XPost: linux.debian.bugs.dist
From: harri@afaics.de

Package: linux-image-6.12.33+deb13-amd64
Version: 6.12.33-1

By default kernel 6.12 dropped some deprecated features around cgroupv2 support. This affects openjdk 21 and older, see

https://bugs.openjdk.org/browse/JDK-8347811
https://bugs.debian.org/1107967

This is fatal: Using cgroupv2 openjdk 21 doesn't recognize the container
limits by default anymore, the Java GC is not run since there seems to
be plenty of memory, and the Java app runs into the container's memory
limit and is killed with OOM.

openjdk 25 has been fixed, AFAICT.

Workaround is to configure the kernel with

CONFIG_CPUSETS_V1=y
CONFIG_MEMCG_V1=y

to bring back the deprecated features.

I would like to suggest to re-enable the deprecated features in the
kernel. It is pretty much unlikely that openjdk 21 is fixed in time
for Trixie. Not to mention the kernel backport to Bookworm.


Regards
Harri

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)

XPost: linux.debian.bugs.dist
From: ben@decadent.org.uk

For reference, I think this is the status of the OpenJDK versions in the archive:

| Debian release | cgroups |
| 11 | 12 | 13 | sid | support | -----------+----+----+----+-----+---------+
openjdk-8 | | | | X | no |
openjdk-11 | X | | | X | yes * |
openjdk-17 | X | X | | X | yes * |
openjdk-21 | | | X | X | yes * |
openjdk-22 | | | | X | yes * |
openjdk-23 | | | | X | yes * |
openjdk-24 | | | | X | yes * |
openjdk-25 | | | X | X | yes + |

* CgroupSubsystemFactory depends on /proc/cgroups even if using v2
+ C++ implementation of CgroupSubsystemFactory does not depend on
/proc/cgroups if using v2, but Java implementation still does

Ben.

--
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmhdeMYACgkQ57/I7JWG EQn5Vw//Y4ruxAYjNAsqTXH5uJDAMFRf29uS6lZdcr3/DdG+LpduIlNl20lJssAM JsbAiaiKZ7fZZeBvTCafMCvCfdMeBRsfa/FNdbaZBqPcm0RMdfEcGYA+bOfbBjOF FndjjNWCrFievOSwx0y6qlWb2Dh926NnfVxjdb/BzTauWrkuh2G8Y9Q2l5rIGdyS 19oZZmWGufaN2PzJ7nxjFK3a9/qoxhHjeLWUhMgpsV0n2aAN9pvkFtBNz2Ba6+8x GYFpZny0N7H8altlfe7qGUo8mARhf3oiXWzI+jr2yo1MQRhP15kch/MkOJLq5AYR by4uz+gImzZzPBSwtcoUxXk8TIhjlcPMNqbYgYo6LhnSDSvsLY3EihpdoOQhO435 JnujbfDcp+FXyX+lm1Laf6THOxqE4wqv588psP119lrrYBFcXarDlg76mdiNhm7/ YNNOZczuTW9nroPurJ/ad4NUvmb0dXMVcIKS6F4OHPFZr4nuVn9rd7Xgrf/QPYkC YRyVWd3gaX15Dc44S2qj2vczoEDJD7h5xs2R0pZK6xokjl4JXqDTgceVK1spDQel B8GTAL3bDLA7yQ6Ng8qyr0EfZXIAW6n1Q8DrBy1vau2k5DOoPCDaCY2a96crV1l2 bqyevi/me/9ilDGtp6EsXR2J4LlSVDqO1FyJ4qPL5HQ5vlEp4RQ=
=67xU
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you h

XPost: linux.debian.bugs.dist
From: ben@decadent.org.uk

On Wed, 25 Jun 2025 08:33:24 +0200 Harald Dunkel <harri@afaics.de>
wrote:

Package: linux-image-6.12.33+deb13-amd64
Version: 6.12.33-1

By default kernel 6.12 dropped some deprecated features around

cgroupv2

support. This affects openjdk 21 and older, see

       https://bugs.openjdk.org/browse/JDK-8347811 >       https://bugs.debian.org/1107967

This is fatal: Using cgroupv2 openjdk 21 doesn't recognize the

container

limits by default anymore, the Java GC is not run since there seems to
be plenty of memory, and the Java app runs into the container's memory
limit and is killed with OOM.

openjdk 25 has been fixed, AFAICT.

