lxqt-powermanagement crashes with SIGSEGV in QHashData::nextNode()

[thedoctar]

I'm using backports, version 1.1 of lxqt-powermanagement. Just before it crashes, I get this dmesg:

Aug 19 15:09:29 dell-XPS-13-9360 kernel: ucsi_acpi USBC000:00: ucsi_handle_connector_change: ACK failed (-110)

== Disassembly =================================
=> 0x7ff80b880017 <_ZN9QHashData8nextNodeEPNS_4NodeE+7>: cmpq $0x0,(%r8)
   0x7ff80b88001b <_ZN9QHashData8nextNodeEPNS_4NodeE+11>: je 0x7ff80b880028 <_ZN9QHashData8nextNodeEPNS_4NodeE+24>
   0x7ff80b88001d <_ZN9QHashData8nextNodeEPNS_4NodeE+13>: mov %r8,%rax
   0x7ff80b880020 <_ZN9QHashData8nextNodeEPNS_4NodeE+16>: ret
   0x7ff80b880021 <_ZN9QHashData8nextNodeEPNS_4NodeE+17>: nopl 0x0(%rax)
   0x7ff80b880028 <_ZN9QHashData8nextNodeEPNS_4NodeE+24>: mov 0x20(%r8),%ecx
   0x7ff80b88002c <_ZN9QHashData8nextNodeEPNS_4NodeE+28>: mov 0x8(%rdi),%eax
   0x7ff80b88002f <_ZN9QHashData8nextNodeEPNS_4NodeE+31>: xor %edx,%edx
   0x7ff80b880031 <_ZN9QHashData8nextNodeEPNS_4NodeE+33>: div %ecx
   0x7ff80b880033 <_ZN9QHashData8nextNodeEPNS_4NodeE+35>: mov 0x8(%r8),%rax
   0x7ff80b880037 <_ZN9QHashData8nextNodeEPNS_4NodeE+39>: add $0x1,%edx
   0x7ff80b88003a <_ZN9QHashData8nextNodeEPNS_4NodeE+42>: movslq %edx,%rsi
   0x7ff80b88003d <_ZN9QHashData8nextNodeEPNS_4NodeE+45>: lea (%rax,%rsi,8),%rax
   0x7ff80b880041 <_ZN9QHashData8nextNodeEPNS_4NodeE+49>: sub %edx,%ecx
   0x7ff80b880043 <_ZN9QHashData8nextNodeEPNS_4NodeE+51>: je 0x7ff80b88001d <_ZN9QHashData8nextNodeEPNS_4NodeE+13>
   0x7ff80b880045 <_ZN9QHashData8nextNodeEPNS_4NodeE+53>: mov %ecx,%ecx

== SegvAnalysis =================================
Segfault happened at: 0x7ff80b880017 <_ZN9QHashData8nextNodeEPNS_4NodeE+7>: cmpq $0x0,(%r8)
PC (0x7ff80b880017) ok
source "$0x0" ok
destination "(%r8)" (0x55aff33c714e) not located in a known VMA region (needed writable region)!

== SegvReason =================================
writing unknown VMA

== Stacktrace =================================
#0 0x00007ff80b880017 in QHashData::nextNode(QHashData::Node*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#1 0x00007ff80cc1dee8 in () at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
#2 0x00007ff80ba69783 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#3 0x00007ff80cc1dc75 in AbstractSystemPoller::timeoutReached(int) () at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
#4 0x00007ff805e88e3b in () at /usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/org.kde.kidletime.platforms/KF5IdleTimeXcbPlugin0.so
#5 0x00007ff80ba2f1f7 in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#6 0x00007ff807544b05 in QXcbConnection::handleXcbEvent(xcb_generic_event_t*) () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#7 0x00007ff807546116 in QXcbConnection::processXcbEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#8 0x00007ff80756cd67 in () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#9 0x00007ff80aed6d1b in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#10 0x00007ff80af2b6f8 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007ff80aed43c3 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007ff80ba8b11e in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#13 0x00007ff80ba3074b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#14 0x00007ff80ba38ce4 in QCoreApplication::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#15 0x000055aaa7d6e764 in ()
#16 0x00007ff80b264d90 in __libc_start_call_main (main=main@entry=0x55aaa7d6e4b0, argc=argc@entry=1, argv=argv@entry=0x7ffd0a5d8de8) at ../sysdeps/nptl/libc_start_call_main.h:58
        self = <optimised out>
        result = <optimised out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -3276756896878161960, 140724777356776, 94191448679600, 94191448786424, 140703344087104, 3277646694342594520, 3275956111417413592}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x55aaa7d8a008, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = -1478975480}}}
        not_first_call = <optimised out>
#17 0x00007ff80b264e40 in __libc_start_main_impl (main=0x55aaa7d6e4b0, argc=1, argv=0x7ffd0a5d8de8, init=<optimised out>, fini=<optimised out>, rtld_fini=<optimised out>, stack_end=0x7ffd0a5d8dd8) at ../csu/libc-start.c:392
#18 0x000055aaa7d6f095 in _start ()

