Use SYSCALL_WORK_SYSCALL_AUDIT to check if audit needs to be done
instead of audit context for consistency to other syscall work bit
checks.

Signed-off-by: Khalid Ali <khaliidcaliy@gmail.com>
---
 kernel/entry/common.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index f49e3440204d..3e9f2d40230f 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -17,12 +17,10 @@
 
 static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
 {
-	if (unlikely(audit_context())) {
-		unsigned long args[6];
+	unsigned long args[6];
 
-		syscall_get_arguments(current, regs, args);
-		audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
-	}
+	syscall_get_arguments(current, regs, args);
+	audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
 }
 
 long syscall_trace_enter(struct pt_regs *regs, long syscall,
@@ -65,8 +63,9 @@ long syscall_trace_enter(struct pt_regs *regs, long syscall,
 		 */
 		syscall = syscall_get_nr(current, regs);
 	}
-
-	syscall_enter_audit(regs, syscall);
+	
+	if (unlikely(work & SYSCALL_WORK_SYSCALL_AUDIT))
+		syscall_enter_audit(regs, syscall);
 
 	return ret ? : syscall;
 }
-- 
2.49.0

On Sun, Jun 15 2025 at 08:28, Khalid Ali wrote:

Same prefix comment as for the other patch.

> Use SYSCALL_WORK_SYSCALL_AUDIT to check if audit needs to be done
> instead of audit context for consistency to other syscall work bit
> checks.

This does not explain why this is correct. I explained it to you here:

     https://lore.kernel.org/all/87frg2q1w7.ffs@tglx

You also missed the fact that audit_syscall_entry() has yet another
check for audit context, which means there is still redundancy, right?

Thanks,

        tglx

> Same prefix comment as for the other patch.
I will fix on v3 if agree with me this one.
> You also missed the fact that audit_syscall_entry() has yet another
> check for audit context, which means there is still redundancy, right?

There will be a redundancy always. You told me earlier of this patch it is for performance,
however my patch makes consistent by replacing the upper context check to checking work bit.
We can't do anything about audit_syscall_entry() because it is used in multiple places.

Is there a problem if we just replace the upper context check with work bit as i did in this patch.