#1152434 libkf6svg6: crash in shared QSvgRenderer from async image provider breaks Plasma screen locker

Package:
libkf6svg6
Source:
libkf6svg6
Description:
library for rendering SVG-based themes
Submitter:
cen
Date:
2026-10-29 08:59:02 UTC
Severity:
normal
Tags:
#1152434#5
Date:
2026-10-29 08:56:36 UTC
From:
To:
Dear Maintainer,

On trixie with Plasma 6.3 on Wayland and the default Debian wallpaper
(desktop-base, ceratopsian theme, which ships SVG images only), the
screen locker greeter started crashing on me recently.

This started after I cleared up all local plasma cache, it worked
fine for a year.


"The screen locker is broken and unlocking is not possible anymore."

The session can then only be recovered from a VT with
"loginctl unlock-session <id>".

The journal shows, for each greeter restart:

  kscreenlocker_greet[163109]: PAM adding faulty module: pam_sss.so
   (unrelated)
  kwin_wayland_wrapper[163109]: pure virtual method called
  kwin_wayland_wrapper[163109]: terminate called without an active exception

Running the greeter in test mode under gdb
(/usr/lib/x86_64-linux-gnu/libexec/kscreenlocker_greet --testing, with
debuginfod.debian.net) reproduced the crash with this backtrace:

  Thread 40 "Thread (pooled)" received signal SIGSEGV, Segmentation fault.
  #0  createLinearGradientNode (node=0x7fff70047830, attributes=...,
handler=0x7fff6bffe080) at ./src/svg/qsvghandler.cpp:3036
  #1  QSvgHandler::startElement (...)
  #2  QSvgHandler::parse (this=0x7fff6bffe080) at
./src/svg/qsvghandler.cpp:4652
  #3  QSvgHandler::init () at ./src/svg/qsvghandler.cpp:4552
  #4  QSvgHandler::QSvgHandler (...) at ./src/svg/qsvghandler.cpp:4525
  #5  QSvgTinyDocument::load (...) at ./src/svg/qsvgtinydocument.cpp:214
  #6  loadDocument<QByteArray> (...) at ./src/svg/qsvgrenderer.cpp:418
  #7  QSvgRenderer::load (this=0x7fff6c0058a0, contents=...) at
./src/svg/qsvgrenderer.cpp:448
  #8  KSvg::SharedSvgRenderer::load(...) at ./src/ksvg/svg.cpp:137
  #9  KSvg::SharedSvgRenderer::reload (this=0x7fff6c0058a0) at
./src/ksvg/svg.cpp:105
  #10 KSvg::SvgPrivate::setImagePath (...) at ./src/ksvg/svg.cpp:525
  #11 KSvg::Svg::setImagePath (...) at ./src/ksvg/svg.cpp:1054
  #12 AsyncPackageImageResponseRunnable::run () at
./wallpapers/image/plugin/provider/packageimageprovider.cpp:95
  #13 QThreadPoolThread::run () at ./src/corelib/thread/qthreadpool.cpp:71
  #14-#18 QThreadPrivate::start / start_thread / clone3

This is likely the sharted SharedSvgRenderer bug fixed in KSvg 6.19.0:

  commit 741de4c9550b2009e5a8844ef8d413847521af63
  "Restrict shared rendering to the main thread"
https://invent.kde.org/frameworks/ksvg/-/commit/741de4c9550b2009e5a8844ef8d413847521af63

  "KSvg tries to share a renderer between instance. QSVGRenderer is not
   thread safe, and we have usage crashing. In particular in an async
   impage provider."

unstable/testing (6.30.0-1) already contain the fix. The upstream patch
adds four lines to one function and applies cleanly to 6.13.0-1.

The race condition is likely triggered due to my 3 monitor setup.

Considering that this bug can crash lockscreen and plasma (due to
wallpaper rendering)
because default ceratopsian theme is shipped as SVG,
could this patch be considered for stable backport?