fix more leaks in audit_tree.c tag_chunk()
[linux-2.6.git] / kernel / audit_tree.c
1 #include "audit.h"
2 #include <linux/inotify.h>
3 #include <linux/namei.h>
4 #include <linux/mount.h>
5 #include <linux/kthread.h>
6
7 struct audit_tree;
8 struct audit_chunk;
9
10 struct audit_tree {
11         atomic_t count;
12         int goner;
13         struct audit_chunk *root;
14         struct list_head chunks;
15         struct list_head rules;
16         struct list_head list;
17         struct list_head same_root;
18         struct rcu_head head;
19         char pathname[];
20 };
21
22 struct audit_chunk {
23         struct list_head hash;
24         struct inotify_watch watch;
25         struct list_head trees;         /* with root here */
26         int dead;
27         int count;
28         atomic_long_t refs;
29         struct rcu_head head;
30         struct node {
31                 struct list_head list;
32                 struct audit_tree *owner;
33                 unsigned index;         /* index; upper bit indicates 'will prune' */
34         } owners[];
35 };
36
37 static LIST_HEAD(tree_list);
38 static LIST_HEAD(prune_list);
39
40 /*
41  * One struct chunk is attached to each inode of interest.
42  * We replace struct chunk on tagging/untagging.
43  * Rules have pointer to struct audit_tree.
44  * Rules have struct list_head rlist forming a list of rules over
45  * the same tree.
46  * References to struct chunk are collected at audit_inode{,_child}()
47  * time and used in AUDIT_TREE rule matching.
48  * These references are dropped at the same time we are calling
49  * audit_free_names(), etc.
50  *
51  * Cyclic lists galore:
52  * tree.chunks anchors chunk.owners[].list                      hash_lock
53  * tree.rules anchors rule.rlist                                audit_filter_mutex
54  * chunk.trees anchors tree.same_root                           hash_lock
55  * chunk.hash is a hash with middle bits of watch.inode as
56  * a hash function.                                             RCU, hash_lock
57  *
58  * tree is refcounted; one reference for "some rules on rules_list refer to
59  * it", one for each chunk with pointer to it.
60  *
61  * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount
62  * of watch contributes 1 to .refs).
63  *
64  * node.index allows to get from node.list to containing chunk.
65  * MSB of that sucker is stolen to mark taggings that we might have to
66  * revert - several operations have very unpleasant cleanup logics and
67  * that makes a difference.  Some.
68  */
69
70 static struct inotify_handle *rtree_ih;
71
72 static struct audit_tree *alloc_tree(const char *s)
73 {
74         struct audit_tree *tree;
75
76         tree = kmalloc(sizeof(struct audit_tree) + strlen(s) + 1, GFP_KERNEL);
77         if (tree) {
78                 atomic_set(&tree->count, 1);
79                 tree->goner = 0;
80                 INIT_LIST_HEAD(&tree->chunks);
81                 INIT_LIST_HEAD(&tree->rules);
82                 INIT_LIST_HEAD(&tree->list);
83                 INIT_LIST_HEAD(&tree->same_root);
84                 tree->root = NULL;
85                 strcpy(tree->pathname, s);
86         }
87         return tree;
88 }
89
90 static inline void get_tree(struct audit_tree *tree)
91 {
92         atomic_inc(&tree->count);
93 }
94
95 static void __put_tree(struct rcu_head *rcu)
96 {
97         struct audit_tree *tree = container_of(rcu, struct audit_tree, head);
98         kfree(tree);
99 }
100
101 static inline void put_tree(struct audit_tree *tree)
102 {
103         if (atomic_dec_and_test(&tree->count))
104                 call_rcu(&tree->head, __put_tree);
105 }
106
107 /* to avoid bringing the entire thing in audit.h */
108 const char *audit_tree_path(struct audit_tree *tree)
109 {
110         return tree->pathname;
111 }
112
113 static struct audit_chunk *alloc_chunk(int count)
114 {
115         struct audit_chunk *chunk;
116         size_t size;
117         int i;
