Re: [PATCH v3] audit: merge loops in __audit_inode_child()

Thanks, Paul!

On Fri, Nov 7, 2025 at 6:50 PM Paul Moore <[email protected]> wrote:
>
> On Oct 31, 2025 Ricardo Robaina <[email protected]> wrote:
> >
> > Whenever there's audit context, __audit_inode_child() gets called
> > numerous times, which can lead to high latency in scenarios that
> > create too many sysfs/debugfs entries at once, for instance, upon
> > device_add_disk() invocation.
> >
> >    # uname -r
> >    6.18.0-rc2+
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m46.676s
> >    user 0m0.000s
> >    sys 0m46.405s
> >
> >    # perf record -a insmod loop max_loop=1000
> >    # perf report --stdio |grep __audit_inode_child
> >    32.73%  insmod [kernel.kallsyms] [k] __audit_inode_child
> >
> > __audit_inode_child() searches for both the parent and the child
> > in two different loops that iterate over the same list. This
> > process can be optimized by merging these into a single loop,
> > without changing the function behavior or affecting the code's
> > readability.
> >
> > This patch merges the two loops that walk through the list
> > context->names_list into a single loop. This optimization resulted
> > in around 51% performance enhancement for the benchmark.
> >
> >    # uname -r
> >    6.18.0-rc2-enhancedv3+
> >
> >    # auditctl -a always,exit -F path=/tmp -k foo
> >    # time insmod loop max_loop=1000
> >    real 0m22.899s
> >    user 0m0.001s
> >    sys 0m22.652s
> >
> > Signed-off-by: Ricardo Robaina <[email protected]>
> > ---
> >  kernel/auditsc.c | 43 +++++++++++++++++++------------------------
> >  1 file changed, 19 insertions(+), 24 deletions(-)
>
> Looks good to me, merged into audit/dev, thanks!
>
> --
> paul-moore.com
>