In audit_find_rule(), there is an if statement on line 894 to check whether entry->rule.watch is NULL: else if (entry->rule.watch) If entry->rule.watch is NULL, audit_compare_rule on 910 is called: audit_compare_rule(&entry->rule, &e->rule)) In audit_compare_rule(), a->watch is used on line 720: if (strcmp(audit_watch_path(a->watch), ...) In this case, a->watch is NULL, and audit_watch_path() will use: watch->path Thus, a possible null-pointer dereference may occur in this case. To fix this possible bug, an if statement is added in audit_compare_rule() to check a->watch before using a->watch. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990(a)gmail.com&gt; --- kernel/auditfilter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index b0126e9c0743..b0ad17b14609 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -717,6 +717,8 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b) return 1; break; case AUDIT_WATCH: + if (!a->watch) + break; if (strcmp(audit_watch_path(a->watch), audit_watch_path(b->watch))) return 1; -- 2.17.0