linux-kernel - [PATCH v3 0/2] fs, audit: Avoid excessive dput/dget in audit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260206201918.1988344-1-longman@redhat.com>
Date: Fri,  6 Feb 2026 15:19:15 -0500
From: Waiman Long <longman@...hat.com>
To: Paul Moore <paul@...l-moore.com>,
	Eric Paris <eparis@...hat.com>,
	Christian Brauner <brauner@...nel.org>,
	Al Viro <viro@...iv.linux.org.uk>
Cc: linux-kernel@...r.kernel.org,
	audit@...r.kernel.org,
	Richard Guy Briggs <rgb@...hat.com>,
	Ricardo Robaina <rrobaina@...hat.com>,
	Waiman Long <longman@...hat.com>
Subject: [PATCH v3 0/2] fs, audit: Avoid excessive dput/dget in audit_context setup and reset paths

 v3:
  - Add a new counter in fs_struct to track # of additional references
    to pwd and add a new get_fs_pwd_pool() and put_fs_pwd_pool helpers
    to use the new counter.
  - Make audit use the new helpers instead of storing pwd reference
    internally.

 v2: https://lore.kernel.org/lkml/20260203194433.1738162-1-longman@redhat.com/

When the audit subsystem is enabled, it can do a lot of get_fs_pwd()
calls to get references to fs->pwd and then releasing those references
back with path_put() later. That may cause a lot of spinlock contention
on a single pwd's dentry lock because of the constant changes to the
reference count when there are many processes on the same working
directory actively doing open/close system calls. This can cause
noticeable performance regresssion when compared with the case where
the audit subsystem is turned off especially on systems with a lot of
CPUs which is becoming more common these days.

This patch series aim to avoid this type of performance regression caused
by audit by adding a new set of fs_struct helpers to reduce unncessary
path_get() and path_put() calls and the audit code is modified to use
these new helpers.

Waiman Long (2):
  fs: Add a pool of extra fs->pwd references to fs_struct
  audit: Use the new {get,put}_fs_pwd_pool() APIs to get/put pwd
    references

 fs/fs_struct.c            | 26 +++++++++++++++++++++-----
 fs/namespace.c            |  8 ++++++++
 include/linux/fs_struct.h | 30 +++++++++++++++++++++++++++++-
 kernel/auditsc.c          |  7 +++++--
 4 files changed, 63 insertions(+), 8 deletions(-)

-- 
2.52.0