evm: stop avoidably reading i_writecount in evm_file_release

The EVM_NEW_FILE flag is unset if the file already existed at the time
of open and this can be checked without looking at i_writecount.

Not accessing it reduces traffic on the cacheline during parallel open
of the same file and drop the evm_file_release routine from second place
to bottom of the profile.

Fixes: 75a323e604fc ("evm: Make it independent from 'integrity' LSM")
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Cc: stable@vger.kernel.org # 6.9+
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 6924ed508ebdb3fcf7f0d6ff87ad0ae1ffed147f..377e57e9084f0e5013b5214e91703cb2e4cc05c9 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -1084,7 +1084,8 @@ static void evm_file_release(struct file *file)
        if (!S_ISREG(inode->i_mode) || !(mode & FMODE_WRITE))
                return;
 
-       if (iint && atomic_read(&inode->i_writecount) == 1)
+       if (iint && iint->flags & EVM_NEW_FILE &&
+           atomic_read(&inode->i_writecount) == 1)
                iint->flags &= ~EVM_NEW_FILE;
 }