Chris Down
e757e791b2
Let's say a user has two services with ManagedOOMMemoryPressure=kill, one for a web server under system.slice, and one for a batch job under user.slice. The batch job is causing severe memory pressure, whereas the web server's cgroup has no processes with significant pgscan activity. In the code, monitor_memory_pressure_contexts_handler() iterates over all pressure targets that have exceeded their limits. When oomd_select_by_pgscan_rate() returns 0 (that is, no candidates) for a target, we return from the entire SET_FOREACH loop instead of moving to the next target. Since SET_FOREACH iteration order is hash-dependent, if the web server target happens to be visited first, oomd will find no kill candidates for it and exit the loop. The batch job target that is actually slamming the machine will never even be evaluated, and can continue to wreak havoc without any intervention. The effect is that oomd non-deterministically and silently fails to kill cgroups that it should actually kill, allowing memory pressure to persist and dangerously build up on the machine. The fix is simple, keep evaluating remaining targets when one does not match.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release