Hi Tim,
One more thing.  Pay attention to your usage of
list_for_each_entry_safe.  I believe you want to use it every time you
iterate over an audit_file->watchlist.  You use list_for_each_entry for
one of those in audit_fetch_watch, but then use _safe while walking over
context->watched during audit_free_files, when I don't think you need
to.
-- 
Serge Hallyn <serue(a)us.ibm.com>