118
119         size = offsetof(struct audit_chunk, owners) + count * sizeof(struct node);
120         chunk = kzalloc(size, GFP_KERNEL);
121         if (!chunk)
122                 return NULL;
123
124         INIT_LIST_HEAD(&chunk->hash);
125         INIT_LIST_HEAD(&chunk->trees);
126         chunk->count = count;
127         atomic_long_set(&chunk->refs, 1);
128         for (i = 0; i < count; i++) {
129                 INIT_LIST_HEAD(&chunk->owners[i].list);
130                 chunk->owners[i].index = i;
131         }
132         inotify_init_watch(&chunk->watch);
133         return chunk;
134 }
135
136 static void free_chunk(struct audit_chunk *chunk)
137 {
138         int i;
139
140         for (i = 0; i < chunk->count; i++) {
141                 if (chunk->owners[i].owner)
142                         put_tree(chunk->owners[i].owner);
143         }
144         kfree(chunk);
145 }
146
147 void audit_put_chunk(struct audit_chunk *chunk)
148 {
149         if (atomic_long_dec_and_test(&chunk->refs))
150                 free_chunk(chunk);
151 }
152
153 static void __put_chunk(struct rcu_head *rcu)
154 {
155         struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
156         audit_put_chunk(chunk);
157 }
158
159 enum {HASH_SIZE = 128};
160 static struct list_head chunk_hash_heads[HASH_SIZE];
161 static __cacheline_aligned_in_smp DEFINE_SPINLOCK(hash_lock);
162
163 static inline struct list_head *chunk_hash(const struct inode *inode)
164 {
165         unsigned long n = (unsigned long)inode / L1_CACHE_BYTES;
166         return chunk_hash_heads + n % HASH_SIZE;
167 }
168
169 /* hash_lock is held by caller */
170 static void insert_hash(struct audit_chunk *chunk)
171 {
172         struct list_head *list = chunk_hash(chunk->watch.inode);
173         list_add_rcu(&chunk->hash, list);
174 }
175
176 /* called under rcu_read_lock */
177 struct audit_chunk *audit_tree_lookup(const struct inode *inode)
178 {
179         struct list_head *list = chunk_hash(inode);
180         struct audit_chunk *p;
181
182         list_for_each_entry_rcu(p, list, hash) {
183                 if (p->watch.inode == inode) {
184                         atomic_long_inc(&p->refs);
185                         return p;
186                 }
187         }
188         return NULL;
189 }
190
191 int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
192 {
193         int n;
194         for (n = 0; n < chunk->count; n++)
195                 if (chunk->owners[n].owner == tree)
196                         return 1;
197         return 0;
198 }
199
200 /* tagging and untagging inodes with trees */
201
202 static struct audit_chunk *find_chunk(struct node *p)
203 {
204         int index = p->index & ~(1U<<31);
205         p -= index;
206         return container_of(p, struct audit_chunk, owners[0]);
207 }
208
209 static void untag_chunk(struct node *p)
210 {
211         struct audit_chunk *chunk = find_chunk(p);
212         struct audit_chunk *new;
213         struct audit_tree *owner;
214         int size = chunk->count - 1;
215         int i, j;
216
217         if (!pin_inotify_watch(&chunk->watch)) {
218                 /*
219                  * Filesystem is shutting down; all watches are getting
220                  * evicted, just take it off the node list for this
221                  * tree and let the eviction logics take care of the
222                  * rest.
223                  */
224                 owner = p->owner;
225                 if (owner->root == chunk) {
226                         list_del_init(&owner->same_root);
227                         owner->root = NULL;
228                 }
229                 list_del_init(&p->list);
230                 p->owner = NULL;
231                 put_tree(owner);
232                 return;
233         }
234
235         spin_unlock(&hash_lock);
236
237         /*
238          * pin_inotify_watch() succeeded, so the watch won't go away
239          * from under us.
