> Audit not my favorite area of the kernel to work in either. I don't see > a good way to make it rcu-friendly, but I haven't looked too hard yet > either. It would be nice to be able to do some of the auditing under > rcu or spinlock. For audit your main option is to dodge the problem and check whether audit is active and only drop out of rcu if it is. That sidesteps the problem. I'm somewhat certain that a lot of systems don't really have audit active.