From fb5bdc09ede52d88fc687e9614c41649eccff292 Mon Sep 17 00:00:00 2001 From: Saubhik Datta <50126327+saubhikdattagithub@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:11:14 +0200 Subject: [PATCH 1/2] Add cgroup v1 compat patch for OpenJDK detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverts upstream commit af000ce85293 ("cgroup: Do not report unavailable v1 controllers in /proc/cgroups") adapted for 6.18. With CONFIG_CPUSETS_V1 and CONFIG_MEMCG_V1 disabled, cpuset and memory controllers disappear from /proc/cgroups. OpenJDK 11-24 relies on /proc/cgroups to detect cgroup memory/CPU limits — without them the JVM defers GC and triggers OOM in containers. Origin: https://sources.debian.org/patches/linux/6.12.43-1~bpo12+1/debian/revert-cgroup-do-not-report-unavailable-v1-controlle.patch/ Bug-Debian: https://bugs.debian.org/1108294 Bumps version_suffix to gl1~bp2150. --- prepare_source | 2 +- ...ot-report-unavailable-v1-controllers.patch | 39 +++++++++++++++++++ upstream_patches/series | 1 + 3 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch diff --git a/prepare_source b/prepare_source index de3cff7..53cf4ed 100755 --- a/prepare_source +++ b/prepare_source @@ -28,4 +28,4 @@ cp -r config "$dir/src/debian/" apply_patches fixes_debian import_upstream_patches -version_suffix=gl0~bp2150 +version_suffix=gl1~bp2150 diff --git a/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch b/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch new file mode 100644 index 0000000..472d054 --- /dev/null +++ b/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch @@ -0,0 +1,39 @@ +From: Ben Hutchings +Date: Tue, 8 Jul 2025 22:41:37 +0200 +Subject: Revert "cgroup: Do not report unavailable v1 controllers in /proc/cgroups" +Bug-Debian: https://bugs.debian.org/1108294 +Origin: https://sources.debian.org/patches/linux/6.12.43-1~bpo12+1/debian/revert-cgroup-do-not-report-unavailable-v1-controlle.patch/ + +This reverts commit af000ce85293b8e608f696f0c6c280bc3a75887f, adapted +for the 6.18 kernel where the proc_cgroupstats_show function has +additional logic (proc_show_all, cgrp_v1_visible). + +Starting in version 11, OpenJDK supports both cgroups v1 and v2 APIs, +but relies on /proc/cgroups (part of the v1 API) to detect which +controllers are enabled. The VM detects and adjusts its behaviour for +cgroups cpuset and memory limits. The GC will be configured to +collect before hitting the memory limit. + +If it does not detect such limits, it may defer GC so long that it +triggers OOM despite not needing all the allocated memory. + +The upstream change restricts /proc/cgroups to only show controllers +that support the v1 API. With CONFIG_CPUSETS_V1 and CONFIG_MEMCG_V1 +disabled (upstream default), these controllers do not support the v1 +API and OpenJDK fails to detect them entirely, easily resulting in +triggering OOM when running in a container. + +OpenJDK 25 has been fixed to detect cgroups v2 without depending on +/proc/cgroups, but older versions (11-24) are affected. + +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -689,8 +689,6 @@ int proc_cgroupstats_show(struct seq_file *m, void *v) + for_each_subsys(ss, i) { + cgrp_v1_visible |= ss->root != &cgrp_dfl_root; + +- if (!proc_show_all && cgroup1_subsys_absent(ss)) +- continue; + seq_printf(m, "%s\t%d\t%d\t%d\n", + ss->legacy_name, ss->root->hierarchy_id, + atomic_read(&ss->root->nr_cgrps), diff --git a/upstream_patches/series b/upstream_patches/series index bb2bf16..e55f801 100644 --- a/upstream_patches/series +++ b/upstream_patches/series @@ -5,3 +5,4 @@ 0005-disable-xxhash64.patch CVE-2026-31688.patch CVE-2026-43009.patch +revert-cgroup-do-not-report-unavailable-v1-controllers.patch From c97a081076a73597f0f583574f8eebce2271f132 Mon Sep 17 00:00:00 2001 From: Saubhik Datta <50126327+saubhikdattagithub@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:23:09 +0200 Subject: [PATCH 2/2] =?UTF-8?q?Fix=20patch=20hunk=20context=20=E2=80=94=20?= =?UTF-8?q?add=20blank=20line=20after=20continue?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...evert-cgroup-do-not-report-unavailable-v1-controllers.patch | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch b/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch index 472d054..34a6cb5 100644 --- a/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch +++ b/upstream_patches/revert-cgroup-do-not-report-unavailable-v1-controllers.patch @@ -28,12 +28,13 @@ OpenJDK 25 has been fixed to detect cgroups v2 without depending on --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c -@@ -689,8 +689,6 @@ int proc_cgroupstats_show(struct seq_file *m, void *v) +@@ -689,9 +689,6 @@ int proc_cgroupstats_show(struct seq_file *m, void *v) for_each_subsys(ss, i) { cgrp_v1_visible |= ss->root != &cgrp_dfl_root; - if (!proc_show_all && cgroup1_subsys_absent(ss)) - continue; +- seq_printf(m, "%s\t%d\t%d\t%d\n", ss->legacy_name, ss->root->hierarchy_id, atomic_read(&ss->root->nr_cgrps),