240          */
241         mutex_lock(&chunk->watch.inode->inotify_mutex);
242         if (chunk->dead) {
243                 mutex_unlock(&chunk->watch.inode->inotify_mutex);
244                 goto out;
245         }
246
247         owner = p->owner;
248
249         if (!size) {
250                 chunk->dead = 1;
251                 spin_lock(&hash_lock);
252                 list_del_init(&chunk->trees);
253                 if (owner->root == chunk)
254                         owner->root = NULL;
255                 list_del_init(&p->list);
256                 list_del_rcu(&chunk->hash);
257                 spin_unlock(&hash_lock);
258                 inotify_evict_watch(&chunk->watch);
259                 mutex_unlock(&chunk->watch.inode->inotify_mutex);
260                 put_inotify_watch(&chunk->watch);
261                 goto out;
262         }
263
264         new = alloc_chunk(size);
265         if (!new)
266                 goto Fallback;
267         if (inotify_clone_watch(&chunk->watch, &new->watch) < 0) {
268                 free_chunk(new);
269                 goto Fallback;
270         }
271
272         chunk->dead = 1;
273         spin_lock(&hash_lock);
274         list_replace_init(&chunk->trees, &new->trees);
275         if (owner->root == chunk) {
276                 list_del_init(&owner->same_root);
277                 owner->root = NULL;
278         }
279
280         for (i = j = 0; j <= size; i++, j++) {
281                 struct audit_tree *s;
282                 if (&chunk->owners[j] == p) {
283                         list_del_init(&p->list);
284                         i--;
285                         continue;
286                 }
287                 s = chunk->owners[j].owner;
288                 new->owners[i].owner = s;
289                 new->owners[i].index = chunk->owners[j].index - j + i;
290                 if (!s) /* result of earlier fallback */
291                         continue;
292                 get_tree(s);
293                 list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
294         }
295
296         list_replace_rcu(&chunk->hash, &new->hash);
297         list_for_each_entry(owner, &new->trees, same_root)
298                 owner->root = new;
299         spin_unlock(&hash_lock);
300         inotify_evict_watch(&chunk->watch);
301         mutex_unlock(&chunk->watch.inode->inotify_mutex);
302         put_inotify_watch(&chunk->watch);
303         goto out;
304
305 Fallback:
306         // do the best we can
307         spin_lock(&hash_lock);
308         if (owner->root == chunk) {
309                 list_del_init(&owner->same_root);
310                 owner->root = NULL;
311         }
312         list_del_init(&p->list);
313         p->owner = NULL;
314         put_tree(owner);
315         spin_unlock(&hash_lock);
316         mutex_unlock(&chunk->watch.inode->inotify_mutex);
317 out:
318         unpin_inotify_watch(&chunk->watch);
319         spin_lock(&hash_lock);
320 }
321
322 static int create_chunk(struct inode *inode, struct audit_tree *tree)
323 {
324         struct audit_chunk *chunk = alloc_chunk(1);
325         if (!chunk)
326                 return -ENOMEM;
327
328         if (inotify_add_watch(rtree_ih, &chunk->watch, inode, IN_IGNORED | IN_DELETE_SELF) < 0) {
329                 free_chunk(chunk);
330                 return -ENOSPC;
331         }
332
333         mutex_lock(&inode->inotify_mutex);
334         spin_lock(&hash_lock);
335         if (tree->goner) {
336                 spin_unlock(&hash_lock);
337                 chunk->dead = 1;
338                 inotify_evict_watch(&chunk->watch);
339                 mutex_unlock(&inode->inotify_mutex);
340                 put_inotify_watch(&chunk->watch);
341                 return 0;
342         }
343         chunk->owners[0].index = (1U << 31);
344         chunk->owners[0].owner = tree;
345         get_tree(tree);
346         list_add(&chunk->owners[0].list, &tree->chunks);
347         if (!tree->root) {
348                 tree->root = chunk;
349                 list_add(&tree->same_root, &chunk->trees);
350         }
351         insert_hash(chunk);
352         spin_unlock(&hash_lock);
353         mutex_unlock(&inode->inotify_mutex);
354         return 0;
355 }
356
357 /* the first tagged inode becomes root of tree */
