On Wed, Apr 5, 2017 at 3:38 AM, Jan Kara <jack@xxxxxxx> wrote: > On Tue 04-04-17 16:47:11, Paul Moore wrote: >> On Mon, Apr 3, 2017 at 11:33 AM, Jan Kara <jack@xxxxxxx> wrote: >> > Currently audit code uses checking of mark->inode to verify whether mark >> > is still alive. Switch that to checking mark flags as that is more >> > logical and current way will become unreliable in future. >> > >> > Reviewed-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> >> > Signed-off-by: Jan Kara <jack@xxxxxxx> >> > --- >> > kernel/audit_tree.c | 4 ++-- >> > 1 file changed, 2 insertions(+), 2 deletions(-) >> >> Should audit_tree.c:insert_hash() also be updated in a similar manner? > > Do you mean the part which has become chunk_to_key()? ... No, I was talking about the if conditional near the top of the function that checks to see if the fsnotify_mark's inode is non-NULL; it seems like you would also want to convert that to a FSNOTIFY_MARK_FLAG_ATTACHED, yes?
