On Wed, Jul 11, 2018 at 11:57 AM, Amir Goldstein <amir73il@xxxxxxxxx> wrote: > On Tue, Jul 10, 2018 at 1:02 PM, Jan Kara <jack@xxxxxxx> wrote: >> Allocate fsnotify mark independently instead of embedding it inside >> chunk. This will allow us to just replace chunk attached to mark when >> growing / shrinking chunk instead of replacing mark attached to inode >> which is a more complex operation. >> >> Signed-off-by: Jan Kara <jack@xxxxxxx> > > Ack. Found minor nit. [...] >> +static inline struct audit_tree_mark *AUDIT_M(struct fsnotify_mark *entry) >> +{ >> + return container_of(entry, struct audit_tree_mark, fsn_mark); >> +} >> + >> static void audit_tree_destroy_watch(struct fsnotify_mark *entry) >> { >> - struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark); >> + struct audit_chunk *chunk = AUDIT_M(entry)->chunk; >> audit_mark_put_chunk(chunk); >> + kmem_cache_free(audit_tree_mark_cachep, entry); Technically, we should be freeing AUDIT_M(entry) although it is the same address with current struct layout. Thanks, Amir.