linux-kernel - Re: [PATCH v3] audit: merge loops in __audit_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <54043277138c6499c0ced9bbdcae7cf5@paul-moore.com>
Date: Fri, 07 Nov 2025 16:50:40 -0500
From: Paul Moore <paul@...l-moore.com>
To: Ricardo Robaina <rrobaina@...hat.com>, audit@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: eparis@...hat.com, Ricardo Robaina <rrobaina@...hat.com>
Subject: Re: [PATCH v3] audit: merge loops in __audit_inode_child()

On Oct 31, 2025 Ricardo Robaina <rrobaina@...hat.com> wrote:
> 
> Whenever there's audit context, __audit_inode_child() gets called
> numerous times, which can lead to high latency in scenarios that
> create too many sysfs/debugfs entries at once, for instance, upon
> device_add_disk() invocation.
> 
>    # uname -r
>    6.18.0-rc2+
> 
>    # auditctl -a always,exit -F path=/tmp -k foo
>    # time insmod loop max_loop=1000
>    real 0m46.676s
>    user 0m0.000s
>    sys 0m46.405s
> 
>    # perf record -a insmod loop max_loop=1000
>    # perf report --stdio |grep __audit_inode_child
>    32.73%  insmod [kernel.kallsyms] [k] __audit_inode_child
> 
> __audit_inode_child() searches for both the parent and the child
> in two different loops that iterate over the same list. This
> process can be optimized by merging these into a single loop,
> without changing the function behavior or affecting the code's
> readability.
> 
> This patch merges the two loops that walk through the list
> context->names_list into a single loop. This optimization resulted
> in around 51% performance enhancement for the benchmark.
> 
>    # uname -r
>    6.18.0-rc2-enhancedv3+
> 
>    # auditctl -a always,exit -F path=/tmp -k foo
>    # time insmod loop max_loop=1000
>    real 0m22.899s
>    user 0m0.001s
>    sys 0m22.652s
> 
> Signed-off-by: Ricardo Robaina <rrobaina@...hat.com>
> ---
>  kernel/auditsc.c | 43 +++++++++++++++++++------------------------
>  1 file changed, 19 insertions(+), 24 deletions(-)

Looks good to me, merged into audit/dev, thanks!

--
paul-moore.com