crash in file_unix isOnCifs if checked against btrfs(when overwriting files in btrfs on Dolphin)

[msaxl]

kio 5.110.0 unfortunately has a bug that it crashes if file_unix isOnCifs is called with a file that is on a btrfs filesystem

Upstream has already a fix:
https://invent.kde.org/frameworks/kio/-/merge_requests/1411
https://invent.kde.org/frameworks/kio/-/commit/a6f7d3117f159f3e0a88ff08b5f69b9bc8612cf7

This fix however is for kio 6

I attached a backport of the commit above.

The second patch would be a fix for the underlying btrfs issue (discussed here:
https://invent.kde.org/frameworks/kio/-/merge_requests/1422
https://bugs.kde.org/show_bug.cgi?id=474680)

When applying this patch you see the mounted from / mounted to info in the properties dialog of a directory in dolphin (that else is empty, but at least dolphin does not crash)

[Ultralux97 (ultralux97)]

Application: okular (23.08.0)

Qt Version: 5.15.10
Frameworks Version: 5.110.0
Operating System: Linux 6.5.2-1-clear x86_64
Windowing System: Wayland
Distribution: Arch Linux
DrKonqi: 5.27.7 [KCrashBackend]

-- Information about the crash:
Steps to reproduce:
1. Open PDF file (saved from exporting a docx from Word if this is relevant)
2. Open typewriter annotation, make some text.
3. Save

The saving crashes it.

The crash can be reproduced every time.

-- Backtrace:
Application: Okular (okular), signal: Segmentation fault
Content of s_kcrashErrorMessage: std::unique_ptr<char []> = {get() = 0x0}
[KCrash Handler]
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x55e38737d980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x000055e3b494a87d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x55e379f75b70, srcUrl=..., destUrl=<optimized out>, _mode=-1, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x000055e3db31c8db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x55e379f75b80, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364
#11 0x000055e3db31520e in KIO::SlaveBase::dispatchLoop() (this=0x55e379f75b80) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:342
#12 0x000055e3db395e87 in KIO::WorkerThread::run() (this=0x55e3ded98300) at /usr/src/debug/kio/kio-5.110.0/src/core/workerthread.cpp:62
#13 0x000055e3d98f35da in operator() (__closure=<optimized out>) at thread/qthread_unix.cpp:350
#14 (anonymous namespace)::terminate_on_exception<QThreadPrivate::start(void*)::<lambda()> > (t=<optimized out>) at thread/qthread_unix.cpp:287
#15 QThreadPrivate::start(void*) (arg=0x55e3ded98300) at thread/qthread_unix.cpp:310
#16 0x000055e3d908c9eb in start_thread (arg=<optimized out>) at pthread_create.c:444
#17 0x000055e3d9110dfc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Thread 11 (Thread 0x55e3c4eb86c0 (LWP 6334) "okular:sh5"):
#1 __futex_abstimed_wait_common (futex_word=futex_word@entry=0x55e3dc1122b8, expected=expected@entry=0, clockid=clockid@entry=0, abstime=abstime@entry=0x0, private=private@entry=0, cancel=cancel@entry=true) at futex-internal.c:87
#2 0x000055e3d908952f in __GI___futex_abstimed_wait_cancelable64 (futex_word=futex_word@entry=0x55e3dc1122b8, expected=expected@entry=0, clockid=clockid@entry=0, abstime=abstime@entry=0x0, private=private@entry=0) at futex-internal.c:139
#3 0x000055e3d908bd40 in __pthread_cond_wait_common (abstime=0x0, clockid=0, mutex=0x55e3dc112268, cond=0x55e3dc112290) at pthread_cond_wait.c:503
#4 ___pthread_cond_wait (cond=0x55e3dc112290, mutex=0x55e3dc112268) at pthread_cond_wait.c:618
#5 0x000055e3cc2c794c in cnd_wait () at ../mesa-23.1.7/src/c11/impl/threads_posix.c:135
#6 util_queue_thread_func() () at ../mesa-23.1.7/src/util/u_queue.c:290
#7 0x000055e3cc31485c in imp...