Workaround is to configure the kernel with

       CONFIG_CPUSETS_V1=y
       CONFIG_MEMCG_V1=y

to bring back the deprecated features.

I would like to suggest to re-enable the deprecated features in the
kernel. It is pretty much unlikely that openjdk 21 is fixed in time
for Trixie. Not to mention the kernel backport to Bookworm.

Thank you for bringing this to our attention.

I don't think it makes sense for us to re-enable cgroups v1, given that
it has been deprecated for so long and OpenJDK itself can use v2.

I will look into whether we can instead provide only a /proc/cgroups
file, which seems to be all that OpenJDK actually needed.

Ben.

--
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmhddE0ACgkQ57/I7JWG EQkamBAAgJgd0/aLWsY4DDpnvyL11j+E70iRw8QXpYEeJiF1EE/RDWVGxUgh7zYn zucfUzHUIGVjszxTBokqA9sU+jZYzM/QkMtfAHtxTDfhWcS9nX0sNZSzzIVcEffQ EDK25HvRQyjfR5YZ4+YnGfCqqsMYU45xzYnTmH51Cx2H9SnF79TY3N/ub+4ZZ8ZY 40dTrZfRyvJbSJ6a3fciwAk16SBFT5hTPf+K4k+Tv8hOGeZHCpPVYLHUpE2n/8Vh Ed3pG7Pk/ZFVW/VXg/J0XwIFVZhk2+dLOXon7uj4CEHEbBucTkPnjqs4J0YVcqjZ uQJBi9dXflrD7v8+/bqefvX5QMNMr5cYP+TSaeIbnTeVZRu1DmRWtCVUTfacj2/6 Tf/YGBxhmc69h6yCdf9X0POTXGTKTjGU8N6X+FdKjbrxSKcsRMfHJciJ9kJlCQQ3 hIlpRbJgKA2YYFyHMGQU5LtVrpQqc+l93FxZ5tasmeo0jr+FCqKNNVdopY++/fL7 7uJSAj1Bwz5TOuEd6IkeTTw9upg6h9P1cp9wN8bDdwJNyE70/P6P7dS3Fh6H4e09 PZVYqmtIcqGRgza/ciBMzgufbK6AQdHrHawlhEeyR7ZOlRrky1EuKcmm0JUTFkkq 7+iCfc/C0PT/3rNOunzomlLhHSFAZu20HOAjs+f3WwvoO55yXIs=
=Ix0F
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you h

XPost: linux.debian.bugs.dist
From: waldi@debian.org

On Wed, Jun 25, 2025 at 08:33:24AM +0200, Harald Dunkel wrote:

This is fatal: Using cgroupv2 openjdk 21 doesn't recognize the container limits by default anymore, the Java GC is not run since there seems to
be plenty of memory, and the Java app runs into the container's memory
limit and is killed with OOM.
openjdk 25 has been fixed, AFAICT.

Did you think about backporting those changes?

Bastian

--
It is necessary to have purpose.
-- Alice #1, "I, Mudd", stardate 4513.3

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)

XPost: linux.debian.bugs.dist
From: harri@afaics.de

Ben Hutchings wrote:

Thank you for bringing this to our attention.

I don't think it makes sense for us to re-enable cgroups v1, given that
it has been deprecated for so long and OpenJDK itself can use v2.

You are right, it's been deprecated for quite some time, and this is
clearly a bug in openjdk, but currently there is no better version of
JDK21. I am not sure what you mean by "OpenJDK itself can use v2".

I will look into whether we can instead provide only a /proc/cgroups
file, which seems to be all that OpenJDK actually needed.

How is this supposed to work? Since we are talking about the host system
here you cannot know how /proc was mounted in the container, which
Container framework is involved, or whether the container is based on
Debian at all.

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)

XPost: linux.debian.bugs.dist
From: ben@decadent.org.uk

On Thu, 2025-06-26 at 18:24 +0200, Ben Hutchings wrote:
[...]

Thank you for bringing this to our attention.

I don't think it makes sense for us to re-enable cgroups v1, given that
it has been deprecated for so long and OpenJDK itself can use v2.

I will look into whether we can instead provide only a /proc/cgroups
file, which seems to be all that OpenJDK actually needed.

