Re: [GIT PULL] audit/audit-pr-20260410

[Linus Torvalds]

On Fri, 10 Apr 2026 at 16:26, Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
>
> We've only got a few audit patches for the v7.1 merge window, the
> highlights are below:

Pulled. However, can I ask you to take a look at my reply to one of
the vfs pulls, which was actually triggered by audit overhead?

It's entirely unrelated to this particular audit pull, but maybe you
have comments? See

    https://lore.kernel.org/all/CAHk-=wiW53j3vmc1Y58-E_8jUBJtjgAVxDRt+r-w3WPQN+Zm5w@xxxxxxxxxxxxxx/

and it's really all about that current "get_fs_pwd()" in
audit_alloc_name(), and the cache contention it causes when lots of
processes share the same pwd and you get everybody just updating the
path refcounts.

Would it be reasonable to do something along the lines I suggest,
where instead of getting that fairly "global" path refcount, instead
get a reference (with some way to do a copy-on-write break on it) to
'struct fs_struct' instead? No, we don't have that infrastructure (but
it doesn't seem _hugely_ complicated - famous last words), and yes, in
a heavily threaded app you'd still have potentially lots of threads
sharing a 'struct fs_struct', but at least that thing is local to the
process, so it's not shared beyond that.

And no, I don't expect that you'd actually start being interested in
the current root in auditing, but from a bigger VFS perspective, root
and pwd really are just two instances of the exact same thing and I
despise that spull that makes them different at a VFS level.

                  Linus