[Arojas-8 (arojas-8)]

*** Bug 474429 has been marked as a duplicate of this bug. ***

[Arojas-8 (arojas-8)]

*** Bug 474466 has been marked as a duplicate of this bug. ***

[Arojas-8 (arojas-8)]

*** Bug 474491 has been marked as a duplicate of this bug. ***

[Arojas-8 (arojas-8)]

*** Bug 474512 has been marked as a duplicate of this bug. ***

[Arojas-8 (arojas-8)]

*** Bug 474521 has been marked as a duplicate of this bug. ***

[Matheust-- (matheust--)]

Created attachment 161625
New crash information added by DrKonqi

dolphin (23.08.0) using Qt 5.15.10

Steps to reproduce:
1- Create two files, let's say "test1.txt" and "test2.txt".
2- Select "test1.txt", hit Ctrl+C and Ctrl+V.
3- Dolphin will ask what you want to call the new copy, type "test2.txt".
4- Dolphin will ask if you want to overwrite the file.
5- Overwrite it.
6- Dolphin crashes and no file operation is performed.

-- Backtrace (Reduced):
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x7f2929f7a980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x00007f2940f3c87d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x7f29080012d0, srcUrl=..., destUrl=<optimized out>, _mode=420, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x00007f294aa2e8db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x7f29080012e0, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364

[Arojas-8 (arojas-8)]

*** Bug 474536 has been marked as a duplicate of this bug. ***

[Zincles (zincles)]

Created attachment 161627
New crash information added by DrKonqi

dolphin (23.08.1) using Qt 5.15.10

Dolphin crashes while trying to override any file.
for example:
create a file at ~/folder1/sth.txt;
create another at ~/folder2/sth.txt;
while I tries to copy the first file to overwrite the second file, while I click the "overwrite" button, the dolphin would immediately crash.
this problem seems to be happend on many other arch linux users. I also tried flatpak version of dolphin, and same bug happened.

-- Backtrace (Reduced):
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x7fc869f7a980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x00007fc87616987d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x7fc82c0012d0, srcUrl=..., destUrl=<optimized out>, _mode=420, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x00007fc89c5998db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x7fc82c0012e0, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364

[Bug-janitor (bug-janitor)]

A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kio/-/merge_requests/1411

[Thibaud-laurent (thibaud-laurent)]

Created attachment 161630
New crash information added by DrKonqi

dolphin (23.08.1) using Qt 5.15.10

KDE Dolphin seems to crash whenever I try to cut / paste and replace (or copy / paste and replace) files across two different drives. This does not seem to happen on the same drive.

-- Backtrace (Reduced):
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x7ff9fcad9980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x00007ffa1d5d587d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x7ff9d8000d70, srcUrl=..., destUrl=<optimized out>, _mode=420, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x00007ffa3d67e8db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x7ff9d8000d80, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364

[Y-mik6-8 (y-mik6-8)]

something that might help:

My system is on btrfs. The crash (not okular but kdevelop) crashes when copying a file to /tmp

if I do mount -t tmpfs none /tmp the crash does not happen (KMountPoint::List::findByPath works)

I have my system running off of a cryptsetup lvm. Running stat on / gives me 0:28 whereas mountinfo shows 0:26. guess that's the root cause of the issue..

[Y-mik6-8 (y-mik6-8)]

(In reply to mike from comment #11)
> something that might help:
>
> My system is on btrfs. The crash (not okular but kdevelop) crashes when
> copying a file to /tmp
>
> if I do mount -t tmpfs none /tmp the crash does not happen
> (KMountPoint::List::findByPath works)
>
> I have my system running off of a cryptsetup lvm. Running stat on / gives me
> 0:28 whereas mountinfo shows 0:26. guess that's the root cause of the issue..

actually btrfs over lvm over cryptsetup. Guess in that case st_dev in stat does not match mountinfo, so the assumption that mountPtr->deviceId() == buff.st_dev matches at least once is in practice wrong (don't know if this is how it should work or a kernel bug, but the kernel used in my setup is currently 6.2)

[ervin (ervin)]

Git commit a6f7d3117f159f3e0a88ff08b5f69b9bc8612cf7 by Kevin Ottens, on behalf of Kevin Ottens.
Committed on 15/09/2023 at 13:34.
Pushed by ervin into branch 'master'.