In fact this may be as simple as reverting:

commit af000ce85293b8e608f696f0c6c280bc3a75887f
Author: Michal Koutný <mkoutny@suse.com>
Date: Mon Sep 9 18:32:23 2024 +0200

cgroup: Do not report unavailable v1 controllers in /proc/cgroups

but I have not yet tested that.

Ben.

--
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmhdgKAACgkQ57/I7JWG EQnrRw//ZfKv7Bwt3F884c9x2NhPu+q2qfr0RPsy6dX/0O7WIwOxym9SzjaX608U xeNgSuPPGs5SktYrQJ8TCiqW6K0xvld5tiC4+O4Cblj6+O2c7McDzyYyi0obKQ2g e1ll+8UQKSIxutfTMYlRafx3iqvC/VS5tuTDpMiiHPNxFtkoescsslULaUhjimjp c2EN5NwVQoYyXVTVAxWX81wfs79ywj0gelJWnJ+ftJJqgZbg8BhyA3qN7o2uSEmd TUXN+7b0klrjMYAdkYnJgClyBNJ1yjqvuOupnTY2ZfJb/HJCd3D2a4r6pGl2UFzZ 6aV9wfwFcX/l/Lc2INE/3qWMhL2hu3qJfo41pq4okN3R5bSHM1LRLWq0vFT3BOTl fbn/wMFVJvHJZlS4bKVft3gNZRs6oAjJITw2A35YxnsmF0hiV/wW54IlO68KVG2q +JgIt8mjmn4SDDSVXDmOhooQqINQDqEBp8Wa8yBbpshxynK+kCE+JreI9Pabw/dp r+OfQPMDw2pSR0h2HG0fsAa+ZnVBhbwzX5VdYlTYNrpiNr21IphwxO6PEC2quSsw 4OS30zOQsvmDM9BGbo910cI4TfinQEhzGJlUlq8akhqW0AHx7eqyR++HtTLkYDEq 17RrmNG6i5P7hJOz8FNT9DS/CZMhY3AX37dEBu/pNY309cbpPC4=
=IBi5
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you h

XPost: linux.debian.bugs.dist
From: ben@decadent.org.uk

On Thu, 2025-06-26 at 20:40 +0200, Harald Dunkel wrote:

Ben Hutchings wrote:

Thank you for bringing this to our attention.

I don't think it makes sense for us to re-enable cgroups v1, given that
it has been deprecated for so long and OpenJDK itself can use v2.

You are right, it's been deprecated for quite some time, and this is
clearly a bug in openjdk, but currently there is no better version of
JDK21. I am not sure what you mean by "OpenJDK itself can use v2".

OpenJDK (from v11 onwards) appears to use v2 of the cgroups API if
available, and only mistakenly relied on /proc/cgroups for detection of
which controllers are enabled.

I will look into whether we can instead provide only a /proc/cgroups
file, which seems to be all that OpenJDK actually needed.

How is this supposed to work? Since we are talking about the host system
here you cannot know how /proc was mounted in the container, which
Container framework is involved, or whether the container is based on
Debian at all.

We have to assume that /proc/cgroups and cgroupfs are exposed to the
container, otherwise none of this detection could have worked before...

Ben.

--
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmhhMDYACgkQ57/I7JWG EQlhWQ//TYX8mQmGi/z40Ac1DSU0SfNPuWJO3Y9a1vv3sDdLDdnCDPW9UHPBrrha nI1kQ3Z3Nqlqn33ia7OS5t21D88A3ia4UFD8N1IWX0y6St2hKyb5TTfwBazdniMR 67ZhRN5oVaHjK/Ky87H+nvVXiJbTpSfSSgiW0DMmsYcUa58wKSCybkL7xzEVYDWn lTMRfv3W0kNcIfaVdiV9GWKjlcwS0z4r8SkEp6lD7h9QNqWiBg3YS26m/NyBNHSh QoBIj/Q6IAtKLYydVpacSnwjk+AQ3OSw291lkaxIjPqrNCjiOyXI0Gi1Nnes2rWe g9N8C+xvoBb/0i0EKFWsOeENz5dxBh4y1yotANNH+pUs9UPyUcfGIgpWQoNSZnBO BynzwDm75AS1kI3b+uL3LyiaJEfekpuOH+fXMUxItqLO+yMKSvs1pXhhMUX5WdEg 9G+AVleHBjAZJtHuh8Gme3Sbg0gc0Yb5AHEUw0cneo+FwKvABM3GpUjqYsPGs3y8 /SCJxA6PCL02DjFgoBIF/1+3/ISjoxEgGD6rXDE5yE5P8/7LBIl9hVBYSHr2Knw6 tcL0AtPz69/YnDIMsSrxLSc8VkuGiaU9QskFYMqHpw/UfJFO3DQ7PC//rlePkEx/ yhime8Rdx8B1ZNI3ylnFFVZU9mM60uVjoQ7ID6+uS8YahIifxi4=
=aP1B
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you h

