<snip>

Ugh. That's not so easy to read... Slightly longer, how about this?

diff --git a/kernel/audit.c b/kernel/audit.c
index 8378c5e..3f569d1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -824,11 +824,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
break;
}
audit_log_common_recv_msg(&ab, msg_type);
- if (msg_type != AUDIT_USER_TTY)
- audit_log_format(ab,
- " msg='%.AUDIT_MESSAGE_TEXT_MAXs'",
- (char *)data);
- else {
+ if (msg_type != AUDIT_USER_TTY) {
+ char fmt[64];
+ strcat(fmt, " msg='%.");
+ strcat(fmt, "AUDIT_MESSAGE_TEXT_MAX");
+ strcat(fmt, "s'");
+ audit_log_format(ab, fmt, (char *)data);
+ } else {
int size;

audit_log_format(ab, " data=");

I am ok with this. In fact I was going to do this the first time, but I thought their would be some explicit reason to avoid the additional

run time overhead as the concat could be made at compile time.

<snip>