== StacktraceTop =================================
QHashData::nextNode(QHashData::Node*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
() at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
() at /lib/x86_64-linux-gnu/libQt5Core.so.5
AbstractSystemPoller::timeoutReached(int) () at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
() at /usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/org.kde.kidletime.platforms/KF5IdleTimeXcbPlugin0.so

== ThreadStacktrace =================================
.
Thread 4 (Thread 0x7ff805e67640 (LWP 1228)):
#0 pselect64_syscall (sigmask=<optimised out>, timeout=<optimised out>, exceptfds=0x0, writefds=0x0, readfds=0x7ff805e5eac0, nfds=19) at ../sysdeps/unix/sysv/linux/pselect.c:34
        sc_ret = -514
        sc_cancel_oldtype = 0
        data = {0, 8}
        tval = {tv_sec = 0, tv_nsec = 906853570}
#1 __pselect (nfds=19, readfds=0x7ff805e5eac0, writefds=0x0, exceptfds=0x0, timeout=<optimised out>, sigmask=<optimised out>) at ../sysdeps/unix/sysv/linux/pselect.c:56
        tval = {tv_sec = 0, tv_nsec = 906853570}
#2 0x00007ff809e1803d in () at /lib/x86_64-linux-gnu/libusbmuxd-2.0.so.6
#3 0x00007ff809e18d88 in () at /lib/x86_64-linux-gnu/libusbmuxd-2.0.so.6
#4 0x00007ff80b2cfb43 in start_thread (arg=<optimised out>) at ./nptl/pthread_create.c:442
        ret = <optimised out>
        pd = <optimised out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140724777354352, -3276756896878030888, 140703227606592, 2, 140703316113488, 140724777354704, 3275969856415338456, 3275956065916948440}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimised out>
#5 0x00007ff80b361a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
.
Thread 3 (Thread 0x7ff807356640 (LWP 1221)):
#0 0x00007ff80b353d7f in __GI___poll (fds=0x7ff807355ac8, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
        sc_ret = -516
        sc_cancel_oldtype = 0
#1 0x00007ff80afe27e2 in () at /lib/x86_64-linux-gnu/libxcb.so.1
#2 0x00007ff80afe422c in xcb_wait_for_event () at /lib/x86_64-linux-gnu/libxcb.so.1
#3 0x00007ff80756bd08 in () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#4 0x00007ff80b844ca1 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#5 0x00007ff80b2cfb43 in start_thread (arg=<optimised out>) at ./nptl/pthread_create.c:442
        ret = <optimised out>
        pd = <optimised out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140724777354112, -3276756896878030888, 140703249557056, 11, 140703316113488, 140724777354464, 3275964779227123672, 3275956065916948440}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimised out>
#6 0x00007ff80b361a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
.

