https://bugs.kde.org/show_bug.cgi?id=528285
Bug ID: 528285
Summary: Greeter crashes when remembered authenticator has been
disabled (null shared_ptr in
PAMAuthenticatorModel::isFunctional)
Classification: Plasma
Product: plasmashell
Version First 6.8.2
Reported In:
Platform: CachyOS
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: Screen locking
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: 1.0
Created attachment 198019
--> https://bugs.kde.org/attachment.cgi?id=198019&action=edit
Backtrace
Summary
`PamAuthenticators::m_authenticator` is initialised from the state config
(`~/.local/state/kscreenlockerrc`, `[Greeter] Authenticator`, written by
`saveAuthenticatorType()` after a
successful unlock). Nothing checks that this authenticator is still part of
`PAMAuthenticatorModel`, which only holds
the *enabled* descriptors (`makeDescriptors()` filters on `isEnabled()`).
`startAuthenticating()` then calls
`PAMAuthenticatorModel::instance()->isFunctional(m_authenticator)`:
```cpp
return m_hash.value(authenticator)->isFunctional(); // m_hash.value() ->
default-constructed (null) shared_ptr
```
`markDefunct()` has the same pattern.
**Reproduced (2026-11-03)**, without locking a session: `kscreenlocker_greet
--testing` with a scratch
`XDG_STATE_HOME` whose `kscreenlockerrc` says `[Greeter]
Authenticator=Fingerprint` (fingerprint not enabled) →
SIGSEGV within a second, every time. The backtrace goes from a QML property
write into a greeter method called from
QML (`QV4::QObjectMethod::callPrecise`), as expected for `isFunctional()`. The
same happens with
`Authenticator=Universal2Factor` when `[Authenticators] Universal2Factor` is
false or missing. With the method
enabled, there's no crash.
Steps to reproduce
1. Create a working `/etc/pam.d/kde-u2f` and set `kscreenlockerrc` →
`[Authenticators] Universal2Factor=true`.
2. Lock the screen, pick the key button, unlock with the key → state file now
says `Authenticator=Universal2Factor`.
3. Set `Universal2Factor=false` (or remove the line).
4. Lock the screen again.
Expected: the greeter falls back to the password authenticator.
Observed: null dereference in `isFunctional()` → greeter crash → "The screen
locker is broken" fallback.
The same applies to Smartcard, Face and Fingerprint-as-active.
--
You are receiving this mail because:
You are watching all bug changes.