358 static int tag_chunk(struct inode *inode, struct audit_tree *tree)
359 {
360         struct inotify_watch *watch;
361         struct audit_tree *owner;
362         struct audit_chunk *chunk, *old;
363         struct node *p;
364         int n;
365
366         if (inotify_find_watch(rtree_ih, inode, &watch) < 0)
367                 return create_chunk(inode, tree);
368
369         old = container_of(watch, struct audit_chunk, watch);
370
371         /* are we already there? */
372         spin_lock(&hash_lock);
373         for (n = 0; n < old->count; n++) {
374                 if (old->owners[n].owner == tree) {
375                         spin_unlock(&hash_lock);
376                         put_inotify_watch(&old->watch);
377                         return 0;
378                 }
379         }
380         spin_unlock(&hash_lock);
381
382         chunk = alloc_chunk(old->count + 1);
383         if (!chunk) {
384                 put_inotify_watch(&old->watch);
385                 return -ENOMEM;
386         }
387
388         mutex_lock(&inode->inotify_mutex);
389         if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
390                 mutex_unlock(&inode->inotify_mutex);
391                 put_inotify_watch(&old->watch);
392                 free_chunk(chunk);
393                 return -ENOSPC;
394         }
395         spin_lock(&hash_lock);
396         if (tree->goner) {
397                 spin_unlock(&hash_lock);
398                 chunk->dead = 1;
399                 inotify_evict_watch(&chunk->watch);
400                 mutex_unlock(&inode->inotify_mutex);
401                 put_inotify_watch(&old->watch);
402                 put_inotify_watch(&chunk->watch);
403                 return 0;
404         }
405         list_replace_init(&old->trees, &chunk->trees);
406         for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
407                 struct audit_tree *s = old->owners[n].owner;
408                 p->owner = s;
409                 p->index = old->owners[n].index;
410                 if (!s) /* result of fallback in untag */
411                         continue;
412                 get_tree(s);
413                 list_replace_init(&old->owners[n].list, &p->list);
414         }
415         p->index = (chunk->count - 1) | (1U<<31);
416         p->owner = tree;
417         get_tree(tree);
418         list_add(&p->list, &tree->chunks);
419         list_replace_rcu(&old->hash, &chunk->hash);
420         list_for_each_entry(owner, &chunk->trees, same_root)
421                 owner->root = chunk;
422         old->dead = 1;
423         if (!tree->root) {
424                 tree->root = chunk;
425                 list_add(&tree->same_root, &chunk->trees);
426         }
427         spin_unlock(&hash_lock);
428         inotify_evict_watch(&old->watch);
429         mutex_unlock(&inode->inotify_mutex);
430         put_inotify_watch(&old->watch); /* pair to inotify_find_watch */
431         put_inotify_watch(&old->watch); /* and kill it */
432         return 0;
433 }
434
435 static void kill_rules(struct audit_tree *tree)
436 {
437         struct audit_krule *rule, *next;
438         struct audit_entry *entry;
439         struct audit_buffer *ab;
440
441         list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
442                 entry = container_of(rule, struct audit_entry, rule);
443
444                 list_del_init(&rule->rlist);
445                 if (rule->tree) {
446                         /* not a half-baked one */
447                         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
448                         audit_log_format(ab, "op=");
449                         audit_log_string(ab, "remove rule");
450                         audit_log_format(ab, " dir=");
451                         audit_log_untrustedstring(ab, rule->tree->pathname);
452                         audit_log_key(ab, rule->filterkey);
453                         audit_log_format(ab, " list=%d res=1", rule->listnr);
454                         audit_log_end(ab);
455                         rule->tree = NULL;
456                         list_del_rcu(&entry->list);
457                         list_del(&entry->rule.list);
458                         call_rcu(&entry->rcu, audit_free_rule_rcu);
