Smack: Create smack_rule cache to optimize memory usage

This patch allows for small memory optimization by creating the
kmem cache for "struct smack_rule" instead of using kzalloc.
For adding new smack rule, kzalloc is used to allocate the memory
for "struct smack_rule". kzalloc will always allocate 32 or 64 bytes
for 1 structure depending upon the kzalloc cache sizes available in
system. Although the size of structure is 20 bytes only, resulting
in memory wastage per object in the default pool.

For e.g., if there are 20000 rules, then it will save 240KB(20000*12)
which is crucial for small memory targets.

Signed-off-by: Vishal Goel <vishal.goel@samsung.com>
Signed-off-by: Amit Sahrawat <a.sahrawat@samsung.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>

diff --git a/security/smack/smack.h b/security/smack/smack.h
index cf52af77d15eef29c083ae1fd27137763b8729d0..e41ca1d584845ad9abcb39ff99f3c0cf21013708 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -348,6 +348,7 @@ extern struct list_head smack_onlycap_list;
 
 #define SMACK_HASH_SLOTS 16
 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
+extern struct kmem_cache *smack_rule_cache;
 
 static inline struct task_smack *smack_cred(const struct cred *cred)
 {

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 5c1613519d5ad3c49696d3cc28ef8bc5edbedf25..bd45c9139d34c6b23bbdac9d7f62a9776e5f1f64 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -59,6 +59,7 @@ DEFINE_MUTEX(smack_ipv6_lock);
 static LIST_HEAD(smk_ipv6_port_list);
 #endif
 static struct kmem_cache *smack_inode_cache;
+struct kmem_cache *smack_rule_cache;
 int smack_enabled;
 
 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s}
@@ -354,7 +355,7 @@ static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
        int rc = 0;
 
        list_for_each_entry_rcu(orp, ohead, list) {
-               nrp = kzalloc(sizeof(struct smack_rule), gfp);
+               nrp = kmem_cache_zalloc(smack_rule_cache, gfp);
                if (nrp == NULL) {
                        rc = -ENOMEM;
                        break;
@@ -1931,7 +1932,7 @@ static void smack_cred_free(struct cred *cred)
        list_for_each_safe(l, n, &tsp->smk_rules) {
                rp = list_entry(l, struct smack_rule, list);
                list_del(&rp->list);
-               kfree(rp);
+               kmem_cache_free(smack_rule_cache, rp);
        }
 }
 
@@ -4758,6 +4759,12 @@ static __init int smack_init(void)
        if (!smack_inode_cache)
                return -ENOMEM;
 
+       smack_rule_cache = KMEM_CACHE(smack_rule, 0);
+       if (!smack_rule_cache) {
+               kmem_cache_destroy(smack_inode_cache);
+               return -ENOMEM;
+       }
+
        /*
         * Set the security state for the initial task.
         */

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 8406738b45f2c3804507f15c357d177e4dfd7761..47f73a0dabb1947abcd44c4e7ca946fcc1b62082 100644 (file)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -236,7 +236,7 @@ static int smk_set_access(struct smack_parsed_rule *srp,
        }
 
        if (found == 0) {
-               sp = kzalloc(sizeof(*sp), GFP_KERNEL);
+               sp = kmem_cache_zalloc(smack_rule_cache, GFP_KERNEL);
                if (sp == NULL) {
                        rc = -ENOMEM;
                        goto out;