kded crashes due to a use-after-free in current Debian bookworm/testing about packagekit-qt HOT 28 CLOSED

Update: Remove all local modifications of apper-1.0.0, then using blocking-properties branch but revert #28 :

diff blocking-properties-branch-transactionprivate.cpp packagekit-qt-1.1.0/src/transactionprivate.cpp
75c75,77
<     // allPropertiesReply.waitForFinished();
---
>     qWarning(PACKAGEKITQT_TRANSACTION) << "BEFORE allPropertiesReply.waitForFinished(): tid.path()=" << tid.path() << ", role=" << role;
>     allPropertiesReply.waitForFinished();
>     qWarning(PACKAGEKITQT_TRANSACTION) << "AFTER allPropertiesReply.waitForFinished(): tid.path()=" << tid.path() << ", role=" << role;
193a196,197
>     case Transaction::RoleUnknown:
>         qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction: case Transaction::RoleUnknown: tid.path()=" << tid.path() << ", role=" << role;
198,202c202,207
<     if (reply.isFinished() && reply.isError()) {
<         q->errorCode(Transaction::ErrorInternalError, reply.error().message());
<         finished(Transaction::ExitFailed, 0);
<         return;
<     }
---
> //    if (reply.isFinished() && reply.isError()) {
> //        q->errorCode(Transaction::ErrorInternalError, reply.error().message());
> //        finished(Transaction::ExitFailed, 0);
> //        qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction: DELETED!: tid.path()=" << tid.path() << ", role=" << role;
> //        return;
> //    }

All issue disappeared. No crashes, #41 is fixed too. Whatever the reason, it looks like at least apperd and Discover rely on this behavior.

#28 :

I've actually tested this, and while this issue only happens if the user made a programming error, I'd imagine it will eventually save someone quite a bit of debugging work in future :-D
So, let's merge this! :-)

Perhaps the maintainers of other packages should be notified.

Update:

If I understand correctly, the problem is that there is no way to receive the signal if this signal was triggered in the constructor, for example:

https://github.com/KDE/apper/blob/b2c34cdc940655cb8a1b4a2a1a71091e758f7cd0/apperd/TransactionWatcher.cpp#L97
Is this signal really supposed to be delivered to TransactionWatcher, because the Transaction::finished signal is just connected when the constructor is left?

from packagekit-qt.

Follow the instruction in bug report in Debian bug tracker, use QEMU/KVM install Debian 11 stable then full-upgrade to Debian bookworm can reproduce this issue.

reportbug tool export for libpackagekitqt5-1:

Package: libpackagekitqt5-1
Version: 1.1.0-1

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.0-6-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=zh_CN.UTF-8, LC_CTYPE=zh_CN.UTF-8 (charmap=UTF-8), LANGUAGE=zh_CN:zh
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libpackagekitqt5-1 depends on:
ii  libc6         2.36-7
ii  libgcc-s1     12.2.0-11
ii  libqt5core5a  5.15.7+dfsg-2
ii  libqt5dbus5   5.15.7+dfsg-2
ii  libstdc++6    12.2.0-11

libpackagekitqt5-1 recommends no packages.

Versions of packages libpackagekitqt5-1 suggests:
ii  packagekit  1.2.6-1

-- no debconf information

reportbug export for kded5:

Package: kded5
Version: 5.101.0-1

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.0-6-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=zh_CN.UTF-8, LC_CTYPE=zh_CN.UTF-8 (charmap=UTF-8), LANGUAGE=zh_CN:zh
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages kded5 depends on:
ii  libc6              2.36-7
ii  libkf5configcore5  5.101.0-1
ii  libkf5coreaddons5  5.101.0-1
ii  libkf5crash5       5.101.0-1
ii  libkf5dbusaddons5  5.101.0-1
ii  libkf5service-bin  5.101.0-1
ii  libkf5service5     5.101.0-1
ii  libqt5core5a       5.15.7+dfsg-2
ii  libqt5dbus5        5.15.7+dfsg-2
ii  libqt5gui5         5.15.7+dfsg-2
ii  libqt5widgets5     5.15.7+dfsg-2
ii  libstdc++6         12.2.0-11

kded5 recommends no packages.

kded5 suggests no packages.

