Hello, this is the third revision of the series that addresses problems I have identified when trying to understand how exactly is kernel/audit_tree.c using generic fsnotify framework. I hope I have understood all the interactions right but careful review is certainly welcome. The patches have been tested by a stress test I have written which mounts & unmounts filesystems in the directory tree while adding and removing audit rules for this tree in parallel and accessing the tree to generate events. Still some real-world testing would be welcome. Changes since v2: * Fixed up mark freeing to use proper pointer as pointed out by Amir * Changed some naming based on Paul's review Changes since v1: * Split the last patch to ease review * Rewrite test script so that it can be included in audit testsuite * Some cleanups and improvements suggested by Amir Honza
