linux/security/apparmor
John Johansen ea9bae12d0 apparmor: cache buffers on percpu list if there is lock contention
commit df323337e5 ("apparmor: Use a memory pool instead per-CPU caches")

changed buffer allocation to use a memory pool, however on a heavily
loaded machine there can be lock contention on the global buffers
lock. Add a percpu list to cache buffers on when lock contention is
encountered.

When allocating buffers attempt to use cached buffers first,
before taking the global buffers lock. When freeing buffers
try to put them back to the global list but if contention is
encountered, put the buffer on the percpu list.

The length of time a buffer is held on the percpu list is dynamically
adjusted based on lock contention.  The amount of hold time is
increased and decreased linearly.

v5:
- simplify base patch by removing: improvements can be added later
  - MAX_LOCAL and must lock
  - contention scaling.
v4:
- fix percpu ->count buffer count which had been spliced across a
  debug patch.
- introduce define for MAX_LOCAL_COUNT
- rework count check and locking around it.
- update commit message to reference commit that introduced the
  memory.
v3:
- limit number of buffers that can be pushed onto the percpu
  list. This avoids a problem on some kernels where one percpu
  list can inherit buffers from another cpu after a reschedule,
  causing more kernel memory to used than is necessary. Under
  normal conditions this should eventually return to normal
  but under pathelogical conditions the extra memory consumption
  may have been unbouanded
v2:
- dynamically adjust buffer hold time on percpu list based on
  lock contention.
v1:
- cache buffers on percpu list on lock contention

Reported-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-10-18 16:00:45 -07:00
..
include apparmor: add io_uring mediation 2023-10-18 15:58:49 -07:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
apparmorfs.c apparmor: add io_uring mediation 2023-10-18 15:58:49 -07:00
audit.c apparmor: add io_uring mediation 2023-10-18 15:58:49 -07:00
capability.c apparmor: pass cred through to audit info. 2023-10-18 15:30:38 -07:00
crypto.c apparmor: Return directly after a failed kzalloc() in two functions 2023-07-06 10:58:49 -07:00
domain.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
file.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
ipc.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
Kconfig + Features 2022-12-14 13:42:09 -08:00
label.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
lib.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
lsm.c apparmor: cache buffers on percpu list if there is lock contention 2023-10-18 16:00:45 -07:00
Makefile + Features 2022-12-14 13:42:09 -08:00
match.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
mount.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
net.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
nulldfa.in apparmor: cleanup add proper line wrapping to nulldfa.in 2018-02-09 11:30:01 -08:00
path.c security: apparmor: delete repeated words in comments 2021-02-07 04:15:46 -08:00
policy_compat.c apparmor: fixup return comments for kernel doc cleanups by Gaosheng Cui 2023-08-08 13:12:19 -07:00
policy_ns.c apparmor: remove unused functions in policy_ns.c/.h 2023-10-15 21:44:31 -07:00
policy_unpack_test.c apparmor: fix use of strcpy in policy_unpack_test 2023-07-06 10:58:49 -07:00
policy_unpack.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
policy.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
procattr.c apparmor: fix obsoleted comments for aa_getprocattr() and audit_resource() 2022-10-24 22:35:23 -07:00
resource.c apparmor: pass cred through to audit info. 2023-10-18 15:30:38 -07:00
secid.c apparmor: fix kernel-doc complaints 2023-01-10 10:04:35 -08:00
stacksplitdfa.in apparmor: use the dfa to do label parse string splitting 2018-02-09 11:30:01 -08:00
task.c apparmor: add user namespace creation mediation 2023-10-18 15:49:02 -07:00