-- no debconf information

reportbug export for apper:

Package: apper
Version: 1.0.0-3

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.0-6-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=zh_CN.UTF-8, LC_CTYPE=zh_CN.UTF-8 (charmap=UTF-8), LANGUAGE=zh_CN:zh
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apper depends on:
ii  apper-data               1.0.0-3
ii  kio                      5.101.0-2
ii  libappstreamqt2          0.15.6-1
ii  libc6                    2.36-7
ii  libkf5completion5        5.101.0-1
ii  libkf5configcore5        5.101.0-1
ii  libkf5coreaddons5        5.101.0-1
ii  libkf5dbusaddons5        5.101.0-1
ii  libkf5i18n5              5.101.0-1+b1
ii  libkf5iconthemes5        5.101.0-1+b1
ii  libkf5itemviews5         5.101.0-1
ii  libkf5jobwidgets5        5.101.0-1
ii  libkf5kiocore5           5.101.0-2
ii  libkf5kiowidgets5        5.101.0-2
ii  libkf5notifications5     5.101.0-1
ii  libkf5service-bin        5.101.0-1
ii  libkf5service5           5.101.0-1
ii  libkf5solid5             5.101.0-1
ii  libkf5widgetsaddons5     5.101.0-1
ii  libkf5xmlgui5            5.101.0-1+b1
ii  libkworkspace5-5         4:5.26.4.1-1+b1
ii  libpackagekitqt5-1       1.1.0-1
ii  libqt5core5a             5.15.7+dfsg-2
ii  libqt5dbus5              5.15.7+dfsg-2
ii  libqt5gui5               5.15.7+dfsg-2
ii  libqt5widgets5           5.15.7+dfsg-2
ii  libqt5xmlpatterns5       5.15.7-2
ii  libstdc++6               12.2.0-11
ii  packagekit               1.2.6-1
ii  polkit-kde-agent-1       4:5.26.4-1
ii  software-properties-kde  0.96.20.2-2.1

Versions of packages apper recommends:
ii  appstream           0.15.6-1
ii  apt-config-icons    0.15.6-1
ii  debconf-kde-helper  1.1.0-1

apper suggests no packages.

-- no debconf information

from packagekit-qt.

Note that TransactionWatcher.cpp comes from apper.

from packagekit-qt.

I did not really realize this when writing the information to the Debian bug report.
That would mean if apper does not save the Transaction in its m_transactions list, it kded would not crash, would make sense.

Is there some property of that Transaction that apper should query if it is allowed to store that object in its list,
or if it is already "marked for deletion" ?

from packagekit-qt.

I did not really realize this when writing the information to the Debian bug report. That would mean if apper does not save the Transaction in its m_transactions list, it kded would not crash, would make sense.

Is there some property of that Transaction that apper should query if it is allowed to store that object in its list, or if it is already "marked for deletion" ?

I did sort of digging of TransactionWatcher.cpp, it's looks like connect to qt signal Transaction::finished signal
https://invent.kde.org/system/apper/-/blob/master/apperd/TransactionWatcher.cpp#L97 .

Follow the stacktrace from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1026062#35 :

1. PackageKit-Qt/src/transaction.cpp

   Line 69 in a71050b

   d->setup(tid);

2. PackageKit-Qt/src/transactionprivate.cpp

   Line 82 in a71050b

   runQueuedTransaction();

3. PackageKit-Qt/src/transactionprivate.cpp

   Line 193 in a71050b

   finished(Transaction::ExitFailed, 0);

If Transaction has some error happend, TransactionPrivate::finished will be called.

Two event happend:

1. emit Transaction::finished,
2. called deleteLater , which will delete TransactionPrivate instance in QT's event loop.

Now I have three questions:

1. Will Transaction::finished signal execute before deleteLater event?
2. If true, why TransactionWatcher not delete object which hold in m_transaction correctly?
3. What error happend in the construactor of Transaction?

to figure this out I need rr debugger to record kded5, but rr said that it can't recognize my CPU, maybe I need to manually package a new version of rr.

ps. I have never used QT and cpp at all, if there is any mistake in the above analysis, please point it out.

from packagekit-qt.

