Please enable CONFIG_PAGE_POISONING

[Kees Cook]

I'd like to be able to use page poisoning, but CONFIG_PAGE_POISONING is not enabled on Ubuntu. (This option itself has a near-zero performance impact since it must be combined with the boot option "page_poison=1" to actually enable the poisoning.)

To make the poisoning (when enabled) less of an impact, I'd also like to see CONFIG_PAGE_POISONING_ZERO=y too, which means GFP_ZEROing can be skipped.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1783651

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Tyler Hicks (tyhicks)]

I've taken a quick look and I believe that the current upstream code matches Kees' description.

Kees didn't mention it but I suspect that he also wants CONFIG_PAGE_POISONING_NO_SANITY to be 'n' where possible when CONFIG_HIBERNATION isn't selected.

[Kees Cook (kees)]

Oh no, leave CONFIG_PAGE_POISONING_NO_SANITY=y. Things get REALLY slow without that, and the default kernel is built with hibernation, so I would expect to do =y for that option.

[Kees Cook (kees)]

To clarify, I'm suggesting:

CONFIG_PAGE_POISONING=y
CONFIG_PAGE_POISONING_ZERO=y
CONFIG_PAGE_POISONING_NO_SANITY=y

this should have no impact on regular boots, and if someone boots with "page_poison=1" then they get page wiping when page_alloc pages are freed (and then GFP_ZERO is a no-op since it was already freed), so it becomes a reasonable trade-off on performance vs gaining the wipe-on-free ability of the buddy allocator.

[Colin Ian King (colin-king)]

I've built and tested 4.15 and the latest 4.18 with the following configs:

CONFIG_PAGE_POISONING=y
CONFIG_PAGE_POISONING_ZERO=y
CONFIG_PAGE_POISONING_NO_SANITY=y

Attached is a libreoffice spreadsheet with the test results comparing kernels without the config, with the config and with the config with page_poison=1 for the 4.18 and 4.15 kernels. I ran nearly 200 stress-ng stress tests and gathered the throughput (based on bogo ops per second on the usr+sys time consumed) for each stress test. Each of the stress tests were run for 60 seconds on an idle 8 thread Xeon i7-3770.

The bogo-ops data was then normalized against the kernel that didn't have the config changes. The data to look at is the geometric means of all the normalized test results:

4.18 kernel, geometric mean of normalized bogo/ops throughput:

No page poisoning: 1.000
Config page poisoning: 1.003
Config page poionsing + page_poison=1: 0.991

4.15 kernel, geometric mean of normalized bogo/ops throughput:

No page poisoning: 1.000
Config page poisoning: 1.025
Config page poionsing + page_poison=1: 0.977

where > 1.000 shows more throughput and < 1.000 shows degraded throughput

So it appears that enabling page poisoning configs does not degrade performance and setting page_poison=1 degrades performance by a very small amount.

[Colin Ian King (colin-king)]

Patch sent to kernel team mailing list

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.18.0-8.9

---------------
linux (4.18.0-8.9) cosmic; urgency=medium

  * linux: 4.18.0-8.9 -proposed tracker (LP: #1791663)

  * Cosmic update to v4.18.7 stable release (LP: #1791660)
    - rcu: Make expedited GPs handle CPU 0 being offline
    - net: 6lowpan: fix reserved space for single frames
    - net: mac802154: tx: expand tailroom if necessary
    - 9p/net: Fix zero-copy path in the 9p virtio transport
    - spi: davinci: fix a NULL pointer dereference
    - spi: pxa2xx: Add support for Intel Ice Lake
    - spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe
    - spi: cadence: Change usleep_range() to udelay(), for atomic context
    - mmc: block: Fix unsupported parallel dispatch of requests
    - mmc: renesas_sdhi_internal_dmac: mask DMAC interrupts
    - mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS
    - readahead: stricter check for bdi io_pages
    - block: fix infinite loop if the device loses discard capability
    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case
    - block: really disable runtime-pm for blk-mq
    - blkcg: Introduce blkg_root_lookup()
    - block: Introduce blk_exit_queue()
    - block: Ensure that a request queue is dissociated from the cgroup controller
    - apparmor: fix bad debug check in apparmor_secid_to_secctx()
    - dma-buf: Move BUG_ON from _add_shared_fence to _add_shared_inplace
    - libertas: fix suspend and resume for SDIO connected cards
    - media: Revert "[media] tvp5150: fix pad format frame height"
    - mailbox: xgene-slimpro: Fix potential NULL pointer dereference
    - Replace magic for trusting the secondary keyring with #define
    - Fix kexec forbidding kernels signed with keys in the secondary keyring to
      boot
    - powerpc/fadump: handle crash memory ranges array index overflow
    - powerpc/64s: Fix page table fragment refcount race vs speculative references
    - powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
    - powerpc/pkeys: Give all threads control of their key permissions
    - powerpc/pkeys: Deny read/write/execute by default
    - powerpc/pkeys: key allocation/deallocation must not change pkey registers
    - powerpc/pkeys: Save the pkey registers before fork
    - powerpc/pkeys: Fix calculation of total pkeys.
    - powerpc/pkeys: Preallocate execute-only key
    - powerpc/nohash: fix pte_access_permitted()
    - powerpc64/ftrace: Include ftrace.h needed for enable/disable calls
    - powerpc/powernv/pci: Work around races in PCI bridge enabling
    - cxl: Fix wrong comparison in cxl_adapter_context_get()
    - IB/mlx5: Honor cnt_set_id_valid flag instead of set_id
    - IB/mlx5: Fix leaking stack memory to userspace
    - IB/srpt: Fix srpt_cm_req_recv() error path (1/2)
    - IB/srpt: Fix srpt_cm_req_recv() error path (2/2)
    - IB/srpt: Support HCAs with more than two ports
    - overflow.h: Add arithmetic shift helper
    - RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq
    - ib_srpt: Fix a use-after-free in srpt_close_ch()
    - ib_srpt: Fix a use-after-free in __srpt_close_all_ch()
    - RDMA/rxe: Set wqe->status correctly if an unexpected...

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Andy Whitcroft (apw)]

This bug was erroneously marked for verification in bionic; verification is not required and verification-needed-bionic is being removed.