
0000000e`6b304210 00007ffe`3f5a1323 : 0000000e`6b304390 0000000e`6b304338
00000000`00000001 00000162`782e9720 : msvcrt!malloc+0x70
0000000e`6b304240 00007ffe`3f5a184e : 0000000e`6b304390 00000162`782e9640
00000000`00000010 00007ffe`72a9d6b0 : Windows_Networking!operator new+0x23
0000000e`6b304270 00007ffe`3f5cc28a : 00000000`00000010 00007ffe`3f5cc355
00000000`00000000 00000162`782e9640 : Windows_Networking!operator new+0x12
(Inline Function) --------`-------- : --------`-------- --------`--------
--------`-------- --------`-------- :
Windows_Networking!Microsoft::WRL::Details::MakeAllocator<SocketIoContext>::Allocate+0x17
0000000e`6b3042b0 00007ffe`3f5f12bd : 00000162`782e9680 00000162`782e9680
00000162`782e9640 00000000`00000001 :
Windows_Networking!Microsoft::WRL::Details::MakeAndInitialize<SocketIoContext,SocketIoContext,Windows::Networking::Sockets::Internal::ISocketContext
*,void (__cdecl*&)(void *,unsigned long,unsigned __int64),void * &>+0x36
0000000e`6b3042f0 00007ffe`3f5f6db6 : 00000000`00000001 00000000`00000001
00000162`7ac0b3f0 00007ffe`3f5f6e10 :
Windows_Networking!TcpHelper::TcpSendRequest+0x12d
0000000e`6b304370 00007ffe`3f5ccf93 : 00000162`7ac0b3f0 0000000e`6b304400
00000000`00000001 00000162`7ac04340 :
Windows_Networking!WebioFacade::Write+0x10a
(Inline Function) --------`-------- : --------`-------- --------`--------
--------`-------- --------`-------- :
Windows_Networking!SocketOutputStream::TcpBatchedSendAsync+0x12
0000000e`6b3043b0 00007ffe`3f5ce397 : 00000162`782e9720 0000000e`6b304460
00000162`7ac04610 00000000`00000000 :
Windows_Networking!SocketOutputStream::StartBatchedSend+0x203
0000000e`6b304400 00007ffe`3f5ce53a : 00000000`00000000 00000000`00000015
00000162`7ac04610 00000162`7ac04610 :
Windows_Networking!SocketOutputStreamBatchedWriter::StartBatchedSend+0x12b
0000000e`6b304480 00007ffe`3f5cf0a6 : 00000162`7ac04610 00000000`00000000
0000000e`6b304550 00000000`00000000 :
Windows_Networking!SocketOutputStreamBatchedWriter::WriteAsync+0xda
(Inline Function) --------`-------- : --------`-------- --------`--------
--------`-------- --------`-------- :
Windows_Networking!SocketWriteOperationServer::SocketWrite+0x1f
0000000e`6b3044f0 00007ffe`3f5cef15 : 00000162`7a942280 00000162`7ac058e8
00000162`7ac058e8 00000162`7a8117f0 :
Windows_Networking!SocketWriteOperationServer::StartCore+0x16a
0000000e`6b304560 00007ffe`3f5bc43a : 00000000`00000000 00000162`7ac036b0
ffffffff`fffffffe 00000162`7ac059b8 :
Windows_Networking!SocketWriteOperationServer::OnStart+0x55
0000000e`6b304590 00007ffe`3f5cd633 : 00000000`00000000 00000000`00000000
00000000`00000000 00000162`7ac036b0 :
Windows_Networking!Microsoft::WRL::AsyncBase<Windows::Foundation::IAsyncOperationWithProgressCompletedHandler<unsigned
int,unsigned
int>,Microsoft::WRL::Details::Nil,1,Microsoft::WRL::AsyncOptions<-1,0,&GUID_CAUSALITY_WINDOWS_PLATFORM_ID,2>
>::Start+0x2a
(Inline Function) --------`-------- : --------`-------- --------`--------
--------`-------- --------`-------- :
Windows_Networking!SocketWriteOperationServer::Initialize+0x4a
0000000e`6b3045c0 00007ffe`3f5cd2de : 0000000e`6b3046b8 00000162`7ac03758
00002a14`53393371 000097fa`ba296e51 :
Windows_Networking!SocketOutputStream::WriteAsyncInternal+0x323
0000000e`6b304650 00007ffd`e63be3ec : 00000000`00000015 00000162`7a987178
00000162`7a987178 00007ffe`3f5cccb1 :
Windows_Networking!SocketOutputStream::WriteAsync+0x3e
0000000e`6b304680 00007ffd`e63be124 : 0000004f`00000001 00000000`00000000
00007ffe`3f64cb00 00007ffe`3f5ce5d7 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb81c
0000000e`6b304760 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac05288
00000000`00000015 00000162`782e1c20 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb554
0000000e`6b3047e0 00007ffd`e79ed289 : 00000000`0000052d 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b304830 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b304850
0000d209`ecb37f73 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b304860 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b304890 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b3048c0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b304a01 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b3049f0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b304a20 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b304a60 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac05b08
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b304ae0 00007ffd`e79ed289 : 00000000`0000052c 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b304b30 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b304b50
0000d209`ecb37c73 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b304b60 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b304b90 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b304bc0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b304d01 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b304cf0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b304d20 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b304d60 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac05288
