Skip to content

drivemount: fix use-after-free crash on icon theme change#697

Open
Cigydd wants to merge 1 commit into
mate-desktop:masterfrom
Cigydd:fix-drivemount-theme-uaf
Open

drivemount: fix use-after-free crash on icon theme change#697
Cigydd wants to merge 1 commit into
mate-desktop:masterfrom
Cigydd:fix-drivemount-theme-uaf

Conversation

@Cigydd

@Cigydd Cigydd commented Jun 15, 2026

Copy link
Copy Markdown

DriveButton connects drive_button_theme_change to the process-global default
GtkIconTheme "changed" signal in drive_button_new() and
drive_button_new_from_mount(), but drive_button_dispose() never disconnected
it. Because the default icon theme outlives the button, after a button is
destroyed (e.g. a volume or mount is removed) a later "changed" emission
invokes the callback on freed memory and schedules drive_button_update() via
g_idle_add(), crashing in the GTK main loop (SIGSEGV inside the
DRIVE_IS_BUTTON() type check).

On affected systems this applet has been crashing repeatedly for months, around
USB device plug/unplug.

Disconnect the handler in drive_button_dispose():

g_signal_handlers_disconnect_by_func (gtk_icon_theme_get_default (),
                                      G_CALLBACK (drive_button_theme_change),
                                      self);

Verified with AddressSanitizer: a harness that destroys a DriveButton and then
emits "changed" on the default icon theme reports heap-use-after-free in
drive_button_queue_update (via drive_button_theme_change) without this
change, and runs cleanly with it.

Fixes #696.

🤖 Generated with Claude Code

DriveButton connects drive_button_theme_change to the process-global
default GtkIconTheme ("changed" signal) in drive_button_new() and
drive_button_new_from_mount(), but drive_button_dispose() never
disconnected it. The default icon theme outlives the button, so after a
button is destroyed (e.g. a volume or mount is removed) a later
"changed" emission invokes the callback on freed memory, which then
schedules drive_button_update() via g_idle_add() and crashes in the GTK
main loop with a SIGSEGV inside the DRIVE_IS_BUTTON() type check.

Disconnect the handler in drive_button_dispose(). Confirmed under
AddressSanitizer: the dangling-handler path reports heap-use-after-free
without this change and runs cleanly with it.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@vkareh

vkareh commented Jun 15, 2026

Copy link
Copy Markdown
Member

@Cigydd this change looks fine to me, but I would like your commit message attribution to follow MATE's contribution guidelines: https://github.com/mate-desktop/mate-applets?tab=contributing-ov-file#attribution

tl;dr: Clean up the commit message to be more readable, and change the co-authorship like this (or something reasonably similar to it):

- Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
+ Assisted-By: Claude:claude-opus-4.8

@lukefromdc

lukefromdc commented Jun 16, 2026 via email

Copy link
Copy Markdown
Member

@lukefromdc lukefromdc left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This builds fine and stops the crash, which I was able to verify by first ejecting a drive with this applet in the panel, then changing icon themes. As expected, that took down the whole panel with all applets in-process.

Applying this change to disconnect the signal handler stops the crash.

Holding off on approval until the attribution is fixed, but if I wrote this code myself the only likely change would be the wording of the comment. I checked the docs for this over at
https://docs.gtk.org/gobject/func.signal_handlers_disconnect_by_func.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

drivemount applet crashes (SIGSEGV) — use-after-free after a drive is removed and the icon theme changes

3 participants