On Thu 06-04-17 07:51:48, Paul Moore wrote: > On Wed, Apr 5, 2017 at 3:38 AM, Jan Kara <jack@xxxxxxx> wrote: > > On Tue 04-04-17 16:47:11, Paul Moore wrote: > >> On Mon, Apr 3, 2017 at 11:33 AM, Jan Kara <jack@xxxxxxx> wrote: > >> > Currently audit code uses checking of mark->inode to verify whether mark > >> > is still alive. Switch that to checking mark flags as that is more > >> > logical and current way will become unreliable in future. > >> > > >> > Reviewed-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > >> > Signed-off-by: Jan Kara <jack@xxxxxxx> > >> > --- > >> > kernel/audit_tree.c | 4 ++-- > >> > 1 file changed, 2 insertions(+), 2 deletions(-) > >> > >> Should audit_tree.c:insert_hash() also be updated in a similar manner? > > > > Do you mean the part which has become chunk_to_key()? ... > > No, I was talking about the if conditional near the top of the > function that checks to see if the fsnotify_mark's inode is non-NULL; > it seems like you would also want to convert that to a > FSNOTIFY_MARK_FLAG_ATTACHED, yes? Ah, that one. Yes, that can certainly become a FSNOTIFY_MARK_FLAG_ATTACHED check although I cannot currently come up with a situation where it would matter. But it looks safer that way so I'll change that check as you suggest. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
