On Mon 10-04-17 17:31:26, Jan Kara wrote: > On Thu 06-04-17 07:51:48, Paul Moore wrote: > > On Wed, Apr 5, 2017 at 3:38 AM, Jan Kara wrote: > > > On Tue 04-04-17 16:47:11, Paul Moore wrote: > > >> On Mon, Apr 3, 2017 at 11:33 AM, Jan Kara wrote: > > >> > Currently audit code uses checking of mark->inode to verify whether mark > > >> > is still alive. Switch that to checking mark flags as that is more > > >> > logical and current way will become unreliable in future. > > >> > > > >> > Reviewed-by: Miklos Szeredi > > >> > Signed-off-by: Jan Kara > > >> > --- > > >> > kernel/audit_tree.c | 4 ++-- > > >> > 1 file changed, 2 insertions(+), 2 deletions(-) > > >> > > >> Should audit_tree.c:insert_hash() also be updated in a similar manner? > > > > > > Do you mean the part which has become chunk_to_key()? ... > > > > No, I was talking about the if conditional near the top of the > > function that checks to see if the fsnotify_mark's inode is non-NULL; > > it seems like you would also want to convert that to a > > FSNOTIFY_MARK_FLAG_ATTACHED, yes? > > Ah, that one. Yes, that can certainly become a FSNOTIFY_MARK_FLAG_ATTACHED > check although I cannot currently come up with a situation where it would > matter. But it looks safer that way so I'll change that check as you > suggest. Attached is the resulting patch. Honza -- Jan Kara SUSE Labs, CR