[Bug]: Nextcloud Files background job ScanFiles eats up all RAM

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When the ScanFiles background job gets executed it cripples my VPS, when checking with strace i get the following output:

mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8e7ae00000 prctl(PR_SET_VMA, 0, 0x7f8e7ae00000, 0x200000, 0x55938fce1d43) = -1 EINVAL (Invalid argument) munmap(0x7f8e7ae00000, 2097152) = 0

Anyhelp would be appreciated :)

Steps to reproduce

1. Not really sure how one could recreate this

Expected behavior

That the job succeeds and not cripples my server and eat ram.

Installation method

Other Community project

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "educationwarehouse.org"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "28.0.4.1",
        "overwrite.cli.url": "https:\/\/educationwarehouse.org\/nextcloud",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "updatechecker": false,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "integrity.check.disabled": true,
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "6379",
            "timeout": "0.0",
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "hashing_default_password": true,
        "localstorage.allowsymlinks": true,
        "simpleSignUpLink.shown": false,
        "logout_url": "https:\/\/educationwarehouse.org\/yunohost\/sso\/?action=logout",
        "maintenance": false,
        "app_install_overwrite": [
            "timetracker",
            "circlesdb",
            "externalpassword"
        ],
        "loglevel": 2,
        "default_language": "nl",
        "default_locale": "nl_NL",
        "default_phone_region": "NL",
        "allow_user_to_change_display_name": false,
        "skeletondirectory": "",
        "templatedirectory": "\/var\/www\/nextcloud\/templates",
        "auth.bruteforce.protection.enabled": false,
        "mail_smtpmode": "smtp",
        "mail_smtpport": "25",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "maintenance_window_start": 1
    }
}

List of activated Apps

<pre>Enabled:
  - activity: 2.20.0
  - admin_audit: 1.18.0
  - assistant: 1.0.8
  - bookmarks: 13.1.3
  - bruteforcesettings: 2.8.0
  - calendar: 4.7.0
  - circles: 28.0.0
  - cloud_federation_api: 1.11.0
  - collectives: 2.10.1
  - comments: 1.18.0
  - contacts: 5.5.3
  - contactsinteraction: 1.9.0
  - dashboard: 7.8.0
  - dav: 1.29.1
  - deck: 1.12.2
  - end_to_end_encryption: 1.14.5
  - external: 5.3.1
  - externalpassword: 1.1.0
  - federatedfilesharing: 1.18.0
  - federation: 1.18.0
  - files: 2.0.0
  - files_accesscontrol: 1.18.0
  - files_antivirus: 5.5.0
  - files_pdfviewer: 2.9.0
  - files_reminders: 1.1.0
  - files_sharing: 1.20.0
  - files_trashbin: 1.18.0
  - files_versions: 1.21.0
  - firstrunwizard: 2.17.0
  - forms: 4.2.3
  - groupfolders: 16.0.6
  - guests: 3.0.1
  - impersonate: 1.15.0
  - integration_giphy: 1.0.10
  - integration_github: 2.0.7
  - integration_miro: 1.0.4
  - integration_openai: 2.0.0
  - logreader: 2.13.0
  - lookup_server_connector: 1.16.0
  - nextcloud_announcements: 1.17.0
  - notifications: 2.16.0
  - notify_push: 0.6.10
  - oauth2: 1.16.3
  - password_policy: 1.18.0
  - passwords: 2024.4.21
  - privacy: 1.12.0
  - provisioning_api: 1.18.0
  - quota_warning: 1.19.0
  - recommendations: 2.0.0
  - related_resources: 1.3.0
  - richdocuments: 8.3.5
  - serverinfo: 1.18.0
  - settings: 1.10.1
  - sharebymail: 1.18.0
  - side_menu: 3.12.0
  - socialsharing_email: 3.1.0
  - spreed: 18.0.7
  - support: 1.11.1
  - survey_client: 1.16.0
  - suspicious_login: 6.0.0
  - systemtags: 1.18.0
  - tasks: 0.15.0
  - text: 3.9.1
  - theming: 2.3.0
  - theming_customcss: 1.15.0
  - timemanager: 0.3.13
  - twofactor_backupcodes: 1.17.0
  - twofactor_totp: 10.0.0-beta.2
  - user_ldap: 1.19.0
  - user_status: 1.8.1
  - viewer: 2.2.0
  - workflowengine: 2.10.0
Disabled:
  - announcementcenter: 6.8.1 (installed 6.8.1)
  - encryption: 2.16.0
  - files_external: 1.20.0 (installed 1.20.0)
  - files_rightclick: 1.6.0 (installed 1.6.0)
  - integration_ews: 1.0.37 (installed 1.0.37)
  - mail: 3.6.0 (installed 3.6.0)
  - photos: 2.4.0 (installed 2.3.0)
  - updatenotification: 1.18.0 (installed 1.17.0)
  - user_saml: 6.1.3 (installed 6.1.3)
  - weather_status: 1.8.0 (installed 1.7.0)
  - welcome: 1.1.0 (installed 1.1.0)
</pre>

Nextcloud Signing status

Integrity checker has been disabled. Integrity cannot be verified.

Nextcloud Logs

No response

Additional info

No response

Start by locating the ScanFiles background job in the Nextcloud server code and review how it runs against the reported PHP 8.2, MySQL, and Debian/Ubuntu environment. Investigate the reported strace output and gather reproducible memory usage or logs, since the issue provides no reliable reproduction steps. Done means the job completes without exhausting the server's RAM.