52 	struct audit_parent	*parent; /* associated parent */  member
69 static void audit_free_parent(struct audit_parent *parent)  in audit_free_parent()  argument
71 	WARN_ON(!list_empty(&parent->watches));  in audit_free_parent()
72 	kfree(parent);  in audit_free_parent()
77 	struct audit_parent *parent;  in audit_watch_free_mark()  local
79 	parent = container_of(entry, struct audit_parent, mark);  in audit_watch_free_mark()
80 	audit_free_parent(parent);  in audit_watch_free_mark()
83 static void audit_get_parent(struct audit_parent *parent)  in audit_get_parent()  argument
85 	if (likely(parent))  in audit_get_parent()
86 		fsnotify_get_mark(&parent->mark);  in audit_get_parent()
89 static void audit_put_parent(struct audit_parent *parent)  in audit_put_parent()  argument
91 	if (likely(parent))  in audit_put_parent()
92 		fsnotify_put_mark(&parent->mark);  in audit_put_parent()
101 	struct audit_parent *parent = NULL;  in audit_find_parent()  local
106 		parent = container_of(entry, struct audit_parent, mark);  in audit_find_parent()
108 	return parent;  in audit_find_parent()
119 		WARN_ON(watch->parent);  in audit_put_watch()
129 	audit_put_parent(watch->parent);  in audit_remove_watch()
130 	watch->parent = NULL;  in audit_remove_watch()
150 	struct audit_parent *parent;  in audit_init_parent()  local
153 	parent = kzalloc(sizeof(*parent), GFP_KERNEL);  in audit_init_parent()
154 	if (unlikely(!parent))  in audit_init_parent()
157 	INIT_LIST_HEAD(&parent->watches);  in audit_init_parent()
159 	fsnotify_init_mark(&parent->mark, audit_watch_free_mark);  in audit_init_parent()
160 	parent->mark.mask = AUDIT_FS_WATCH;  in audit_init_parent()
161 	ret = fsnotify_add_mark(&parent->mark, audit_watch_group, inode, NULL, 0);  in audit_init_parent()
163 		audit_free_parent(parent);  in audit_init_parent()
167 	return parent;  in audit_init_parent()
231 	audit_get_parent(old->parent);  in audit_dupe_watch()
232 	new->parent = old->parent;  in audit_dupe_watch()
258 static void audit_update_watch(struct audit_parent *parent,  in audit_update_watch()  argument
269 	list_for_each_entry_safe(owatch, nextw, &parent->watches, wlist) {  in audit_update_watch()
329 	list_add(&nwatch->wlist, &parent->watches);  in audit_update_watch()
335 static void audit_remove_parent_watches(struct audit_parent *parent)  in audit_remove_parent_watches()  argument
342 	list_for_each_entry_safe(w, nextw, &parent->watches, wlist) {  in audit_remove_parent_watches()
355 	fsnotify_destroy_mark(&parent->mark, audit_watch_group);  in audit_remove_parent_watches()
359 static int audit_get_nd(struct audit_watch *watch, struct path *parent)  in audit_get_nd()  argument
361 	struct dentry *d = kern_path_locked(watch->path, parent);  in audit_get_nd()
364 	mutex_unlock(&d_backing_inode(parent->dentry)->i_mutex);  in audit_get_nd()
377 				struct audit_parent *parent)  in audit_add_to_parent()  argument
384 	list_for_each_entry(w, &parent->watches, wlist) {  in audit_add_to_parent()
400 		audit_get_parent(parent);  in audit_add_to_parent()
401 		watch->parent = parent;  in audit_add_to_parent()
403 		list_add(&watch->wlist, &parent->watches);  in audit_add_to_parent()
413 	struct audit_parent *parent;  in audit_add_watch()  local
429 	parent = audit_find_parent(d_backing_inode(parent_path.dentry));  in audit_add_watch()
430 	if (!parent) {  in audit_add_watch()
431 		parent = audit_init_parent(&parent_path);  in audit_add_watch()
432 		if (IS_ERR(parent)) {  in audit_add_watch()
433 			ret = PTR_ERR(parent);  in audit_add_watch()
438 	audit_add_to_parent(krule, parent);  in audit_add_watch()
441 	audit_put_parent(parent);  in audit_add_watch()
453 	struct audit_parent *parent = watch->parent;  in audit_remove_watch_rule()  local
460 		if (list_empty(&parent->watches)) {  in audit_remove_watch_rule()
461 			audit_get_parent(parent);  in audit_remove_watch_rule()
462 			fsnotify_destroy_mark(&parent->mark, audit_watch_group);  in audit_remove_watch_rule()
463 			audit_put_parent(parent);  in audit_remove_watch_rule()
477 	struct audit_parent *parent;  in audit_watch_handle_event()  local
479 	parent = container_of(inode_mark, struct audit_parent, mark);  in audit_watch_handle_event()
497 		audit_update_watch(parent, dname, inode->i_sb->s_dev, inode->i_ino, 0);  in audit_watch_handle_event()
499 		audit_update_watch(parent, dname, (dev_t)-1, (unsigned long)-1, 1);  in audit_watch_handle_event()
501 		audit_remove_parent_watches(parent);  in audit_watch_handle_event()