On Thu, Jun 28, 2018 at 7:40 PM, Jan Kara <jack(a)suse.cz> wrote:
 When an inode is tagged with a tree, tag_chunk() checks whether there
is
 audit_tree_group mark attached to the inode and adds one if not. However
 nothing protects another tag_chunk() to add the mark between we've
 checked and try to add the fsnotify mark thus resulting in an error from
 fsnotify_add_mark() and consequently an ENOSPC error from tag_chunk().
 Fix the problem by holding mark_mutex over the whole check-insert code
 sequence.
 Signed-off-by: Jan Kara <jack(a)suse.cz>
 --- 
Never dived into the audit_tree code, but this looks sane.
Thanks,
Amir.