Quoting serue(a)us.ibm.com (serue(a)us.ibm.com):
Now looking at locking. I assume that you feel confident enough at
audit_data_put calls audit_drain_watchlist calls audit_destroy_watch
without auditfs_lock. audit_destroy_watch removes from
master_watchlist, should be locked.
audit.h still including rcupdate, but you don't use rcu anymore, do you?
audit_insert_watch: you claim that this is protected from racing with
itself by the netlink_receive code being synchronous,
right?
(not done...)
-serge