[tip: core/entry] entry: Rework syscall_audit_enter()

[tip-bot2 for Thomas Gleixner]

The following commit has been merged into the core/entry branch of tip:

Commit-ID:     6f25517010ddd3f8080d7e06b9b1cb1b64b73772
Gitweb:        https://git.kernel.org/tip/6f25517010ddd3f8080d7e06b9b1cb1b64b73772
Author:        Thomas Gleixner <tglx@xxxxxxxxxx>
AuthorDate:    Sun, 12 Jul 2026 23:25:17 +02:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Mon, 20 Jul 2026 20:38:40 +02:00

entry: Rework syscall_audit_enter()

Move it out of line and let it reread the syscall number on it's own. That
makes the low level entry code denser and allows to move the reread to the
call site of syscall_trace_enter() once the tracer is fixed up.

To prevent the compiler from putting audit_context() out of line and
thereby breaking dead code elimination, mark audit_context()
__always_inline.

Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Tested-by: Michal Suchánek <msuchanek@xxxxxxx>
Reviewed-by: Jinjie Ruan <ruanjinjie@xxxxxxxxxx>
Link: https://patch.msgid.link/20260712141346.576865340@xxxxxxxxxx
---
 include/linux/entry-common.h  | 14 +++-----------
 kernel/entry/syscall-common.c | 12 ++++++++++++
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/include/linux/entry-common.h b/include/linux/entry-common.h
index 299f13c..78cfeeb 100644
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -60,16 +60,7 @@ static __always_inline bool arch_ptrace_report_syscall_permit_entry(struct pt_re
 
 long trace_syscall_enter(struct pt_regs *regs, long syscall);
 void trace_syscall_exit(struct pt_regs *regs, long ret);
-
-static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
-{
-	if (unlikely(audit_context())) {
-		unsigned long args[6];
-
-		syscall_get_arguments(current, regs, args);
-		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
-	}
-}
+void syscall_enter_audit(struct pt_regs *regs);
 
 static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work,
 						long syscall)
@@ -114,7 +105,8 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l
 	if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT))
 		syscall = trace_syscall_enter(regs, syscall);
 
-	syscall_enter_audit(regs, syscall);
+	if (unlikely(audit_context()))
+		syscall_enter_audit(regs);
 
 	return syscall;
 }
diff --git a/kernel/entry/syscall-common.c b/kernel/entry/syscall-common.c
index cd4967a..b3cde6f 100644
--- a/kernel/entry/syscall-common.c
+++ b/kernel/entry/syscall-common.c
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 
+#include <linux/audit.h>
 #include <linux/entry-common.h>
 
 #define CREATE_TRACE_POINTS
@@ -21,3 +22,14 @@ void trace_syscall_exit(struct pt_regs *regs, long ret)
 {
 	trace_sys_exit(regs, ret);
 }
+
+#ifdef CONFIG_AUDITSYSCALL
+void syscall_enter_audit(struct pt_regs *regs)
+{
+	long syscall = syscall_get_nr(current, regs);
+	unsigned long args[6];
+
+	syscall_get_arguments(current, regs, args);
+	__audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
+}
+#endif