linux-kernel - Re: [PATCH v3] audit: merge loops in __audit_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAABTaaA9qy8P-LLuT8mfv5a8Sc_g2MJcjRDcFMET0dwGwRoj1g@mail.gmail.com>
Date: Mon, 10 Nov 2025 09:11:11 -0300
From: Ricardo Robaina <rrobaina@...hat.com>
To: Paul Moore <paul@...l-moore.com>
Cc: audit@...r.kernel.org, linux-kernel@...r.kernel.org, eparis@...hat.com
Subject: Re: [PATCH v3] audit: merge loops in __audit_inode_child()

Thanks, Paul!

On Fri, Nov 7, 2025 at 6:50 PM Paul Moore <paul@...l-moore.com> wrote:
>
> On Oct 31, 2025 Ricardo Robaina <rrobaina@...hat.com> wrote:
> >
> > Whenever there's audit context, __audit_inode_child() gets called
> > numerous times, which can lead to high latency in scenarios that
> > create too many sysfs/debugfs entries at once, for instance, upon
> > device_add_disk() invocation.
> >
> >    # uname -r
> >    6.18.0-rc2+
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m46.676s
> >    user 0m0.000s
> >    sys 0m46.405s
> >
> >    # perf record -a insmod loop max_loop=1000
> >    # perf report --stdio |grep __audit_inode_child
> >    32.73%  insmod [kernel.kallsyms] [k] __audit_inode_child
> >
> > __audit_inode_child() searches for both the parent and the child
> > in two different loops that iterate over the same list. This
> > process can be optimized by merging these into a single loop,
> > without changing the function behavior or affecting the code's
> > readability.
> >
> > This patch merges the two loops that walk through the list
> > context->names_list into a single loop. This optimization resulted
> > in around 51% performance enhancement for the benchmark.
> >
> >    # uname -r
> >    6.18.0-rc2-enhancedv3+
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m22.899s
> >    user 0m0.001s
> >    sys 0m22.652s
> >
> > Signed-off-by: Ricardo Robaina <rrobaina@...hat.com>
> > ---
> >  kernel/auditsc.c | 43 +++++++++++++++++++------------------------
> >  1 file changed, 19 insertions(+), 24 deletions(-)
>
> Looks good to me, merged into audit/dev, thanks!
>
> --
> paul-moore.com
>