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b304de0 00007ffd`e79ed289 : 00000000`0000052b 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b304e30 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b304e50
0000d209`ecb37973 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b304e60 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b304e90 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b304ec0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b305001 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b304ff0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b305020 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b305060 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac04f58
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b3050e0 00007ffd`e79ed289 : 00000000`0000052a 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b305130 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b305150
0000d209`ecb36673 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b305160 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b305190 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b3051c0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b305301 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b3052f0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b305320 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b305360 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac05288
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b3053e0 00007ffd`e79ed289 : 00000000`00000529 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b305430 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b305450
0000d209`ecb36373 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b305460 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b305490 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b3054c0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b305601 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b3055f0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b305620 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b305660 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac05068
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b3056e0 00007ffd`e79ed289 : 00000000`00000528 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b305730 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b305750
0000d209`ecb36073 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
0000000e`6b305760 00007ffd`e8fffe24 : 00000162`7a942780 00000000`00000000
00000162`7ac036b0 00007ffe`74493924 :
kdeconnectcore!LinkProvider::~LinkProvider+0x645f3
0000000e`6b305790 00007ffd`e7a6bf31 : 00000000`00000000 00000000`00000000
00000000`00000000 00007ffe`3f5aba45 :
kdeconnectcore!LinkProvider::~LinkProvider+0x66f2b
0000000e`6b3057c0 00007ffd`e7a6edb4 : 00000162`7a942280 00007ffe`00000005
00000000`00000003 0000000e`6b305901 :
Qt6Core!QObject::qt_static_metacall+0x1491
0000000e`6b3058f0 00007ffd`e79e9ce3 : 00000000`00000015 00000162`7a942280
00000000`00000015 00000162`7a572dd0 : Qt6Core!QMetaObject::activate+0x84
0000000e`6b305920 00007ffd`e63be24c : 0000004f`00000001 00000000`00000015
00007ffe`3f64cb00 00007ffe`3f5ce5d7 : Qt6Core!QIODevice::bytesWritten+0x33
0000000e`6b305960 00007ffd`e79ed562 : 00000162`782e1c20 00000162`7ac057d8
00000000`00000015 00000000`00000000 :
Qt6Bluetooth!QBluetoothServer::setMaxPendingConnections+0xb67c
0000000e`6b3059e0 00007ffd`e79ed289 : 00000000`00000527 00000000`00000015
41e95b6e`c54c95d9 00000162`7a942280 : Qt6Core!QIODevice::write+0x282
0000000e`6b305a30 00007ffd`e8ffd4ec : 00007ffe`3f64cb00 0000000e`6b305a50
0000d209`ecb36d73 00007ffe`3f5b8e41 : Qt6Core!QIODevice::write+0x39
STACK_COMMAND: .ecxr ; ~~[0x3688]s ; .frame ffffffff ; ~5s; .ecxr ; kb
IP_IN_PAGED_CODE:
Qt6Core!QIODevice::write+282
00007ffd`e79ed562 488bd8 mov rbx,rax
SYMBOL_NAME: msvcrt!malloc+70
MODULE_NAME: msvcrt
IMAGE_NAME: msvcrt.dll
FAILURE_BUCKET_ID: STACK_OVERFLOW_c00000fd_msvcrt.dll!malloc
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 7.0.26100.9444
FAILURE_ID_HASH: {27975aa2-36ea-061b-f28e-5dd1dabd3671}
Followup: MachineOwner
I will also attach the dmp-file.
EXPECTED RESULT
The bluetooth backend should work as intended
SOFTWARE/OS VERSIONS
KDE Connect: 26.08.1
Windows 11 Version 25H2
KDE Frameworks: 6.30.0
Qt: 6.11.1
Build ABI: x86_64-little_endian-llp64
Kernel: winnt 10.0.26200
ADDITIONAL INFORMATION
Before I issued this ticked, I already started a discussion in the forum with
additional findings:
https://discuss.kde.org/t/possible-stack-overflow-on-windows-using-kdeconnect-with-bluetooth-as-backend/50938
--
You are receiving this mail because:
You are watching all bug changes.
