diff -Nurp linux-2.6.9/kernel/auditfs.c linux-2.6.9~new/kernel/auditfs.c
--- linux-2.6.9/kernel/auditfs.c	2005-05-24 19:15:38.582106144 -0500
+++ linux-2.6.9~new/kernel/auditfs.c	2005-05-24 19:34:55.151280904 -0500
@@ -541,28 +541,28 @@ struct audit_skb_list *audit_to_skb(stru
 {
 	size_t size;
 	void *memblk;
-       struct audit_skb_list *entry;
-      
+	struct audit_skb_list *entry;
+
 	/* We must include space for both "\0" */
 	size = sizeof(struct watch_transport) + strlen(watch->path) +
-                     strlen(watch->filterkey) + 2;
-                                                                                                                                                                    
-       entry = ERR_PTR(-ENOMEM);
+	       strlen(watch->filterkey) + 2;
+
+	entry = ERR_PTR(-ENOMEM);
 	memblk = audit_to_transport(watch, size);
 	if (!memblk)
-               goto audit_queue_watch_exit;
+		goto audit_queue_watch_exit;
+
+	entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
+	if (!entry) {
+		entry = ERR_PTR(-ENOMEM);
+		goto audit_queue_watch_exit;
+	}
 
-       entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
-       if (!entry) {
-               entry = ERR_PTR(-ENOMEM);
-               goto audit_queue_watch_exit;
-       }
-       
-       entry->memblk = memblk;
-       entry->size = size;
+	entry->memblk = memblk;
+	entry->size = size;
 
 audit_queue_watch_exit:
-       return entry;
+	return entry;
 }
 
 /*
@@ -579,39 +579,40 @@ audit_queue_watch_exit:
 int audit_list_watches(int pid, int seq)
 {
 	int ret = 0;
-       struct hlist_head skb_list;
-       struct hlist_node *tmp, *pos;
-       struct audit_skb_list *entry;
+	struct hlist_head skb_list;
+	struct hlist_node *tmp, *pos;
+	struct audit_skb_list *entry;
 	struct audit_wentry *wentry;
 
-       INIT_HLIST_HEAD(&skb_list);
+	INIT_HLIST_HEAD(&skb_list);
 
 	rcu_read_lock();
-       hlist_for_each_entry_rcu(wentry, pos, &master_watchlist, w_master) {
-               entry = audit_to_skb(wentry->w_watch);
-               if (IS_ERR(entry)) {
-                       ret = PTR_ERR(entry);
-                       goto audit_list_watches_fail;
-               }
-               hlist_add_head(&entry->list, &skb_list);
+	hlist_for_each_entry_rcu(wentry, pos, &master_watchlist, w_master) {
+		entry = audit_to_skb(wentry->w_watch);
+		if (IS_ERR(entry)) {
+			ret = PTR_ERR(entry);
+			rcu_read_unlock();
+			goto audit_list_watches_fail;
+		}
+		hlist_add_head(&entry->list, &skb_list);
 	}
 	rcu_read_unlock();
 
-       hlist_for_each_entry_safe(entry, pos, tmp, &skb_list, list) {
-               audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 0, 1, 
-                                entry->memblk, entry->size);
-               kfree(entry->memblk);
-               kfree(entry);
-       }
-
-       audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 1, 1, NULL, 0);
-       goto audit_list_watches_exit;
-       
+	hlist_for_each_entry_safe(entry, pos, tmp, &skb_list, list) {
+		audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 0, 1, 
+				 entry->memblk, entry->size);
+		kfree(entry->memblk);
+		kfree(entry);
+	}
+
+	audit_send_reply(pid, seq, AUDIT_WATCH_LIST, 1, 1, NULL, 0);
+	goto audit_list_watches_exit;
+
 audit_list_watches_fail:
-       hlist_for_each_entry_safe(entry, pos, tmp, &skb_list, list) {
-               kfree(entry->memblk);
-               kfree(entry);
-       }
+	hlist_for_each_entry_safe(entry, pos, tmp, &skb_list, list) {
+		kfree(entry->memblk);
+		kfree(entry);
+	}
 audit_list_watches_exit:
 	return ret;
 }
diff -Nurp linux-2.6.9/kernel/auditsc.c linux-2.6.9~new/kernel/auditsc.c
--- linux-2.6.9/kernel/auditsc.c	2005-05-24 19:15:38.581106296 -0500
+++ linux-2.6.9~new/kernel/auditsc.c	2005-05-24 19:37:49.482778488 -0500
@@ -576,11 +576,18 @@ static inline void audit_free_aux(struct
 	struct audit_aux_data *aux;
 
 	while ((aux = context->aux)) {
-		if (aux->type == AUDIT_AVC_PATH) {
+		switch(aux->type) {
+		case AUDIT_AVC_PATH: {
 			struct audit_aux_data_path *axi = (void *)aux;
 			dput(axi->dentry);
 			mntput(axi->mnt);
+			break; }
+		case AUDIT_FS_WATCH: {
+			struct audit_aux_data_watched *axi = (void *)aux;
+			audit_wentry_put(axi->wentry);
+			break; }
 		}
+		
 		context->aux = aux->next;
 		kfree(aux);
 	}
@@ -1227,12 +1234,20 @@ int audit_notify_watch(struct inode *ino
 	if (likely(!audit_enabled))
 		goto audit_notify_watch_exit;
 
-	if (!inode)
+	if (!inode || !inode->i_audit)
 		goto audit_notify_watch_exit;
 
+	/* 
+	 * Won't be able to drop i_audit->wentry reference
+	 * before we obtain our own reference
+	 */
+	read_lock(&inode->i_audit->lock);
 	wentry = audit_wentry_get(inode->i_audit->wentry);
-	if (!wentry)
+	if (!wentry) {
+		read_unlock(&inode->i_audit->lock);
 		goto audit_notify_watch_exit;
+	}
+	read_unlock(&inode->i_audit->lock);
 
 	if (mask && (wentry->w_watch->perms && !(wentry->w_watch->perms&mask)))
 		goto audit_notify_watch_fail;