459                 }
460         }
461 }
462
463 /*
464  * finish killing struct audit_tree
465  */
466 static void prune_one(struct audit_tree *victim)
467 {
468         spin_lock(&hash_lock);
469         while (!list_empty(&victim->chunks)) {
470                 struct node *p;
471
472                 p = list_entry(victim->chunks.next, struct node, list);
473
474                 untag_chunk(p);
475         }
476         spin_unlock(&hash_lock);
477         put_tree(victim);
478 }
479
480 /* trim the uncommitted chunks from tree */
481
482 static void trim_marked(struct audit_tree *tree)
483 {
484         struct list_head *p, *q;
485         spin_lock(&hash_lock);
486         if (tree->goner) {
487                 spin_unlock(&hash_lock);
488                 return;
489         }
490         /* reorder */
491         for (p = tree->chunks.next; p != &tree->chunks; p = q) {
492                 struct node *node = list_entry(p, struct node, list);
493                 q = p->next;
494                 if (node->index & (1U<<31)) {
495                         list_del_init(p);
496                         list_add(p, &tree->chunks);
497                 }
498         }
499
500         while (!list_empty(&tree->chunks)) {
501                 struct node *node;
502
503                 node = list_entry(tree->chunks.next, struct node, list);
504
505                 /* have we run out of marked? */
506                 if (!(node->index & (1U<<31)))
507                         break;
508
509                 untag_chunk(node);
510         }
511         if (!tree->root && !tree->goner) {
512                 tree->goner = 1;
513                 spin_unlock(&hash_lock);
514                 mutex_lock(&audit_filter_mutex);
515                 kill_rules(tree);
516                 list_del_init(&tree->list);
517                 mutex_unlock(&audit_filter_mutex);
518                 prune_one(tree);
519         } else {
520                 spin_unlock(&hash_lock);
521         }
522 }
523
524 static void audit_schedule_prune(void);
525
526 /* called with audit_filter_mutex */
527 int audit_remove_tree_rule(struct audit_krule *rule)
528 {
529         struct audit_tree *tree;
530         tree = rule->tree;
531         if (tree) {
532                 spin_lock(&hash_lock);
533                 list_del_init(&rule->rlist);
534                 if (list_empty(&tree->rules) && !tree->goner) {
535                         tree->root = NULL;
536                         list_del_init(&tree->same_root);
537                         tree->goner = 1;
538                         list_move(&tree->list, &prune_list);
539                         rule->tree = NULL;
540                         spin_unlock(&hash_lock);
541                         audit_schedule_prune();
542                         return 1;
543                 }
544                 rule->tree = NULL;
545                 spin_unlock(&hash_lock);
546                 return 1;
547         }
548         return 0;
549 }
550
551 void audit_trim_trees(void)
552 {
553         struct list_head cursor;
554
555         mutex_lock(&audit_filter_mutex);
556         list_add(&cursor, &tree_list);
557         while (cursor.next != &tree_list) {
558                 struct audit_tree *tree;
559                 struct path path;
560                 struct vfsmount *root_mnt;
561                 struct node *node;
562                 struct list_head list;
563                 int err;
564
565                 tree = container_of(cursor.next, struct audit_tree, list);
566                 get_tree(tree);
567                 list_del(&cursor);
568                 list_add(&cursor, &tree->list);
569                 mutex_unlock(&audit_filter_mutex);
570
571                 err = kern_path(tree->pathname, 0, &path);
572                 if (err)
573                         goto skip_it;
574
575                 root_mnt = collect_mounts(&path);
576                 path_put(&path);
577                 if (!root_mnt)
578                         goto skip_it;
579
580                 list_add_tail(&list, &root_mnt->mnt_list);
581                 spin_lock(&hash_lock);
582                 list_for_each_entry(node, &tree->chunks, list) {
583                         struct audit_chunk *chunk = find_chunk(node);
