On Oct 31, 2025 Ricardo Robaina <[email protected]> wrote: > > Whenever there's audit context, __audit_inode_child() gets called > numerous times, which can lead to high latency in scenarios that > create too many sysfs/debugfs entries at once, for instance, upon > device_add_disk() invocation. > > # uname -r > 6.18.0-rc2+ > > # auditctl -a always,exit -F path=/tmp -k foo > # time insmod loop max_loop=1000 > real 0m46.676s > user 0m0.000s > sys 0m46.405s > > # perf record -a insmod loop max_loop=1000 > # perf report --stdio |grep __audit_inode_child > 32.73% insmod [kernel.kallsyms] [k] __audit_inode_child > > __audit_inode_child() searches for both the parent and the child > in two different loops that iterate over the same list. This > process can be optimized by merging these into a single loop, > without changing the function behavior or affecting the code's > readability. > > This patch merges the two loops that walk through the list > context->names_list into a single loop. This optimization resulted > in around 51% performance enhancement for the benchmark. > > # uname -r > 6.18.0-rc2-enhancedv3+ > > # auditctl -a always,exit -F path=/tmp -k foo > # time insmod loop max_loop=1000 > real 0m22.899s > user 0m0.001s > sys 0m22.652s > > Signed-off-by: Ricardo Robaina <[email protected]> > --- > kernel/auditsc.c | 43 +++++++++++++++++++------------------------ > 1 file changed, 19 insertions(+), 24 deletions(-)
Looks good to me, merged into audit/dev, thanks! -- paul-moore.com