Now I have three questions:

1. Will `Transaction::finished` signal execute before `deleteLater` event?
2. If true, why `TransactionWatcher` not delete object which hold in `m_transaction` correctly?

https://github.com/KDE/apper/blob/b2c34cdc940655cb8a1b4a2a1a71091e758f7cd0/apperd/TransactionWatcher.cpp#L97
Is this signal really supposed to be delivered to TransactionWatcher, because the Transaction::finished signal is just connected when the constructor is left?

3. What error happend in the construactor of `Transaction`?

If I see it right the reply gets not filled, because role has a value of PackageKit::Transaction::RoleUnknown ?
Therefore reply.isFinished() and reply.isError() is true.

to figure this out I need rr debugger to record kded5, but rr said that it can't recognize my CPU, maybe I need to manually package a new version of rr.

What CPU model you are using?

from packagekit-qt.

What CPU model you are using?

7950x.

https://github.com/rr-debugger/rr/wiki/Zen

update: I tried to manually patching the rr package (rr-debugger/rr@140d3cf) and installed, but rr replay not work:

[FATAL ./src/ReplaySession.cc:1173:check_ticks_consistency()] 
 (task 5866 (rec:2725) at time 2926)
 -> Assertion `ticks_now == trace_ticks' failed to hold. ticks mismatch for 'SYSCALL: mmap'; expected 26518566, got 26518563

zen_workaround.py:

$ sudo ./zen_workaround.py 
Traceback (most recent call last):
  File "/home/test/./zen_workaround.py", line 66, in <module>
    val = read_msr(cpu)
  File "/home/test/./zen_workaround.py", line 58, in read_msr
    (val,) = struct.unpack('<q', os.read(msr, 8))
OSError: [Errno 5] Input/output error

I'm heading down the rabbit hole :/

At this time, I believe I need to get a rest because of COVID-19 sequelae. I will continue to pay attention to this issue until the tray icon no longer disappears.

(As an aside, kded5 daemon has crashed 55 times in the past three days :)

update 2:

I got it all wrong, zen_workaround.py should execute on the host machine. Unfortunately rr still doesn't work.

from packagekit-qt.

Is this signal really supposed to be delivered to TransactionWatcher, because the Transaction::finished signal is just connected when the constructor is left?

I believe you are right, I'm so tired never noticed this issue today.

from packagekit-qt.

Note that TransactionWatcher.cpp comes from apper.

I found a bug report of apper here:

https://bugs.kde.org/show_bug.cgi?id=463576

from packagekit-qt.

What CPU model you are using?

7950x.

https://github.com/rr-debugger/rr/wiki/Zen

update: I tried to manually patching the rr package (rr-debugger/rr@140d3cf) and installed, but rr replay not work:

Ah, yes, Intel users have more comfort here, I am on an old Ryzen 1700 here.
rr is quite small and getting latest git and running with full path from the build directory works usually for me quite well.

[FATAL ./src/ReplaySession.cc:1173:check_ticks_consistency()] 
 (task 5866 (rec:2725) at time 2926)
 -> Assertion `ticks_now == trace_ticks' failed to hold. ticks mismatch for 'SYSCALL: mmap'; expected 26518566, got 26518563

zen_workaround.py:

$ sudo ./zen_workaround.py 
Traceback (most recent call last):
  File "/home/test/./zen_workaround.py", line 66, in <module>
    val = read_msr(cpu)
  File "/home/test/./zen_workaround.py", line 58, in read_msr
    (val,) = struct.unpack('<q', os.read(msr, 8))
OSError: [Errno 5] Input/output error

I'm heading down the rabbit hole :/

At this time, I believe I need to get a rest because of COVID-19 sequelae. I will continue to pay attention to this issue until the tray icon no longer disappears.

(As an aside, kded5 daemon has crashed 55 times in the past three days :)

update 2:

I got it all wrong, zen_workaround.py should execute on the host machine. Unfortunately rr still doesn't work.

Yes zen_workaround.py is needed at the bare metal.
And damn, if some mapped memory to processes outside of the rr recording come into play it usually does not work.
You tried it in some base installation inside a VM, which distrubution did you try?

from packagekit-qt.