584                         struct inode *inode = chunk->watch.inode;
585                         struct vfsmount *mnt;
586                         node->index |= 1U<<31;
587                         list_for_each_entry(mnt, &list, mnt_list) {
588                                 if (mnt->mnt_root->d_inode == inode) {
589                                         node->index &= ~(1U<<31);
590                                         break;
591                                 }
592                         }
593                 }
594                 spin_unlock(&hash_lock);
595                 trim_marked(tree);
596                 put_tree(tree);
597                 list_del_init(&list);
598                 drop_collected_mounts(root_mnt);
599 skip_it:
600                 mutex_lock(&audit_filter_mutex);
601         }
602         list_del(&cursor);
603         mutex_unlock(&audit_filter_mutex);
604 }
605
606 static int is_under(struct vfsmount *mnt, struct dentry *dentry,
607                     struct path *path)
608 {
609         if (mnt != path->mnt) {
610                 for (;;) {
611                         if (mnt->mnt_parent == mnt)
612                                 return 0;
613                         if (mnt->mnt_parent == path->mnt)
614                                         break;
615                         mnt = mnt->mnt_parent;
616                 }
617                 dentry = mnt->mnt_mountpoint;
618         }
619         return is_subdir(dentry, path->dentry);
620 }
621
622 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
623 {
624
625         if (pathname[0] != '/' ||
626             rule->listnr != AUDIT_FILTER_EXIT ||
627             op != Audit_equal ||
628             rule->inode_f || rule->watch || rule->tree)
629                 return -EINVAL;
630         rule->tree = alloc_tree(pathname);
631         if (!rule->tree)
632                 return -ENOMEM;
633         return 0;
634 }
635
636 void audit_put_tree(struct audit_tree *tree)
637 {
638         put_tree(tree);
639 }
640
641 /* called with audit_filter_mutex */
642 int audit_add_tree_rule(struct audit_krule *rule)
643 {
644         struct audit_tree *seed = rule->tree, *tree;
645         struct path path;
646         struct vfsmount *mnt, *p;
647         struct list_head list;
648         int err;
649
650         list_for_each_entry(tree, &tree_list, list) {
651                 if (!strcmp(seed->pathname, tree->pathname)) {
652                         put_tree(seed);
653                         rule->tree = tree;
654                         list_add(&rule->rlist, &tree->rules);
655                         return 0;
656                 }
657         }
658         tree = seed;
659         list_add(&tree->list, &tree_list);
660         list_add(&rule->rlist, &tree->rules);
661         /* do not set rule->tree yet */
662         mutex_unlock(&audit_filter_mutex);
663
664         err = kern_path(tree->pathname, 0, &path);
665         if (err)
666                 goto Err;
667         mnt = collect_mounts(&path);
668         path_put(&path);
669         if (!mnt) {
670                 err = -ENOMEM;
671                 goto Err;
672         }
673         list_add_tail(&list, &mnt->mnt_list);
674
675         get_tree(tree);
676         list_for_each_entry(p, &list, mnt_list) {
677                 err = tag_chunk(p->mnt_root->d_inode, tree);
678                 if (err)
679                         break;
680         }
681
682         list_del(&list);
683         drop_collected_mounts(mnt);
684
685         if (!err) {
686                 struct node *node;
687                 spin_lock(&hash_lock);
688                 list_for_each_entry(node, &tree->chunks, list)
689                         node->index &= ~(1U<<31);
690                 spin_unlock(&hash_lock);
691         } else {
692                 trim_marked(tree);
693                 goto Err;
694         }
695
696         mutex_lock(&audit_filter_mutex);
697         if (list_empty(&rule->rlist)) {
698                 put_tree(tree);
699                 return -ENOENT;
700         }
701         rule->tree = tree;
702         put_tree(tree);
703
704         return 0;
705 Err:
706         mutex_lock(&audit_filter_mutex);
707         list_del_init(&tree->list);
708         list_del_init(&tree->rules);