Don't crash if KMountPoint gives nothing back while checking for CIFS

M +3 -0 src/kioworkers/file/file_unix.cpp

https://invent.kde.org/frameworks/kio/-/commit/a6f7d3117f159f3e0a88ff08b5f69b9bc8612cf7

[Arojas-8 (arojas-8)]

*** Bug 474555 has been marked as a duplicate of this bug. ***

[Fanzhuyifan (fanzhuyifan)]

Created attachment 161647
New crash information added by DrKonqi

okular (23.08.0) using Qt 5.15.10

Crashes when saving editted file, or when using save as to overwrite existing file. Does not crash when using save as to new file.

-- Backtrace (Reduced):
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x7f1627f7e980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x00007f16900a587d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x7f161c407f70, srcUrl=..., destUrl=<optimized out>, _mode=-1, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x00007f16c09b48db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x7f161c407f80, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364

[Fanzhuyifan (fanzhuyifan)]

Created attachment 161648
New crash information added by DrKonqi

okular (23.08.1) using Qt 5.15.10

crash on save, on save-as to existing file (overwrite). Does not crash on save-as to new file.

-- Backtrace (Reduced):
#6 QString::QString(QString const&) (other=<error reading variable: Cannot access memory at address 0x8>, this=0x7f8197f7e980, this=<optimized out>, other=<optimized out>) at /usr/include/qt/QtCore/qstring.h:1093
#7 KMountPoint::mountType() const (this=0x0) at /usr/src/debug/kio/kio-5.110.0/src/core/kmountpoint.cpp:411
#8 0x00007f81c821387d in isOnCifsMount (filePath=...) at /usr/include/qt/QtCore/qshareddata.h:161
#9 FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) (this=0x7f8140317b20, srcUrl=..., destUrl=<optimized out>, _mode=-1, _flags=...) at /usr/src/debug/kio/kio-5.110.0/src/ioslaves/file/file_unix.cpp:743
#10 0x00007f81eab2b8db in KIO::SlaveBase::dispatch(int, QByteArray const&) (this=0x7f8140317b30, command=<optimized out>, data=...) at /usr/src/debug/kio/kio-5.110.0/src/core/slavebase.cpp:1364

[ervin (ervin)]

Git commit 48322f44323a1fc09305d66d9093fe6c3780709e by Kevin Ottens, on behalf of Kevin Ottens.
Committed on 15/09/2023 at 19:00.
Pushed by ngraham into branch 'kf5'.

Don't crash if KMountPoint gives nothing back while checking for CIFS

M +3 -0 src/ioslaves/file/file_unix.cpp

https://invent.kde.org/frameworks/kio/-/commit/48322f44323a1fc09305d66d9093fe6c3780709e

[Pollob666-f (pollob666-f)]

Created attachment 161676
New crash information added by DrKonqi

dolphin (23.08.0) using Qt 5.15.10

I was trying to overwrite some files in a directory, and it crashed. I tried repeatedly, but everytime it crashed. I am running Fedora KDE Spin, My Fielsystem is BTRFS. I have also tried with Krusader, and the crash happened there also.

-- Backtrace (Reduced):
#4 0x00007ff26e2cf054 in KMountPoint::mountType() const () from /lib64/libKF5KIOCore.so.5
#5 0x00007ff244023136 in FileProtocol::copy(QUrl const&, QUrl const&, int, QFlags<KIO::JobFlag>) () from /usr/lib64/qt5/plugins/kf5/kio/kio_file.so
#6 0x00007ff26e27cfba in KIO::SlaveBase::dispatch(int, QByteArray const&) () from /lib64/libKF5KIOCore.so.5
#7 0x00007ff26e275a3d in KIO::SlaveBase::dispatchLoop() () from /lib64/libKF5KIOCore.so.5
#8 0x00007ff26e2f35e8 in KIO::WorkerThread::run() () from /lib64/libKF5KIOCore.so.5

[Albert Astals Cid (aacid)]

*** Bug 474654 has been marked as a duplicate of this bug. ***

[Givenpurity (givenpurity)]

(In reply to Albert Astals Cid from comment #19)
> *** Bug 474654 has been marked as a duplicate of this bug. ***

But I am running 23.08.1, long after this is "fixed". Still considered a duplicate?

