<snip>
 Ugh.  That's not so easy to read...  Slightly longer, how about this?
 diff --git a/kernel/audit.c b/kernel/audit.c
 index 8378c5e..3f569d1 100644
 --- a/kernel/audit.c
 +++ b/kernel/audit.c
 @@ -824,11 +824,13 @@ static int audit_receive_msg(struct sk_buff *skb,
 struct nlmsghdr *nlh)
                                         break;
                         }
                         audit_log_common_recv_msg(&ab, msg_type);
 -                       if (msg_type != AUDIT_USER_TTY)
 -                               audit_log_format(ab,
 -                                                "
 msg='%.AUDIT_MESSAGE_TEXT_MAXs'",
 -                                                (char *)data);
 -                       else {
 +                       if (msg_type != AUDIT_USER_TTY) {
 +                               char fmt[64];
 +                               strcat(fmt, " msg='%.");
 +                               strcat(fmt, "AUDIT_MESSAGE_TEXT_MAX");
 +                               strcat(fmt, "s'");
 +                               audit_log_format(ab, fmt, (char *)data);
 +                       } else {
                                 int size;
                                 audit_log_format(ab, " data=");
 
I am ok with this. In fact I was going to do this the first time, but I
thought their would be some explicit reason to avoid the additional
run time overhead as the concat could be made at compile time.
<snip>