Thread 2 (Thread 0x7ff806981640 (LWP 1227)):
#0 0x00007ff80b353d7f in __GI___poll (fds=0x7ff7f80266d0, nfds=6, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
        sc_ret = -516
        sc_cancel_oldtype = 0
#1 0x00007ff80af2b696 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 0x00007ff80aed43c3 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00007ff80ba8b0a8 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#4 0x00007ff80ba3074b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#5 0x00007ff80b843af2 in QThread::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#6 0x00007ff80bceff0b in () at /lib/x86_64-linux-gnu/libQt5DBus.so.5
#7 0x00007ff80b844ca1 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#8 0x00007ff80b2cfb43 in start_thread (arg=<optimised out>) at ./nptl/pthread_create.c:442
        ret = <optimised out>
        pd = <optimised out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140724777354560, -3276756896878030888, 140703239247424, 2, 140703316113488, 140724777354912, 3275968259761246168, 3275956065916948440}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimised out>
#9 0x00007ff80b361a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
.
Thread 1 (Thread 0x7ff807c02940 (LWP 1215)):
#0 0x00007ff80b880017 in QHashData::nextNode(QHashData::Node*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#1 0x00007ff80cc1dee8 in () at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
#2 0x00007ff80ba69783 in () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#3 0x00007ff80cc1dc75 in AbstractSystemPoller::timeoutReached(int) () at /lib/x86_64-linux-gnu/libKF5IdleTime.so.5
#4 0x00007ff805e88e3b in () at /usr/lib/x86_64-linux-gnu/qt5/plugins/kf5/org.kde.kidletime.platforms/KF5IdleTimeXcbPlugin0.so
#5 0x00007ff80ba2f1f7 in QAbstractEventDispatcher::filterNativeEvent(QByteArray const&, void*, long*) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#6 0x00007ff807544b05 in QXcbConnection::handleXcbEvent(xcb_generic_event_t*) () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#7 0x00007ff807546116 in QXcbConnection::processXcbEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#8 0x00007ff80756cd67 in () at /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5
#9 0x00007ff80aed6d1b in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#10 0x00007ff80af2b6f8 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#11 0x00007ff80aed43c3 in g_main_context_iteration () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007ff80ba8b11e in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#13 0x00007ff80ba3074b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#14 0x00007ff80ba38ce4 in QCoreApplication::exec() () at /lib/x86_64-linux-gnu/libQt5Core.so.5
#15 0x000055aaa7d6e764 in ()
#16 0x00007ff80b264d90 in __libc_start_call_main (main=main@entry=0x55aaa7d6e4b0, argc=argc@entry=1, argv=argv@entry=0x7ffd0a5d8de8) at ../sysdeps/nptl/libc_start_call_main.h:58
        self = <optimised out>
        result = <optimised out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -3276756896878161960, 140724777356776, 94191448679600, 94191448786424, 140703344087104, 3277646694342594520, 3275956111417413592}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x55aaa7d8a008, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = -1478975480}}}
        not_first_call = <optimised out>
#17 0x00007ff80b264e40 in __libc_start_main_impl (main=0x55aaa7d6e4b0, argc=1, argv=0x7ffd0a5d8de8, init=<optimised out>, fini=<optimised out>, rtld_fini=<optimised out>, stack_end=0x7ffd0a5d8dd8) at ../csu/libc-start.c:392
#18 0x000055aaa7d6f095 in _start ()

== Title =================================
lxqt-powermanagement crashed with SIGSEGV in QHashData::nextNode()

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Cedders (cedric-gn)]

Package: libkf5idletime5 5.92.0-0ubuntu1

I'm seeing the same segfault and symptoms without using any backports, after upgrading from Lubuntu 21.10 to 22.04.1 LTS. A third user has also reported the crash after a similar upgrade on an upstream bug: https://github.com/lxqt/lxqt/discussions/2219#discussioncomment-3285033 That bug includes developer comments for Arch, which would imply a bug in libkf5idletime5 5.92.0-0ubuntu1.

Steps to reproduce:
0) upgrade Lubunutu from 21.10 to 22.04.1
1) in Power Management Settings, go to Idle, tick 'Enable Backlight Change'. Set idle time to 00:30 (30 seconds), and close.
2) wait 10 seconds

Expected behaviour:
Backlight dims until keystroke or pointer movement, then returns to previous value, and lxqt-powermanagment continues to function.

Experienced behaviour:
Backlight dims, segmentation fault and icon disappears from Status Notifier. Backlight remains dimmed on keystroke and requires manual brightening. Eventually popup that 'Power Management has crashed too many times.'

Sep 6 16:35:38 laptop kernel: [ 4614.857616] lxqt-powermanag[5907]: segfault at 126c ip 00007f958f3d1059 sp 00007ffd4d569b68 error 4 in libQt5Core.so.5.15.3[7f958f357000+30f000]
Sep 6 16:35:38 laptop kernel: [ 4614.857649] Code: 31 d2 f7 f1 49 8b 40 08 83 c2 01 48 63 f2 48 8d 04 f0 29 d1 74 d8 89 c9 48 8d 0c c8 eb 0c 0f 1f 00 48 83 c0 08 48 39 c8 74 c4 <48> 8b 10 49 39 d0 74 ef 49 89 d0 4c 89 c0 c3 0f 1f 84 00 00 00 00

Notes: bug 1987667 by the original reporter looks closely related in kidletime.

