https://bugs.kde.org/show_bug.cgi?id=527513
Bug ID: 527513
Summary: Plasmashell segfaults at login when a KIO HTTPS
request encounters an untrusted TLS certificate
Classification: Plasma
Product: plasmashell
Version First 6.6.6
Reported In:
Platform: Kubuntu
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: generic-crash
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
Created attachment 197436
--> https://bugs.kde.org/attachment.cgi?id=197436&action=edit
sanitized crashing-thread backtrace
SUMMARY
Plasmashell reliably crashed during login on a network where some HTTPS traffic
is TLS-intercepted by an enterprise CA that was not trusted by the local system
CA bundle. The crash occurred when a KIO worker consulted kssld about the
certificate. The journal shows many Qt cross-thread QObject warnings
immediately before the segfault, including a QTextDocument owned by a non-GUI
thread. The top of the crashing stack is QLabel::paintEvent ->
QTextDocument::setPlainText -> QTextDocumentPrivate::clear ->
QTextDocumentLayout::doLayout -> QTextFrame::begin.
This appears to be a KIO/KF6 UI threading bug exposed through Plasmashell: a
certificate-error UI (or related widget tree) is constructed or used from a
non-GUI thread. An untrusted certificate should cause a failed request or a
safely presented error on the GUI thread; it should never crash the shell.
ENVIRONMENT
- Kubuntu 26.04
- plasmashell / plasma-workspace 6.6.6 (Ubuntu package 4:6.6.6-0ubuntu0.1)
- Qt 6.10.2
- KDE Frameworks 6.24.0
- KIO / kssld from KF 6.24.0
- Wayland session
- Wired Ethernet active before login
STEPS TO REPRODUCE
1. Connect the machine to a network where at least one HTTPS endpoint used by
an in-shell KIO fetch is intercepted/re-signed by an enterprise CA that is NOT
in the system trust bundle.
2. Have a normal Plasma desktop configuration that performs an HTTPS KIO fetch
at session startup or when connectivity appears (the affected machine had the
Weather widget/data engine loaded; the exact fetching component was not
conclusively identified).
3. Log in to Plasma with the network already active.
ACTUAL RESULT
- A KIO worker activates org.kde.kssld6.
- Plasmashell logs repeated warnings: "QObject: Cannot create children for a
parent that is in a different thread." Parent objects include Oxygen
widget/label/scrollbar engines and, critically, a QTextDocument owned by the
other thread.
- Plasmashell segfaults while painting a QLabel and laying out its
QTextDocument.
- systemd restarts Plasmashell; it crashes repeatedly until the service start
limit is reached, leaving the desktop unusable.
- The problem persisted with only the wired connection active.
EXPECTED RESULT
The HTTPS request should fail gracefully and/or a certificate warning should be
shown from the GUI thread. Plasmashell should remain running.
CRASHING STACK (top frames)
#4 QTextFrame::begin() (libQt6Gui)
#7 QTextDocumentLayout::doLayout(int, int, int)
#8 QTextDocumentLayout::documentChanged(int, int, int)
#9 QTextDocumentPrivate::clear()
#10 QTextDocument::setPlainText(QString const&)
#14 QLabel::paintEvent(QPaintEvent*)
The full sanitized crashing-thread backtrace is attached.
WORKAROUND / CONFIRMING FIX
Installing the enterprise root CA into the system CA bundle as a plain PEM
X.509 certificate (so the intercepted chain verifies) completely stops the
crash. After that change, the same machine reboots and logs in on the same
network with Plasmashell surviving. This confirms the untrusted-certificate
path is the trigger, but it should not be required to avoid a shell crash.
ATTACHMENTS
1. backtrace-crashing-thread.txt - sanitized coredump header and
crashing-thread stack.
2. journal-excerpt-first-crash.txt - sanitized user-journal excerpt around the
first crash, including kssld activation and cross-thread warnings.
--
You are receiving this mail because:
You are watching all bug changes.
