On Tuesday, July 14, 2015 11:40:41 AM Richard Guy Briggs wrote: > The audit watch count was imbalanced, adding an unnecessary layer of watch > references. Only add the second reference when it is added to a parent. > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > --- > kernel/audit_watch.c | 5 ++--- > kernel/auditfilter.c | 9 --------- > 2 files changed, 2 insertions(+), 12 deletions(-)
Nice catch, we never needed that extra refcnt bump in audit_to_watch(). One minor comment below... > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > index 72e1660..74cc077 100644 > --- a/kernel/auditfilter.c > +++ b/kernel/auditfilter.c > @@ -549,8 +549,6 @@ exit_nofree: > return entry; > > exit_free: > - if (entry->rule.watch) > - audit_put_watch(entry->rule.watch); /* matches initial get */ > if (entry->rule.tree) > audit_put_tree(entry->rule.tree); /* that's the temporary one */ > audit_free_rule(entry); > @@ -933,11 +931,7 @@ static inline int audit_add_rule(struct audit_entry > *entry) #endif > mutex_unlock(&audit_filter_mutex); > > - return 0; > - > error: > - if (watch) > - audit_put_watch(watch); /* tmp watch, matches initial get */ > return err; > } Since the error label is now just a "return err;", how about removing the label entirely and replacing the gotos with returns? -- paul moore security @ redhat -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
