On Mon, Apr 10, 2017 at 11:43 AM, Jan Kara <jack@xxxxxxx> wrote: > On Mon 10-04-17 17:31:26, Jan Kara wrote: >> On Thu 06-04-17 07:51:48, Paul Moore wrote: >> > On Wed, Apr 5, 2017 at 3:38 AM, Jan Kara <jack@xxxxxxx> wrote: >> > > On Tue 04-04-17 16:47:11, Paul Moore wrote: >> > >> On Mon, Apr 3, 2017 at 11:33 AM, Jan Kara <jack@xxxxxxx> wrote: >> > >> > Currently audit code uses checking of mark->inode to verify whether mark >> > >> > is still alive. Switch that to checking mark flags as that is more >> > >> > logical and current way will become unreliable in future. >> > >> > >> > >> > Reviewed-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> >> > >> > Signed-off-by: Jan Kara <jack@xxxxxxx> >> > >> > --- >> > >> > kernel/audit_tree.c | 4 ++-- >> > >> > 1 file changed, 2 insertions(+), 2 deletions(-) >> > >> >> > >> Should audit_tree.c:insert_hash() also be updated in a similar manner? >> > > >> > > Do you mean the part which has become chunk_to_key()? ... >> > >> > No, I was talking about the if conditional near the top of the >> > function that checks to see if the fsnotify_mark's inode is non-NULL; >> > it seems like you would also want to convert that to a >> > FSNOTIFY_MARK_FLAG_ATTACHED, yes? >> >> Ah, that one. Yes, that can certainly become a FSNOTIFY_MARK_FLAG_ATTACHED >> check although I cannot currently come up with a situation where it would >> matter. But it looks safer that way so I'll change that check as you >> suggest. > > Attached is the resulting patch. <grumpy old maintainer voice> Please post patches inline, it is so much easier for me to review that way. </grumpy old maintainer voice> Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> -- paul moore www.paul-moore.com
