Move it out of line and let it reread the syscall number on it's own. That makes the low level entry code denser and allows to move the reread to the call site of syscall_trace_enter() once the tracer is fixed up.
Signed-off-by: Thomas Gleixner <[email protected]> --- include/linux/entry-common.h | 14 +++----------- kernel/entry/syscall-common.c | 10 ++++++++++ 2 files changed, 13 insertions(+), 11 deletions(-) --- a/include/linux/entry-common.h +++ b/include/linux/entry-common.h @@ -60,16 +60,7 @@ static __always_inline bool arch_ptrace_ long trace_syscall_enter(struct pt_regs *regs, long syscall); void trace_syscall_exit(struct pt_regs *regs, long ret); - -static inline void syscall_enter_audit(struct pt_regs *regs, long syscall) -{ - if (unlikely(audit_context())) { - unsigned long args[6]; - - syscall_get_arguments(current, regs, args); - audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); - } -} +void syscall_enter_audit(struct pt_regs *regs); static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned long work, long syscall) @@ -111,7 +102,8 @@ static __always_inline long syscall_trac if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT)) syscall = trace_syscall_enter(regs, syscall); - syscall_enter_audit(regs, syscall); + if (unlikely(audit_context())) + syscall_enter_audit(regs); return syscall; } --- a/kernel/entry/syscall-common.c +++ b/kernel/entry/syscall-common.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 +#include <linux/audit.h> #include <linux/entry-common.h> #define CREATE_TRACE_POINTS @@ -21,3 +22,12 @@ void trace_syscall_exit(struct pt_regs * { trace_sys_exit(regs, ret); } + +void syscall_enter_audit(struct pt_regs *regs) +{ + long syscall = syscall_get_nr(current, regs); + unsigned long args[6]; + + syscall_get_arguments(current, regs, args); + __audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); +}