709         put_tree(tree);
710         return err;
711 }
712
713 int audit_tag_tree(char *old, char *new)
714 {
715         struct list_head cursor, barrier;
716         int failed = 0;
717         struct path path;
718         struct vfsmount *tagged;
719         struct list_head list;
720         struct vfsmount *mnt;
721         struct dentry *dentry;
722         int err;
723
724         err = kern_path(new, 0, &path);
725         if (err)
726                 return err;
727         tagged = collect_mounts(&path);
728         path_put(&path);
729         if (!tagged)
730                 return -ENOMEM;
731
732         err = kern_path(old, 0, &path);
733         if (err) {
734                 drop_collected_mounts(tagged);
735                 return err;
736         }
737         mnt = mntget(path.mnt);
738         dentry = dget(path.dentry);
739         path_put(&path);
740
741         list_add_tail(&list, &tagged->mnt_list);
742
743         mutex_lock(&audit_filter_mutex);
744         list_add(&barrier, &tree_list);
745         list_add(&cursor, &barrier);
746
747         while (cursor.next != &tree_list) {
748                 struct audit_tree *tree;
749                 struct vfsmount *p;
750
751                 tree = container_of(cursor.next, struct audit_tree, list);
752                 get_tree(tree);
753                 list_del(&cursor);
754                 list_add(&cursor, &tree->list);
755                 mutex_unlock(&audit_filter_mutex);
756
757                 err = kern_path(tree->pathname, 0, &path);
758                 if (err) {
759                         put_tree(tree);
760                         mutex_lock(&audit_filter_mutex);
761                         continue;
762                 }
763
764                 spin_lock(&vfsmount_lock);
765                 if (!is_under(mnt, dentry, &path)) {
766                         spin_unlock(&vfsmount_lock);
767                         path_put(&path);
768                         put_tree(tree);
769                         mutex_lock(&audit_filter_mutex);
770                         continue;
771                 }
772                 spin_unlock(&vfsmount_lock);
773                 path_put(&path);
774
775                 list_for_each_entry(p, &list, mnt_list) {
776                         failed = tag_chunk(p->mnt_root->d_inode, tree);
777                         if (failed)
778                                 break;
779                 }
780
781                 if (failed) {
782                         put_tree(tree);
783                         mutex_lock(&audit_filter_mutex);
784                         break;
785                 }
786
787                 mutex_lock(&audit_filter_mutex);
788                 spin_lock(&hash_lock);
789                 if (!tree->goner) {
790                         list_del(&tree->list);
791                         list_add(&tree->list, &tree_list);
792                 }
793                 spin_unlock(&hash_lock);
794                 put_tree(tree);
795         }
796
797         while (barrier.prev != &tree_list) {
798                 struct audit_tree *tree;
799
800                 tree = container_of(barrier.prev, struct audit_tree, list);
801                 get_tree(tree);
802                 list_del(&tree->list);
803                 list_add(&tree->list, &barrier);
804                 mutex_unlock(&audit_filter_mutex);
805
806                 if (!failed) {
807                         struct node *node;
808                         spin_lock(&hash_lock);
809                         list_for_each_entry(node, &tree->chunks, list)
810                                 node->index &= ~(1U<<31);
811                         spin_unlock(&hash_lock);
812                 } else {
813                         trim_marked(tree);
814                 }
815
816                 put_tree(tree);
817                 mutex_lock(&audit_filter_mutex);
818         }
819         list_del(&barrier);
820         list_del(&cursor);
821         list_del(&list);
822         mutex_unlock(&audit_filter_mutex);
823         dput(dentry);
824         mntput(mnt);
825         drop_collected_mounts(tagged);
826         return failed;
827 }
828
829 /*
830  * That gets run when evict_chunk() ends up needing to kill audit_tree.
831  * Runs from a separate thread.
