[PATCH] audit: use time_after to compare time