LSM: shrink the common_audit_data data union

After shrinking the common_audit_data stack usage for private LSM data I'm
not going to shrink the data union.  To do this I'm going to move anything
larger than 2 void * ptrs to it's own structure and require it to be declared
separately on the calling stack.  Thus hot paths which don't need more than
a couple pointer don't have to declare space to hold large unneeded
structures.  I could get this down to one void * by dealing with the key
struct and the struct path.  We'll see if that is helpful after taking care of
networking.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 26 insertions, 13 deletions

diff --git a/security/smack/smack.h b/security/smack/smack.h
index ccba3823d9ef..4ede719922ed 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -325,6 +325,14 @@ static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
         a->a.smack_audit_data->function = func;
 }
 
+static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
+                                   char type, struct lsm_network_audit *net)
+{
+        smk_ad_init(a, func, type);
+        memset(net, 0, sizeof(*net));
+        a->a.u.net = net;
+}
+
 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
                                          struct task_struct *t)
 {
@@ -348,7 +356,7 @@ static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
                                             struct sock *sk)
 {
-        a->a.u.net.sk = sk;
+        a->a.u.net->sk = sk;
 }
 
 #else /* no AUDIT */
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index cd667b4089a5..81c03a597112 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1939,16 +1939,17 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
         char *hostsp;
         struct socket_smack *ssp = sk->sk_security;
         struct smk_audit_info ad;
+        struct lsm_network_audit net;
 
         rcu_read_lock();
         hostsp = smack_host_label(sap);
         if (hostsp != NULL) {
                 sk_lbl = SMACK_UNLABELED_SOCKET;
 #ifdef CONFIG_AUDIT
-                smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-                ad.a.u.net.family = sap->sin_family;
-                ad.a.u.net.dport = sap->sin_port;
-                ad.a.u.net.v4info.daddr = sap->sin_addr.s_addr;
+                smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+                ad.a.u.net->family = sap->sin_family;
+                ad.a.u.net->dport = sap->sin_port;
+                ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
 #endif
                 rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad);
         } else {
@@ -2808,9 +2809,10 @@ static int smack_unix_stream_connect(struct sock *sock,
         struct socket_smack *osp = other->sk_security;
         struct socket_smack *nsp = newsk->sk_security;
         struct smk_audit_info ad;
+        struct lsm_network_audit net;
         int rc = 0;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
         smk_ad_setfield_u_net_sk(&ad, other);
 
         if (!capable(CAP_MAC_OVERRIDE))
@@ -2840,9 +2842,10 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
         struct socket_smack *ssp = sock->sk->sk_security;
         struct socket_smack *osp = other->sk->sk_security;
         struct smk_audit_info ad;
+        struct lsm_network_audit net;
         int rc = 0;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
         smk_ad_setfield_u_net_sk(&ad, other->sk);
 
         if (!capable(CAP_MAC_OVERRIDE))
@@ -2990,6 +2993,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         char *csp;
         int rc;
         struct smk_audit_info ad;
+        struct lsm_network_audit net;
         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
                 return 0;
 
@@ -3007,9 +3011,9 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         netlbl_secattr_destroy(&secattr);
 
 #ifdef CONFIG_AUDIT
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-        ad.a.u.net.family = sk->sk_family;
-        ad.a.u.net.netif = skb->skb_iif;
+        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+        ad.a.u.net->family = sk->sk_family;
+        ad.a.u.net->netif = skb->skb_iif;
         ipv4_skb_to_auditdata(skb, &ad.a, NULL);
 #endif
         /*
@@ -3152,6 +3156,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         char *sp;
         int rc;
         struct smk_audit_info ad;
+        struct lsm_network_audit net;
 
         /* handle mapped IPv4 packets arriving via IPv6 sockets */
         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
@@ -3166,9 +3171,9 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         netlbl_secattr_destroy(&secattr);
 
 #ifdef CONFIG_AUDIT
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-        ad.a.u.net.family = family;
-        ad.a.u.net.netif = skb->skb_iif;
+        smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+        ad.a.u.net->family = family;
+        ad.a.u.net->netif = skb->skb_iif;
         ipv4_skb_to_auditdata(skb, &ad.a, NULL);
 #endif
         /*