832  */
833 static int prune_tree_thread(void *unused)
834 {
835         mutex_lock(&audit_cmd_mutex);
836         mutex_lock(&audit_filter_mutex);
837
838         while (!list_empty(&prune_list)) {
839                 struct audit_tree *victim;
840
841                 victim = list_entry(prune_list.next, struct audit_tree, list);
842                 list_del_init(&victim->list);
843
844                 mutex_unlock(&audit_filter_mutex);
845
846                 prune_one(victim);
847
848                 mutex_lock(&audit_filter_mutex);
849         }
850
851         mutex_unlock(&audit_filter_mutex);
852         mutex_unlock(&audit_cmd_mutex);
853         return 0;
854 }
855
856 static void audit_schedule_prune(void)
857 {
858         kthread_run(prune_tree_thread, NULL, "audit_prune_tree");
859 }
860
861 /*
862  * ... and that one is done if evict_chunk() decides to delay until the end
863  * of syscall.  Runs synchronously.
864  */
865 void audit_kill_trees(struct list_head *list)
866 {
867         mutex_lock(&audit_cmd_mutex);
868         mutex_lock(&audit_filter_mutex);
869
870         while (!list_empty(list)) {
871                 struct audit_tree *victim;
872
873                 victim = list_entry(list->next, struct audit_tree, list);
874                 kill_rules(victim);
875                 list_del_init(&victim->list);
876
877                 mutex_unlock(&audit_filter_mutex);
878
879                 prune_one(victim);
880
881                 mutex_lock(&audit_filter_mutex);
882         }
883
884         mutex_unlock(&audit_filter_mutex);
885         mutex_unlock(&audit_cmd_mutex);
886 }
887
888 /*
889  *  Here comes the stuff asynchronous to auditctl operations
890  */
891
892 /* inode->inotify_mutex is locked */
893 static void evict_chunk(struct audit_chunk *chunk)
894 {
895         struct audit_tree *owner;
896         struct list_head *postponed = audit_killed_trees();
897         int need_prune = 0;
898         int n;
899
900         if (chunk->dead)
901                 return;
902
903         chunk->dead = 1;
904         mutex_lock(&audit_filter_mutex);
905         spin_lock(&hash_lock);
906         while (!list_empty(&chunk->trees)) {
907                 owner = list_entry(chunk->trees.next,
908                                    struct audit_tree, same_root);
909                 owner->goner = 1;
910                 owner->root = NULL;
911                 list_del_init(&owner->same_root);
912                 spin_unlock(&hash_lock);
913                 if (!postponed) {
914                         kill_rules(owner);
915                         list_move(&owner->list, &prune_list);
916                         need_prune = 1;
917                 } else {
918                         list_move(&owner->list, postponed);
919                 }
920                 spin_lock(&hash_lock);
921         }
922         list_del_rcu(&chunk->hash);
923         for (n = 0; n < chunk->count; n++)
924                 list_del_init(&chunk->owners[n].list);
925         spin_unlock(&hash_lock);
926         if (need_prune)
927                 audit_schedule_prune();
928         mutex_unlock(&audit_filter_mutex);
929 }
930
931 static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask,
932                          u32 cookie, const char *dname, struct inode *inode)
933 {
934         struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
935
936         if (mask & IN_IGNORED) {
937                 evict_chunk(chunk);
938                 put_inotify_watch(watch);
939         }
940 }
941
942 static void destroy_watch(struct inotify_watch *watch)
943 {
944         struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
945         call_rcu(&chunk->head, __put_chunk);
946 }
947
948 static const struct inotify_operations rtree_inotify_ops = {
949         .handle_event   = handle_event,
950         .destroy_watch  = destroy_watch,
951 };
952
953 static int __init audit_tree_init(void)
954 {
955         int i;
956
957         rtree_ih = inotify_init(&rtree_inotify_ops);
958         if (IS_ERR(rtree_ih))
959                 audit_panic("cannot initialize inotify handle for rectree watches");
960
961         for (i = 0; i < HASH_SIZE; i++)
962                 INIT_LIST_HEAD(&chunk_hash_heads[i]);
963
964         return 0;
965 }
966 __initcall(audit_tree_init);