Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

On 2018-02-15 15:42, Paul Moore wrote: > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > The arch_f pointer was added to the struct audit_krule in commit: > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients") > > > > This is only used on addition and deletion of rules which isn't time > > critical and the arch field is likely to be one of the first fields, > > easily found iterating over the field type. This isn't worth the > > additional complexity and storage. Delete the field. > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > --- > > include/linux/audit.h | 1 - > > kernel/auditfilter.c | 12 ++++++++---- > > 2 files changed, 8 insertions(+), 5 deletions(-) > > I haven't decided if I like the removal of arch_f or not, but I think > I might know where your oops/panic is coming from, thoughts below ... Have you decided yet if you like the removal of the arch_f pointer or not? An updated v2 was provided the following day: https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html