On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> You added it in:
> commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> Author: Jeff Layton <jlayton@xxxxxxxxxx>
> Date: Wed Oct 10 15:25:28 2012 -0400
>
> audit: allow audit code to satisfy getname requests from its names_list
>
> Do I read correctly this has no user-visible impact, but merely tries
> to shave off some memory usage in case of duplicated user bufs?
>
> This is partially getting in the way of whacking atomics for filename
> ref management (but can be worked around).
>
> AFAIU this change is not all *that* beneficial in its own right, so
> should not be a big deal to whack it regardless of what happens with
> refs? Note it would also remove some branches in the common case as
> normally audit either has dummy context or there is no match anyway.
(cc'ing audit folks and mailing list)
IIRC, having duplicate audit_names records can cause audit to emit
extra name records in this loop in audit_log_exit():
list_for_each_entry(n, &context->names_list, list) {
if (n->hidden)
continue;
audit_log_name(context, n, NULL, i++, &call_panic);
}
...which is something you probably want to avoid.
--
Jeff Layton <jlayton@xxxxxxxxxx>
