Commit 8cc96382 authored by Paul Moore's avatar Paul Moore

audit: use kmem_cache to manage the audit_buffer cache

The audit subsystem implemented its own buffer cache mechanism which
is a bit silly these days when we could use the kmem_cache construct.

Some credit is due to Florian Westphal for originally proposing that
we remove the audit cache implementation in favor of simple
kmalloc()/kfree() calls, but I would rather have a dedicated slab
cache to ease debugging and future stats/performance work.

Cc: Florian Westphal <fw@strlen.de>
Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 2115bb25
...@@ -59,6 +59,7 @@ ...@@ -59,6 +59,7 @@
#include <linux/mutex.h> #include <linux/mutex.h>
#include <linux/gfp.h> #include <linux/gfp.h>
#include <linux/pid.h> #include <linux/pid.h>
#include <linux/slab.h>
#include <linux/audit.h> #include <linux/audit.h>
...@@ -152,12 +153,7 @@ static atomic_t audit_lost = ATOMIC_INIT(0); ...@@ -152,12 +153,7 @@ static atomic_t audit_lost = ATOMIC_INIT(0);
/* Hash for inode-based rules */ /* Hash for inode-based rules */
struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
/* The audit_freelist is a list of pre-allocated audit buffers (if more static struct kmem_cache *audit_buffer_cache;
* than AUDIT_MAXFREE are in use, the audit buffer is freed instead of
* being placed on the freelist). */
static DEFINE_SPINLOCK(audit_freelist_lock);
static int audit_freelist_count;
static LIST_HEAD(audit_freelist);
/* queue msgs to send via kauditd_task */ /* queue msgs to send via kauditd_task */
static struct sk_buff_head audit_queue; static struct sk_buff_head audit_queue;
...@@ -192,17 +188,12 @@ DEFINE_MUTEX(audit_cmd_mutex); ...@@ -192,17 +188,12 @@ DEFINE_MUTEX(audit_cmd_mutex);
* should be at least that large. */ * should be at least that large. */
#define AUDIT_BUFSIZ 1024 #define AUDIT_BUFSIZ 1024
/* AUDIT_MAXFREE is the number of empty audit_buffers we keep on the
* audit_freelist. Doing so eliminates many kmalloc/kfree calls. */
#define AUDIT_MAXFREE (2*NR_CPUS)
/* The audit_buffer is used when formatting an audit record. The caller /* The audit_buffer is used when formatting an audit record. The caller
* locks briefly to get the record off the freelist or to allocate the * locks briefly to get the record off the freelist or to allocate the
* buffer, and locks briefly to send the buffer to the netlink layer or * buffer, and locks briefly to send the buffer to the netlink layer or
* to place it on a transmit queue. Multiple audit_buffers can be in * to place it on a transmit queue. Multiple audit_buffers can be in
* use simultaneously. */ * use simultaneously. */
struct audit_buffer { struct audit_buffer {
struct list_head list;
struct sk_buff *skb; /* formatted skb ready to send */ struct sk_buff *skb; /* formatted skb ready to send */
struct audit_context *ctx; /* NULL or associated context */ struct audit_context *ctx; /* NULL or associated context */
gfp_t gfp_mask; gfp_t gfp_mask;
...@@ -1486,6 +1477,10 @@ static int __init audit_init(void) ...@@ -1486,6 +1477,10 @@ static int __init audit_init(void)
if (audit_initialized == AUDIT_DISABLED) if (audit_initialized == AUDIT_DISABLED)
return 0; return 0;
audit_buffer_cache = kmem_cache_create("audit_buffer",
sizeof(struct audit_buffer),
0, SLAB_PANIC, NULL);
memset(&auditd_conn, 0, sizeof(auditd_conn)); memset(&auditd_conn, 0, sizeof(auditd_conn));
spin_lock_init(&auditd_conn.lock); spin_lock_init(&auditd_conn.lock);
...@@ -1554,60 +1549,33 @@ __setup("audit_backlog_limit=", audit_backlog_limit_set); ...@@ -1554,60 +1549,33 @@ __setup("audit_backlog_limit=", audit_backlog_limit_set);
static void audit_buffer_free(struct audit_buffer *ab) static void audit_buffer_free(struct audit_buffer *ab)
{ {
unsigned long flags;
if (!ab) if (!ab)
return; return;
kfree_skb(ab->skb); kfree_skb(ab->skb);
spin_lock_irqsave(&audit_freelist_lock, flags); kmem_cache_free(audit_buffer_cache, ab);
if (audit_freelist_count > AUDIT_MAXFREE)
kfree(ab);
else {
audit_freelist_count++;
list_add(&ab->list, &audit_freelist);
}
spin_unlock_irqrestore(&audit_freelist_lock, flags);
} }
static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx, static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx,
gfp_t gfp_mask, int type) gfp_t gfp_mask, int type)
{ {
unsigned long flags; struct audit_buffer *ab;
struct audit_buffer *ab = NULL;
struct nlmsghdr *nlh;
spin_lock_irqsave(&audit_freelist_lock, flags);
if (!list_empty(&audit_freelist)) {
ab = list_entry(audit_freelist.next,
struct audit_buffer, list);
list_del(&ab->list);
--audit_freelist_count;
}
spin_unlock_irqrestore(&audit_freelist_lock, flags);
if (!ab) {
ab = kmalloc(sizeof(*ab), gfp_mask);
if (!ab)
goto err;
}
ab->ctx = ctx; ab = kmem_cache_alloc(audit_buffer_cache, gfp_mask);
ab->gfp_mask = gfp_mask; if (!ab)
return NULL;
ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask); ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
if (!ab->skb) if (!ab->skb)
goto err; goto err;
if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
goto err;
nlh = nlmsg_put(ab->skb, 0, 0, type, 0, 0); ab->ctx = ctx;
if (!nlh) ab->gfp_mask = gfp_mask;
goto out_kfree_skb;
return ab; return ab;
out_kfree_skb:
kfree_skb(ab->skb);
ab->skb = NULL;
err: err:
audit_buffer_free(ab); audit_buffer_free(ab);
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment