• Dan Duval's avatar
    audit: efficiency fix 1: only wake up if queue shorter than backlog limit · db897319
    Dan Duval authored
    These and similar errors were seen on a patched 3.8 kernel when the
    audit subsystem was overrun during boot:
    
      udevd[876]: worker [887] unexpectedly returned with status 0x0100
      udevd[876]: worker [887] failed while handling
    '/devices/pci0000:00/0000:00:03.0/0000:40:00.0'
      udevd[876]: worker [880] unexpectedly returned with status 0x0100
      udevd[876]: worker [880] failed while handling
    '/devices/LNXSYSTM:00/LNXPWRBN:00/input/input1/event1'
    
      udevadm settle - timeout of 180 seconds reached, the event queue
    contains:
        /sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input1/event1 (3995)
        /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/INT3F0D:00 (4034)
    
      audit: audit_backlog=258 > audit_backlog_limit=256
      audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=256
    
    The change below increases the efficiency of the audit code and prevents it
    from being overrun:
    
    Only issue a wake_up in kauditd if the length of the skb queue is less than the
    backlog limit.  Otherwise, threads waiting in wait_for_auditd() will simply
    wake up, discover that the queue is still too long for them to proceed, and go
    back to sleep.  This results in wasted context switches and machine cycles.
    kauditd_thread() is the only function that removes buffers from audit_skb_queue
    so we can't race.  If we did, the timeout in wait_for_auditd() would expire and
    the waiting thread would continue.
    
    See: https://lkml.org/lkml/2013/9/2/479Signed-off-by: default avatarDan Duval <dan.duval@oracle.com>
    Signed-off-by: default avatarChuck Anderson <chuck.anderson@oracle.com>
    Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    db897319
audit.c 49.1 KB