[thedoctar (thedoctar)]

Some more output data when running lxqt-powermanagement
----
QString::arg: Argument missing: "9 minute(s)" , 9
QString::arg: Argument missing: "2 hour(s)" , 2
QString::arg: Argument missing: "9 minute(s)" , 9
QString::arg: Argument missing: "2 hour(s)" , 2
BatteryChanged discharging: true chargeLevel: 85.8304 actionTime: QTime(Invalid)
QString::arg: Argument missing: "22 minute(s)" , 22
QString::arg: Argument missing: "6 hour(s)" , 6
BatteryChanged discharging: true chargeLevel: 85.2344 actionTime: QTime(Invalid)
QString::arg: Argument missing: "3 minute(s)" , 3
QString::arg: Argument missing: "6 hour(s)" , 6
QString::arg: Argument missing: "3 minute(s)" , 3
QString::arg: Argument missing: "6 hour(s)" , 6
BatteryChanged discharging: true chargeLevel: 84.706 actionTime: QTime(Invalid)
QString::arg: Argument missing: "31 minute(s)" , 31
QString::arg: Argument missing: "2 hour(s)" , 2
BatteryChanged discharging: true chargeLevel: 84.2455 actionTime: QTime(Invalid)
QString::arg: Argument missing: "27 minute(s)" , 27
QString::arg: Argument missing: "5 hour(s)" , 5
QString::arg: Argument missing: "27 minute(s)" , 27
QString::arg: Argument missing: "5 hour(s)" , 5
BatteryChanged discharging: true chargeLevel: 83.6494 actionTime: QTime(Invalid)
QString::arg: Argument missing: "38 minute(s)" , 38
QString::arg: Argument missing: "1 hour(s)" , 1
BatteryChanged discharging: true chargeLevel: 83.0127 actionTime: QTime(Invalid)
toggleShow
QString::arg: Argument missing: "21 minute(s)" , 21
QString::arg: Argument missing: "5 hour(s)" , 5
QString::arg: Argument missing: "21 minute(s)" , 21
QString::arg: Argument missing: "5 hour(s)" , 5
BatteryChanged discharging: true chargeLevel: 82.1999 actionTime: QTime(Invalid)
QString::arg: Argument missing: "27 minute(s)" , 27
QString::arg: Argument missing: "3 hour(s)" , 3
QString::arg: Argument missing: "27 minute(s)" , 27
QString::arg: Argument missing: "3 hour(s)" , 3
BatteryChanged discharging: true chargeLevel: 81.5904 actionTime: QTime(Invalid)
QString::arg: Argument missing: "16 minute(s)" , 16
QString::arg: Argument missing: "6 hour(s)" , 6
QString::arg: Argument missing: "16 minute(s)" , 16
QString::arg: Argument missing: "6 hour(s)" , 6
BatteryChanged discharging: true chargeLevel: 80.8859 actionTime: QTime(Invalid)
toggleShow
QString::arg: Argument missing: "39 minute(s)" , 39
QString::arg: Argument missing: "4 hour(s)" , 4
BatteryChanged discharging: true chargeLevel: 80.3305 actionTime: QTime(Invalid)
QString::arg: Argument missing: "15 minute(s)" , 15
QString::arg: Argument missing: "5 hour(s)" , 5
QString::arg: Argument missing: "15 minute(s)" , 15
QString::arg: Argument missing: "5 hour(s)" , 5
BatteryChanged discharging: true chargeLevel: 79.7345 actionTime: QTime(Invalid)
QString::arg: Argument missing: "4 minute(s)" , 4
QString::arg: Argument missing: "5 hour(s)" , 5
BatteryChanged discharging: true chargeLevel: 79.2333 actionTime: QTime(Invalid)
QString::arg: Argument missing: "6 minute(s)" , 6
QString::arg: Argument missing: "5 hour(s)" , 5
QString::arg: Argument missing: "6 minute(s)" , 6
QString::arg: Argument missing...