You tried it in some base installation inside a VM, which distrubution did you try?

debian testing (bookworm)

1. download image from here: https://cdimage.debian.org/debian-cd/current/amd64/bt-dvd/ -> debian-11.6.0
2. graphic installer, select KDE as desktop environment
3. full-upgrade
4. upgrade to debian testing (bookworm) by edit /etc/apt/source.list

I noticed that debian 11.6.0 doesn't have this issue,

https://packages.debian.org/search?keywords=apper

stable and testing have same apper version;

https://packages.debian.org/search?keywords=libpackagekitqt5-1

https://packages.debian.org/search?keywords=kded5

debian stable usinglibpackagekitqt5-1: 1.0.2-1 and kded5: 5.78.0-2

debian testing (bookworm) using libpackagekitqt5-1: 1.1.0-1 and kded5: 5.101.0-1

from packagekit-qt.

Oh, ok, thought you were on some other distribution. I was starting from a minimal testing and just installing task-kde-desktop. But there the Debian rr package worked good for me. So you still get the ticks failed to hold? And one more question - you I will try if I can reproduce with a regular install.
Have you installed packages between record and replay? To be sure you can do a rr pack immediately after recording. That way needed files get transferred into the recording directory.

from packagekit-qt.

Yes, it's still failed. I starting to believe rr refuse to working with kded5 on my zen4 CPU. rr record and rr record -n crashed both with difference reason, and I'm not going to try rr on zen4 though; I'm going to borrow a friend's computer next...

Have you installed packages between record and replay?

I crashed kded5 and immediately execute rr replay, and rr also crashed

from packagekit-qt.

Another option - there might be a chance if you try to replay a recording from my VM,
that was recorded and does replay well for me with testings rr version.

from packagekit-qt.

Another option - there might be a chance if you try to replay a recording from my VM, that was recorded and does replay well for me with testings rr version.

Thank you very much for your help, but no lucky:

$ rr replay kded5-0
[FATAL ./src/ReplaySession.cc:202:ReplaySession()] Trace was recorded on a machine with different CPUID values
and CPUID faulting is not enabled; replay will not work.

I'll figure out how to fix this:

I'm going to borrow a friend's computer next...

Just move to intel :(

from packagekit-qt.

I feel like I have symptoms of heart failure, I mean, please forgive me if I can't answer emails in time

from packagekit-qt.

Thank you very much for your help, but no lucky:

$ rr replay kded5-0
[FATAL ./src/ReplaySession.cc:202:ReplaySession()] Trace was recorded on a machine with different CPUID values
and CPUID faulting is not enabled; replay will not work.

I'll figure out how to fix this:

I'm going to borrow a friend's computer next...

Just move to intel :(

Too bad, better would be to find out the reason of this and probably get a fix upstream. Running the test suite would be a starting point, but now I guess this is a topic for another issue tracker ...

I feel like I have symptoms of heart failure, I mean, please forgive me if I can't answer emails in time

I hope you get well soon.

from packagekit-qt.

Too bad, better would be to find out the reason of this and probably get a fix upstream. Running the test suite would be a starting point, but now I guess this is a topic for another issue tracker ...

I'll keep track of rr's zen4 support, but you are right, it's another topic; and thank you for your blessing :)

from packagekit-qt.

This also happens to me but it's on Archlinux. Apper causes kded5 to crash at login. This bug began to happen since KDE Plasma 5.26.3 or .4, KDE Framework 5.100.0. It happens at every login, on multiple machines, all of them ArchLinux.

The crash would happen a few seconds after I logged in to KDE Plasma Desktop. The whole desktop would appears to freeze for a few seconds. KDE Crash Handler would then notify me about kded5 crashed. But when I click the button to see Developer Information, the Crash Handler would also crash. KDED would not restart automatically after that.

I thought it could have been Apper/packagekit-qt's automatic update checker not compatible with the newer KDE components, but I could not stop KDED from crashing even after I disabled every automatic update function in Apper. The only way was to uninstall Apper from the system (I didn't need to uninstall packagekit or packagekit-qt5).

BTW, all my machines has a Intel CPU. So I don't think this is Zen4 specific?

Following is the crash information from DrKonqi.
kded5_crash.txt

from packagekit-qt.

Build and install from master branch of rr, finally it's works.

If I see it right the reply gets not filled, because role has a value of PackageKit::Transaction::RoleUnknown ?
Therefore reply.isFinished() and reply.isError() is true.

In my opinion, there is a race condition here:

If callback updateProperties called earlier than TransactionPrivate::runQueuedTransaction function, then no error happend, otherwise apperd crashed. #28 exposes this race condition.

from packagekit-qt.

