linux-kernel - Re: [PATCH v2] audit: merge loops in __audit_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAABTaaA6BvcYP7_0KrOtXW7ehNH=RrZk4QFWoPujevXOJEY=Sw@mail.gmail.com>
Date: Fri, 24 Oct 2025 12:54:51 -0300
From: Ricardo Robaina <rrobaina@...hat.com>
To: Paul Moore <paul@...l-moore.com>
Cc: audit@...r.kernel.org, linux-kernel@...r.kernel.org, eparis@...hat.com
Subject: Re: [PATCH v2] audit: merge loops in __audit_inode_child()

On Thu, Oct 23, 2025 at 3:41 PM Paul Moore <paul@...l-moore.com> wrote:
>
> On Oct 22, 2025 Ricardo Robaina <rrobaina@...hat.com> wrote:
> >
> > Whenever there's audit context, __audit_inode_child() gets called
> > numerous times, which can lead to high latency in scenarios that
> > create too many sysfs/debugfs entries at once, for instance, upon
> > device_add_disk() invocation.
> >
> >    # uname -r
> >    6.17.0-rc3+
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m42.753s
> >    user 0m0.000s
> >    sys  0m42.494s
> >
> >    # perf record -a insmod loop max_loop=1000
> >    # perf report --stdio |grep __audit_inode_child
> >    37.95%  insmod  [kernel.kallsyms]  [k] __audit_inode_child
> >
> > __audit_inode_child() searches for both the parent and the child
> > in two different loops that iterate over the same list. This
> > process can be optimized by merging these into a single loop,
> > without changing the function behavior or affecting the code's
> > readability.
> >
> > This patch merges the two loops that walk through the list
> > context->names_list into a single loop. This optimization resulted
> > in around 54% performance enhancement for the benchmark.
> >
> >    # uname -r
> >    6.17.0-rc3+-enhanced
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m19.388s
> >    user 0m0.000s
> >    sys  0m19.149s
> >
> > Signed-off-by: Ricardo Robaina <rrobaina@...hat.com>
> > ---
> >  kernel/auditsc.c | 39 +++++++++++++++++----------------------
> >  1 file changed, 17 insertions(+), 22 deletions(-)
> >
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index d1966144bdfe..8cebc016d9eb 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2416,41 +2416,36 @@ void __audit_inode_child(struct inode *parent,
> >       if (inode)
> >               handle_one(inode);
> >
> > -     /* look for a parent entry first */
> >       list_for_each_entry(n, &context->names_list, list) {
> > -             if (!n->name ||
> > -                 (n->type != AUDIT_TYPE_PARENT &&
> > -                  n->type != AUDIT_TYPE_UNKNOWN))
> > +             /* can only match entries that have a name */
> > +             if (!n->name)
> >                       continue;
> >
> > -             if (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
> > -                 !audit_compare_dname_path(dname,
> > -                                           n->name->name, n->name_len)) {
> > +             /* look for a parent entry first */
> > +             if (!found_parent &&
> > +                 (n->ino == parent->i_ino && n->dev == parent->i_sb->s_dev &&
> > +                  !audit_compare_dname_path(dname, n->name->name, n->name_len))) {
> >                       if (n->type == AUDIT_TYPE_UNKNOWN)
> >                               n->type = AUDIT_TYPE_PARENT;
>
> As mentioned in my feedback on your v1 patch, we can probably set
> n->type equal to AUDIT_TYPE_PARENT without checking n->type first
> as it we want this set to AUDIT_TYPE_PARENT regardless.
>
> Please either fix this, or explain why it needs to be the way that it
> is in your v2 patch.
>
> >                       found_parent = n;
> > -                     break;
> > -             }
> > -     }
> > -
> > -     cond_resched();
> > -
> > -     /* is there a matching child entry? */
> > -     list_for_each_entry(n, &context->names_list, list) {
> > -             /* can only match entries that have a name */
> > -             if (!n->name ||
> > -                 (n->type != type && n->type != AUDIT_TYPE_UNKNOWN))
> > +                     if (found_child)
> > +                             break;
> >                       continue;
> > +             }
> >
> > -             if (!strcmp(dname->name, n->name->name) ||
> > -                 !audit_compare_dname_path(dname, n->name->name,
> > +             /* is there a matching child entry? */
> > +             if (!found_child &&
> > +                 (n->type == type || n->type == AUDIT_TYPE_UNKNOWN) &&
> > +                 (!strcmp(dname->name, n->name->name) ||
> > +                  !audit_compare_dname_path(dname, n->name->name,
> >                                               found_parent ?
> >                                               found_parent->name_len :
> > -                                             AUDIT_NAME_FULL)) {
> > +                                             AUDIT_NAME_FULL))) {
> >                       if (n->type == AUDIT_TYPE_UNKNOWN)
> >                               n->type = type;
> >                       found_child = n;
> > -                     break;
> > +                     if (found_parent)
> > +                             break;
> >               }
> >       }
> >
> > --
> > 2.51.0
>
> --
> paul-moore.com
>

Hi Paul,

Thanks for the heads-up!
Now I realize I misunderstood that piece of your review the first time
I read it. I'll fix it and post a newer version of this patch shortly.