Let audit_free_rule() take care of calling audit_remove_mark().
Signed-off-by: Richard Guy Briggs <[email protected]>
---
kernel/auditfilter.c | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index e9d0b2f..ff99749 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -79,6 +79,8 @@ static inline void audit_free_rule(struct audit_entry *e)
/* some rules don't have associated watches */
if (erule->watch)
audit_put_watch(erule->watch);
+ if (erule->exe)
+ audit_remove_mark(erule->exe);
if (erule->fields)
for (i = 0; i < erule->field_count; i++) {
struct audit_field *f = &erule->fields[i];
@@ -1011,9 +1013,6 @@ int audit_del_rule(struct audit_entry *entry)
if (e->rule.tree)
audit_remove_tree_rule(&e->rule);
- if (e->rule.exe)
- audit_remove_mark(e->rule.exe);
-
list_del_rcu(&e->list);
list_del(&e->rule.list);
call_rcu(&e->rcu, audit_free_rule_rcu);
--
1.7.1
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