Processing control commands:

tag -1 patch

Bug #1108294 [src:linux] kernel 6.12 breaks cgroup awareness of openjdk 21 Added tag(s) patch.

--
1108294: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108294
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

XPost: linux.debian.bugs.dist
From: ben@decadent.org.uk

Control: tag -1 patch

On Thu, 2025-06-26 at 19:17 +0200, Ben Hutchings wrote:

On Thu, 2025-06-26 at 18:24 +0200, Ben Hutchings wrote:
[...]

Thank you for bringing this to our attention.

I don't think it makes sense for us to re-enable cgroups v1, given that
it has been deprecated for so long and OpenJDK itself can use v2.

I will look into whether we can instead provide only a /proc/cgroups
file, which seems to be all that OpenJDK actually needed.

In fact this may be as simple as reverting:

commit af000ce85293b8e608f696f0c6c280bc3a75887f
Author: Michal Koutný <mkoutny@suse.com>
Date: Mon Sep 9 18:32:23 2024 +0200

cgroup: Do not report unavailable v1 controllers in /proc/cgroups

but I have not yet tested that.

Yes, this seems to work.

I compiled the following class:

--- BEGIN ---
import java.lang.System;

class Main {
public static void main(String[] args) {
int count = Integer.parseInt(args[0]);
char[] one_mb;
int i;

for (i = 0; i != count; i++) {
one_mb = new char[0x100000];
System.out.println(one_mb[0] | one_mb[0xfffff]);
}
}
};
--- END ---

and ran it with an argument of "1000".

I used a podman container of Debian limited to 50 MiB. With the current
kernel from trixie, it OOMs. With that commit reverted, it runs to
completion.

I will open an MR tomorrow.

Ben.

--
Ben Hutchings
73.46% of all statistics are made up.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmhtn7AACgkQ57/I7JWG EQmidQ/9EcNZc0aaWCi3xCMEPHn9TIOm8tNRfS/HNBDtBU/yDJFwVeo+aL+BiV61 AXWw4l8YNgx6Gca9W6XVD9qZUBdE2IzUBqVMFgggbpqSxXeEaSPxwxwJYUDeuo9y VNsBSBdVSwgkOswjQtQOebOr7LhZB1YtmZEfxGqQD3PHnmIG4yOZ/V5e657P5QL7 MwwETHPQFGm87pLE7sVi5Ddj3f1DyvwNzxdS4GzDX8szNP38o7srntK0sCufTXLi nHxNRB581XP95SaTND9Ttty3cMlTdQh/beIk

This is a multi-part message in MIME format...

Your message dated Fri, 11 Jul 2025 07:00:10 +0000
with message-id <E1ua7ju-003FcQ-H3@fasolo.debian.org>
and subject line Bug#1108294: fixed in linux 6.12.37-1
has caused the Debian Bug report #1108294,
regarding kernel 6.12 breaks cgroup awareness of openjdk 21
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


--
1108294: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108294
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

Received: (at submit) by bugs.debian.org; 25 Jun 2025 07:00:32 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
(2024-03-25) on buxtehude.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-14.8 required=4.0 tests=BAYES_00,
BODY_INCLUDES_PACKAGE,HAS_PACKAGE,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
SPF_NONE autolearn=ham autolearn_force=no
version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 12; hammy, 149; neutral, 27; spammy,
1. spammytokens:0.983-+--browse hammytokens:0.000-+--trixie,
0.000-+--bookworm, 0.000-+--sk:config_, 0.000-+--sk:CONFIG_,
0.000-+--afaict
Return-path: <harri@afaics.de>
Received: from mordac.selfhost.de ([82.98.82.6]:36169 helo=outgoing.selfhost.de)
by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_SECP256R1__RSA_SHA512__AES_256_GCM:256)
(Exim 4.96)
(envelope-from <harri