Public bug reported: [ Impact ]
libappmenu-gtk-module.so is not safe to unload: gtk_module_init() patches the GtkMenuBar class vtable and registers a process-lifetime g_bus_watch_name() watcher. GTK3 nevertheless closes gtk-modules with g_module_close() whenever the "gtk-modules" GtkSettings property is re-evaluated. After that the next GDBus dispatch or GtkMenuBar vfunc call jumps into unmapped memory and the host application segfaults. On KDE Plasma this affects every user with the Global Menu applet, because kde-gtk-config writes gtk-modules=colorreload-gtk-module:window-decorations-gtk-module:appmenu-gtk-module into ~/.config/gtk-3.0/settings.ini. Google Chrome 152 (current stable) started touching that setting on startup and now crashes on every launch on such systems. segmentation fault (core dumped) google-chrome Backtrace (gdb, thread 1): pc is an address with no mapped library, reached from libgio's GDBus dispatch path: #0 in ?? () #1 in ?? () from /lib/x86_64-linux-gnu/libgio-2.0.so.0 ... #8 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0 #10 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0 `catch unload` in gdb shows GTK closing the module right before the crash: Inferior unloaded /usr/lib/x86_64-linux-gnu/gtk-3.0/modules/libappmenu-gtk-module.so #5 dlclose () from /lib/x86_64-linux-gnu/libc.so.6 #6 g_module_close () from /lib/x86_64-linux-gnu/libgmodule-2.0.so.0 #7 ?? () from /lib/x86_64-linux-gnu/libgtk-3.so.0 Testing each module from gtk-modules in isolation, only appmenu-gtk-module triggers the crash. The fix pins the module in memory with g_module_make_resident() from the standard g_module_check_init() hook, so g_module_close() becomes a no-op. This is the documented GLib mechanism for modules that cannot be unloaded, and is what GTK IM modules and theme engines already do. Upstream merge request: https://gitlab.com/vala-panel-project/vala- panel-appmenu/-/merge_requests/275 [ Test Plan ] On Ubuntu 22.04 with KDE Plasma (kubuntu-desktop) and appmenu-gtk3-module installed: 1. Ensure ~/.config/gtk-3.0/settings.ini contains gtk-modules=appmenu-gtk-module (kde-gtk-config adds it automatically when the Global Menu applet is on the panel). 2. Install google-chrome-stable 152.0.7977.75 or newer. 3. Run: google-chrome --user-data-dir=/tmp/cprof about:blank Before the fix: segmentation fault within ~1 second. After the fix: Chrome starts and stays running. 4. Stricter check: gdb -q -batch -ex "set follow-fork-mode parent" \ -ex "catch unload appmenu" -ex run \ --args /opt/google/chrome/chrome --user-data-dir=/tmp/cprof about:blank Before the fix: the catchpoint fires, then SIGSEGV. After the fix: the catchpoint never fires. 5. Regression check: open a GTK3 application with a menu bar (e.g. GIMP, Inkscape) and confirm its menu still appears in the Plasma Global Menu applet. [ Where problems could occur ] The change is a single g_module_make_resident() call at module load time. The only behavioural difference is that the shared object is never unmapped for the lifetime of the process. Memory cost is the module's mapping (~100 KiB) staying resident in applications that would otherwise have unloaded it; there is no functional change to menu export. If the patch were wrong, the failure mode would be a link/load error of the module, which GTK reports as a warning and continues without it. [ Other Info ] The same code is present in upstream master (vala-panel-appmenu 25.04), so the fix applies to all Ubuntu series that ship appmenu-gtk-module. GTK4 has dropped gtk-modules entirely, so the fix on the module side is the only realistic one; GTK3 will not change its unload behaviour. Ubuntu 22.04.5, appmenu-gtk3-module 0.7.6-2, libgtk-3-0 3.24.33-1ubuntu2, google-chrome-stable 152.0.7977.75-1, Plasma 5.24.7, X11 session. ** Affects: appmenu-gtk-module (Ubuntu) Importance: Undecided Status: New ** Patch added: "make_module_resident.patch" https://bugs.launchpad.net/bugs/2166410/+attachment/5997273/+files/make_module_resident.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166410 Title: appmenu-gtk3-module from the terminal pre-fills package versions and opens the same page in the browser. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/appmenu-gtk-module/+bug/2166410/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
