linux/security/selinux
Eric Paris 9dc9978084 selinux: introduce schedule points in policydb_destroy()
During the LSPP testing we found that it was possible for
policydb_destroy() to take 10+ seconds of kernel time to complete.
Basically all policydb_destroy() does is walk some (possibly long) lists
and free the memory it finds.  Turning off slab debugging config options
made the problem go away since the actual functions which took most of
the time were (as seen by oprofile)

> 121202   23.9879  .check_poison_obj
> 78247    15.4864  .check_slabp

were caused by that.  So I decided to also add some voluntary schedule
points in that code so config voluntary preempt would be enough to solve
the problem.  Something similar was done in places like
shmem_free_pages() when we have to walk a list of memory and free it.
This was tested by the LSPP group on the hardware which could reproduce
the problem just loading a new policy and was found to not trigger the
softlock detector.  It takes just as much processing time, but the
kernel doesn't spend all that time stuck doing one thing and never
scheduling.

Someday a better way to handle memory might make the time needed in this
function a lot less, but this fixes the current issue as it stands
today.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2007-07-11 22:52:23 -04:00
..
include selinux: add selinuxfs structure for object class discovery 2007-07-11 22:52:20 -04:00
ss selinux: introduce schedule points in policydb_destroy() 2007-07-11 22:52:23 -04:00
avc.c selinux: remove userland security class and permission definitions 2007-04-26 01:35:58 -04:00
exports.c [PATCH] selinux: rename selinux_ctxid_to_string 2006-09-26 08:48:52 -07:00
hooks.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
Kconfig Fix trivial typos in Kconfig* files 2007-05-09 07:12:20 +02:00
Makefile SELinux: extract the NetLabel SELinux support from the security server 2007-04-26 01:35:48 -04:00
netif.c [PATCH] SELinux: convert to kzalloc 2005-10-30 17:37:11 -08:00
netlabel.c [NetLabel]: consolidate the struct socket/sock handling to just struct sock 2007-06-08 13:33:09 -07:00
netlink.c [NETLINK]: Switch cb_lock spinlock to mutex and allow to override it 2007-04-25 22:29:03 -07:00
nlmsgtab.c [IPv6] prefix: Convert RTM_NEWPREFIX notifications to use the new netlink api 2006-12-02 21:22:45 -08:00
selinuxfs.c selinux: add selinuxfs structure for object class discovery 2007-07-11 22:52:20 -04:00
xfrm.c SELinux: peer secid consolidation for external network labeling 2006-12-02 21:24:14 -08:00