Instead of unconditionally getting and conditionally putting the label, get the label conditionally, transfer the refcount, and avoid putting the label entirely. Reducing the number of refcount updates thus improves the performance of this LSM hook.
Signed-off-by: Ryan Lee <[email protected]> --- security/apparmor/lsm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index d502ad0ac26f..3f2a8d3ad498 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1307,19 +1307,19 @@ static int apparmor_socket_post_create(struct socket *sock, int family, { struct aa_label *label; - if (kern) { - label = aa_get_label(kernel_t); - } else - label = aa_get_current_label(); - if (sock->sk) { struct aa_sk_ctx *ctx = aa_sock(sock->sk); + if (kern) { + label = aa_get_label(kernel_t); + } else + label = aa_get_current_label(); + /* still not live */ aa_put_label(rcu_dereference_protected(ctx->label, true)); - rcu_assign_pointer(ctx->label, aa_get_label(label)); + /* transfer refcount */ + rcu_assign_pointer(ctx->label, label); } - aa_put_label(label); return 0; } -- 2.43.0