[Y-mik6-8 (y-mik6-8)]

(In reply to GivenPurity from comment #20)
> (In reply to Albert Astals Cid from comment #19)
> > *** Bug 474654 has been marked as a duplicate of this bug. ***
>
> But I am running 23.08.1, long after this is "fixed". Still considered a
> duplicate?

This bug is not in kde gear but in kde frameworks. It was fixed in upstream development and will be release with kde frameworks 5.111 that has not been released yet.

This bug hits everyone who has kio 5.110 and copies (or overwrites) a file on a btrfs using a kde application that uses kio to do that.
This bug was introduced as a fix for the same operation but on cifs where a rename operation could fail.

Essentially it was done by looking up the mountpoint for the destination file and if that is cifs/smb it would behave different. The issue with btrfs is that the way the lookup is done does not work with that filesystem (still doesn't, but for the use case all that is needed is to know if the file is on cifs. A method in kio could not handle that case and exactly that was causing the crash)

[Albert Astals Cid (aacid)]

*** Bug 474850 has been marked as a duplicate of this bug. ***

[Arojas-8 (arojas-8)]

*** Bug 474902 has been marked as a duplicate of this bug. ***

[msaxl (saxl)]

btrfs handling in kmountinfo

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "bug-474451.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Fanzhuyifan (fanzhuyifan)]

*** Bug 476432 has been marked as a duplicate of this bug. ***

[Y-mik6-8 (y-mik6-8)]

For (k)ubuntu see https://bugs.launchpad.net/ubuntu/+source/kio/+bug/2039765
if this gets more attention maybe someone will backport this to 23.10

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[林博仁(Buo-ren, Lin) (buo-ren-lin)]

This bug is also triggered when one attempts to overwrite a file that is in a BTRFS file system on the Dolphin file manager, which is a very common scenario of file management.

Is there any way to facilitate the process of merging the patch(es)?

[林博仁(Buo-ren, Lin) (buo-ren-lin)]

The upstream bug report of the crash on file overwriting is: https://bugs.kde.org/show_bug.cgi?id=474451

[林博仁(Buo-ren, Lin) (buo-ren-lin)]

I have attempted to escalate this bug on the Ubuntu Community Hub: https://discourse.ubuntu.com/t/overwriting-files-on-the-btrfs-file-system-on-kubuntu-23-10-crash/40822

[林博仁(Buo-ren, Lin) (buo-ren-lin)]

I can verify that after applying the bug-474451.patch patch this bug is no longer reproduced.

[林博仁(Buo-ren, Lin) (buo-ren-lin)]

Another crash triggered in a slightly different scenario(overwrite multiple files and directories vs. overwrite single file) seems resolved by applying the kmountpoint-btrfs.patch patch.

[Rufus Laggren (rlaggren)]

Same (exact) thing, opensuse 15.5

Why is this marked "Resolved Fixed" when it demonstrably is not? If there is a kludge to make it work, why is it not provided here?

[Rufus Laggren (rlaggren)]

It hits me with ext4 file system.

[Fanzhuyifan (fanzhuyifan)]

(In reply to rlaggren from comment #26)
> Same (exact) thing, opensuse 15.5
>
> Why is this marked "Resolved Fixed" when it demonstrably is not? If there is
> a kludge to make it work, why is it not provided here?

If you look carefully at the information fields at the top of the page, you can see that this is fixed in Frameworks version 5.111, with the commit fixing the issue being https://invent.kde.org/frameworks/kio/-/commit/48322f44323a1fc09305d66d9093fe6c3780709e.

Please submit a new bug report if you are on a version newer than 5.111 and you still see this issue. If you are still on versions before 5.111, you would need to contact the maintainers of your distribution to have the fix backported, or to update to the latest version.

[Rufus Laggren (rlaggren)]

Thx for you quick response. Done. That is, I found a later version of
kio that was assembled to work with my distro release. I will try to
find the right way to report this to the distro.

On 1/31/24 10:04, <email address hidden> wrote:
...
> If you look carefully at the information fields at the top of the page, you can
> see that this is fixed in Frameworks version 5.111, with the commit fixing the
> issue being

[Fanzhuyifan (fanzhuyifan)]

*** Bug 485191 has been marked as a duplicate of this bug. ***