Check watch pointer before dereferencing. Al, please fold in with latest filesystem auditing patch 1d9d3267853cc4368c923f1ab7037db8c8805b73. Signed-off-by: Amy Griffis <amy.griffis(a)hp.com&gt; diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 7f2fcd6..f993842 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1032,12 +1032,13 @@ static inline int audit_do_del_rule(stru list_for_each_entry(e, list, list) { struct audit_watch *watch = e->rule.watch; - struct audit_parent *parent = watch->parent; if (audit_compare_rule(&entry->rule, &e->rule)) continue; if (watch) { + struct audit_parent *parent = watch->parent; + list_del(&e->rule.rlist); if (list_empty(&watch->rules)) { -- 1.3.0