From 9cf9d1d01d1ce2cfcf66d798cb23789064a104f0 Mon Sep 17 00:00:00 2001 From: Jamie Liu Date: Tue, 28 Nov 2023 15:23:13 -0800 Subject: [PATCH] Avoid redundant allocation in seccomp.optimizeSyscallRuleFunc(). PiperOrigin-RevId: 586120281 --- pkg/seccomp/seccomp_optimizer.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/pkg/seccomp/seccomp_optimizer.go b/pkg/seccomp/seccomp_optimizer.go index f0bd2e591..c6515abe3 100644 --- a/pkg/seccomp/seccomp_optimizer.go +++ b/pkg/seccomp/seccomp_optimizer.go @@ -191,11 +191,19 @@ func deduplicatePerArgs[T Or | And](rule SyscallRule) (SyscallRule, bool) { // An optimizer will be exhausted before the next one is ever run. // Earlier optimizers are re-exhausted if later optimizers cause change. func optimizeSyscallRuleFuncs(rule SyscallRule, funcs []ruleOptimizerFunc) SyscallRule { + // Instantiate this closure only once, since passing it to (interface + // method) rule.Recurse() causes it to escape. + var recurse func(subRule SyscallRule) SyscallRule + recurse = func(subRule SyscallRule) SyscallRule { + return optimizeSyscallRuleFuncsRecursive(subRule, funcs, recurse) + } + return optimizeSyscallRuleFuncsRecursive(rule, funcs, recurse) +} + +func optimizeSyscallRuleFuncsRecursive(rule SyscallRule, funcs []ruleOptimizerFunc, recurse func(subRule SyscallRule) SyscallRule) SyscallRule { for changed := true; changed; { for _, fn := range funcs { - rule.Recurse(func(subRule SyscallRule) SyscallRule { - return optimizeSyscallRuleFuncs(subRule, funcs) - }) + rule.Recurse(recurse) if rule, changed = fn(rule); changed { break }