From a267656b07912ecb8e304f62646001b895b93c07 Mon Sep 17 00:00:00 2001
From: Chris Down <chris@chrisdown.name>
Date: Sun, 15 Feb 2026 00:05:12 +0800
Subject: [PATCH] oomd: Prevent corruption of cgroup paths in Killed signal

While looking at oomd behaviour in production I noticed that I always
get garbage cgroup paths for the Killed event. Looking more closely, I
noticed that while the signature is (string cgroup, string reason), we
currently erroneously pass the `OomdCGroupContext*` pointer itself as
the first argument to sd_bus_emit_signal(), rather than the ctx->path
string it contains.

The in-memory layout on affected machines in my case is:

    struct OomdCGroupContext {
        unsigned n_ref;
        /* padding */
        char *path;
        /* ... */
    }

...which explains the control characters, since they're garbage from
parsing n_ref, the path pointer, and later fields. At runtime, sd-bus
treats ctx as `const char *` and reads struct bytes as string data,
resulting in garbage being sent.

Pass ctx->path correctly so listeners receive the valid cgroup path.
---
 src/oom/oomd-util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/oom/oomd-util.c b/src/oom/oomd-util.c
index 340d2bb60e..fb4b58eaf5 100644
--- a/src/oom/oomd-util.c
+++ b/src/oom/oomd-util.c
@@ -287,7 +287,7 @@ int oomd_cgroup_kill(Manager *m, OomdCGroupContext *ctx, bool recurse) {
                                           "org.freedesktop.oom1.Manager",
                                           "Killed",
                                           "ss",
-                                          ctx,
+                                          ctx->path,
                                           "oom");
 
         return !set_isempty(pids_killed);