[PATCH] audit: session ID should not set arch quick field pointer

A bug was introduced in 8fae47705685fcaa75a1fe4c8c3e18300a702979 ("audit: add support for session ID user filter") See: https://github.com/linux-audit/audit-kernel/issues/4 When setting a session ID filter, the session ID filter field overwrote the quick pointer reference to the arch field,

[RFC PATCH 2/3] fixup! audit: remove arch_f pointer from struct audit_krule

Signed-off-by: Richard Guy Briggs --- kernel/auditfilter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 3343d1c..48dcb59 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -221,11 +221,13 @@

[RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

The arch_f pointer was added to the struct audit_krule in commit: e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients") This is only used on addition and deletion of rules which isn't time critical and the arch field is likely to be one of the first fields, easily found iterating

[RFC PATCH 3/3] debug! audit: remove arch_f pointer from struct audit_krule

Signed-off-by: Richard Guy Briggs --- kernel/auditfilter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 48dcb59..3938ad2c 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -228,6 +228,8 @@ static int