It seems to be related to the timeout of the DBUS connection or somethings... rr can do nothing for DBUS debugging, and I'm not an expert on DBUS.

from packagekit-qt.

I've created the PR above, if you think there is a race condition, you can try the branch there and uncomment the line:
https://github.com/PackageKit/PackageKit-Qt/pull/44/files#diff-0d76f2eb9ed739c7e0a43fe2bf59dc89dceece902b73f092b3687a7e7c0f419eR75

Sadly I cannot reproduce the problem.

from packagekit-qt.

I've created the PR above, if you think there is a race condition, you can try the branch there and uncomment the line:
https://github.com/PackageKit/PackageKit-Qt/pull/44/files#diff-0d76f2eb9ed739c7e0a43fe2bf59dc89dceece902b73f092b3687a7e7c0f419eR75

build and install:

1. HOST: apt source libpackagekitqt5-1 && cd packagekit-qt-1.1.0
2. HOST: Download all file from branch blocking-properties and unzip it into packagekit-qt-1.1.0
3. HOST: Uncomment allPropertiesReply.waitForFinished() and add some debug log:

75c75,77
<     // allPropertiesReply.waitForFinished();
---
>     qWarning(PACKAGEKITQT_TRANSACTION) << "BEFORE allPropertiesReply.waitForFinished(): tid.path()=" << tid.path() << ", role=" << role;
>     allPropertiesReply.waitForFinished();
>     qWarning(PACKAGEKITQT_TRANSACTION) << "AFTER allPropertiesReply.waitForFinished(): tid.path()=" << tid.path() << ", role=" << role;
193a196,197
>     case Transaction::RoleUnknown:
>         qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction: case Transaction::RoleUnknown: tid.path()=" << tid.path() << ", role=" << role;
200a205
>         qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction: DELETED!: tid.path()=" << tid.path() << ", role=" << role;

4. HOST: dpkg-source --commit and debuild -us -uc, then upload libpackagekitqt5-1_1.1.0-1_amd64.deb libpackagekitqt5-1-dbgsym_1.1.0-1_amd64.deb libpackagekitqt5-dev_1.1.0-1_amd64.deb to QEMU/KVM guest
5. GUEST: sudo apt reinstall ./libpackagekitqt5-1_1.1.0-1_amd64.deb ./libpackagekitqt5-1-dbgsym_1.1.0-1_amd64.deb ./libpackagekitqt5-dev_1.1.0-1_amd64.deb
6. GUEST: Reboot, then open apper and check updates

Following is the log file from journalctl --user --boot -f.
block_log.txt

from packagekit-qt.

If packagekitqt5 is working properly, maybe apperd needs to check whether the construction is successful after call new Transaction(tid)?

from packagekit-qt.

--- apper-1.0.0.orig/apperd/TransactionWatcher.cpp
+++ apper-1.0.0/apperd/TransactionWatcher.cpp
@@ -93,6 +93,8 @@ void TransactionWatcher::watchTransactio
     if (!m_transactions.contains(tid)) {
         // Check if the current transaction is still the same
         transaction = new Transaction(tid);
+        if (transaction->role() == Transaction::RoleUnknown)
+            return;
         connect(transaction, &Transaction::roleChanged, this, &TransactionWatcher::transactionReady);
         connect(transaction, &Transaction::finished, this, &TransactionWatcher::finished);

No kded5 crashes happened so far, but have same issue with #41

from packagekit-qt.

All issue disappeared. No crashes, #41 is fixed too.

Thanks!

from packagekit-qt.

All issue disappeared. No crashes, #41 is fixed too.

Thanks!

I'm not really sure if this workaround will fix your issue, but you could have a try. If not, then maybe there are other unresolved issues...

from packagekit-qt.

