linux-kernel - [PATCH v2] kernel/entry: Remove some redundancy checks on syscall works

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250615082833.858-1-khaliidcaliy@gmail.com>
Date: Sun, 15 Jun 2025 08:28:17 +0000
From: Khalid Ali <khaliidcaliy@...il.com>
To: tglx@...utronix.de,
	peterz@...radead.org,
	luto@...nel.org
Cc: linux-kernel@...r.kernel.org,
	Khalid Ali <khaliidcaliy@...il.com>
Subject: [PATCH v2] kernel/entry: Remove some redundancy checks on syscall works

Use SYSCALL_WORK_SYSCALL_AUDIT to check if audit needs to be done
instead of audit context for consistency to other syscall work bit
checks.

Signed-off-by: Khalid Ali <khaliidcaliy@...il.com>
---
 kernel/entry/common.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index f49e3440204d..3e9f2d40230f 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -17,12 +17,10 @@
 
 static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
 {
-	if (unlikely(audit_context())) {
-		unsigned long args[6];
+	unsigned long args[6];
 
-		syscall_get_arguments(current, regs, args);
-		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
-	}
+	syscall_get_arguments(current, regs, args);
+	audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
 }
 
 long syscall_trace_enter(struct pt_regs *regs, long syscall,
@@ -65,8 +63,9 @@ long syscall_trace_enter(struct pt_regs *regs, long syscall,
 		 */
 		syscall = syscall_get_nr(current, regs);
 	}
-
-	syscall_enter_audit(regs, syscall);
+	
+	if (unlikely(work & SYSCALL_WORK_SYSCALL_AUDIT))
+		syscall_enter_audit(regs, syscall);
 
 	return ret ? : syscall;
 }
-- 
2.49.0