From 6f25517010ddd3f8080d7e06b9b1cb1b64b73772 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Sun, 12 Jul 2026 23:25:17 +0200 Subject: [PATCH] entry: Rework syscall_audit_enter() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move it out of line and let it reread the syscall number on it's own. That makes the low level entry code denser and allows to move the reread to the call site of syscall_trace_enter() once the tracer is fixed up. To prevent the compiler from putting audit_context() out of line and thereby breaking dead code elimination, mark audit_context() __always_inline. Signed-off-by: Thomas Gleixner Tested-by: Michal Suchánek Reviewed-by: Jinjie Ruan Link: https://patch.msgid.link/20260712141346.576865340@kernel.org --- include/linux/entry-common.h | 14 +++----------- kernel/entry/syscall-common.c | 12 ++++++++++++ 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h index 299f13c78a6f..78cfeeb7a5f0 100644 --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -60,16 +60,7 @@ static __always_inline bool arch_ptrace_report_syscall_permit_entry(struct pt_re long trace_syscall_enter(struct pt_regs *regs, long syscall); void trace_syscall_exit(struct pt_regs *regs, long ret); - -static inline void syscall_enter_audit(struct pt_regs *regs, long syscall) -{ - if (unlikely(audit_context())) { - unsigned long args[6]; - - syscall_get_arguments(current, regs, args); - audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); - } -} +void syscall_enter_audit(struct pt_regs *regs); static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work, long syscall) @@ -114,7 +105,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT)) syscall = trace_syscall_enter(regs, syscall); - syscall_enter_audit(regs, syscall); + if (unlikely(audit_context())) + syscall_enter_audit(regs); return syscall; } diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c index cd4967a9c53e..b3cde6fcee3e 100644 --- a/kernel/entry/syscall-common.c +++ b/kernel/entry/syscall-common.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 +#include #include #define CREATE_TRACE_POINTS @@ -21,3 +22,14 @@ void trace_syscall_exit(struct pt_regs *regs, long ret) { trace_sys_exit(regs, ret); } + +#ifdef CONFIG_AUDITSYSCALL +void syscall_enter_audit(struct pt_regs *regs) +{ + long syscall = syscall_get_nr(current, regs); + unsigned long args[6]; + + syscall_get_arguments(current, regs, args); + __audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); +} +#endif