Use apt source libpackagekitqt5-1 and apt source apper to download the source from debian testing (bookworm), apply the patches to record the Transaction instance life cycle:

diff -r packagekit-qt-1.1.0.orig/src/transaction.cpp packagekit-qt-1.1.0-patched/src/transaction.cpp
22a23
> #include "daemonprivate.h"
55a57
>             qWarning(PACKAGEKITQT_TRANSACTION) << "Transaction::Transaction(): QDBusPendingCallWatcher::finished: BEFORE d->setup: this =" << this << ", tid = " << tid().path() << ", role = " << role() << ", status =" << status();
57a60
>             qWarning(PACKAGEKITQT_TRANSACTION) << "Transaction::Transaction(): QDBusPendingCallWatcher::finished: AFTER d->setup: this =" << this << ", tid = " << tid().path() << ", role = " << role() << ", status =" << status();
68a72
>     qWarning(PACKAGEKITQT_TRANSACTION) << "Transaction::Transaction(const QDBusObjectPath &tid): BEFORE d->setup: this =" << this << ", tid = " << tid.path() << ", role = " << role() << ", status =" << status();
69a74
>     qWarning(PACKAGEKITQT_TRANSACTION) << "Transaction::Transaction(const QDBusObjectPath &tid): AFTER d->setup: this =" << this << ", tid = " << tid.path() << ", role = " << role() << ", status =" << status();
diff -r packagekit-qt-1.1.0.orig/src/transactionprivate.cpp packagekit-qt-1.1.0-patched/src/transactionprivate.cpp
27a28
> #include "qdbusconnection.h"
39a41
>     qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::~TransactionPrivate(): delete p: this =" << q_ptr << ", tid = " << tid.path() << ", role = " << role << ", status =" << status;
191c193,195
<     if (reply.isFinished() && reply.isError()) {
---
>     qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction(): this =" << q_ptr << ", tid = " << tid.path() << ", role = " << role << ", status =" << status;
> 
>     /* if (reply.isFinished() && reply.isError()) {
195c199
<     }
---
>     } */
206a211
>             qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction(): QDBusPendingCallWatcher::finished: this =" << q_ptr << ", reply.isError(), deleted: tid = " << tid.path() << ", role = " << role << ", status =" << status;
207a213
>         qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::runQueuedTransaction(): QDBusPendingCallWatcher::finished: this =" << q_ptr << ", reply no error, deleted: tid = " << tid.path() << ", role = " << role << ", status =" << status;
209a216
> 
280c287
< 
---
>     qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::propertiesChanged called, will updateProperties ... : this =" << q_ptr << ", tid = " << tid.path() << ", role = " << role << ", status =" << status;
287c294
< 
---
>     qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::updateProperties START: this =" << q_ptr << ", tid = " << tid.path() << ", role = " << role << ", status =" << status;
333a341,342
> 
>     qWarning(PACKAGEKITQT_TRANSACTION) << "TransactionPrivate::updateProperties END: this =" << q_ptr << ", tid = " << tid.path() << ", role = " << role << ", status =" << status;

diff apper-1.0.0.orig/apperd/TransactionWatcher.cpp apper-1.0.0-patched/apperd/TransactionWatcher.cpp 
94a95
>         qWarning() << "apperd: TransactionWatcher::watchTransaction BEFORE new Transaction(tid): tid =" << tid.path();
95a97
>         qWarning() << "apperd: TransactionWatcher::watchTransaction AFTER new Transaction(tid): this =" << transaction << ", tid =" << transaction->tid().path() << ", role =" << transaction->role() << ", status =" << transaction->status();
102a105
>         qWarning() << "apperd: TransactionWatcher::watchTransaction BEFORE m_transactions.contains(tid) else branch: this =" << transaction << ", tid =" << transaction->tid().path() << ", role =" << transaction->role() << ", status =" << transaction->status();
108a112
>     qWarning() << "apperd: TransactionWatcher::watchTransaction: this =" << transaction << ", tid =" << transaction->tid().path() << ", role =" << transaction->role() << ", status =" << transaction->status();
114a119,120
>     qWarning() << "apperd: TransactionWatcher::transactionReady: this =" << transaction << ", tid =" << transaction->tid().path() << ", "<< transaction->tid().path() << ", role =" << transaction->role() << ", status =" << transaction->status();
> 
162a169,170
> 
>     qWarning() << "apperd: TransactionWatcher::finished: this =" << transaction << ", tid =" << transaction->tid().path() << ", role =" << transaction->role() << ", status =" << transaction->status();

The only modification besides adding logs is revert #28. Log file from journalctl --user --boot attached below:

journalctl_user_boot_2023-01-12-14_21.log

After a simple analysis I believe at least the objects in the log are being released properly.

from packagekit-qt.