void audit_syscall_entry(struct task_struct *tsk, int major, 
void audit_syscall_entry(struct task_struct *tsk, int arch, int major, 
void audit_syscall_entry(struct task_struct *tsk, int major,			 unsigned long a1, unsigned long a2,			 unsigned long a3, unsigned long a4){	struct audit_context *context = tsk->audit_context;	enum audit_state     state;	BUG_ON(!context);	/* This happens only on certain architectures that make system	 * calls in kernel_thread via the entry.S interface, instead of	 * with direct calls.  (If you are porting to a new	 * architecture, hitting this condition can indicate that you	 * got the _exit/_leave calls backward in entry.S.)	 *	 * i386     no	 * x86_64   no	 * ppc64    yes (see arch/ppc64/kernel/misc.S)	 *	 * This also happens with vm86 emulation in a non-nested manner	 * (entries without exits), so this case must be caught.	 */	if (context->in_syscall) {		struct audit_context *newctx;#if defined(__NR_vm86) && defined(__NR_vm86old)		/* vm86 mode should only be entered once */		if (major == __NR_vm86 || major == __NR_vm86old)			return;#endif#if AUDIT_DEBUG		printk(KERN_ERR		       "audit(:%d) pid=%d in syscall=%d;"		       " entering syscall=%d\n",		       context->serial, tsk->pid, context->major, major);#endif		newctx = audit_alloc_context(context->state);		if (newctx) {			newctx->previous   = context;			context		   = newctx;			tsk->audit_context = newctx;		} else	{			/* If we can't alloc a new context, the best we			 * can do is to leak memory (any pending putname			 * will be lost).  The only other alternative is			 * to abandon auditing. */			audit_zero_context(context, context->state);		}	}	BUG_ON(context->in_syscall || context->name_count);	if (!audit_enabled)		return;	context->major      = major;	context->argv[0]    = a1;	context->argv[1]    = a2;	context->argv[2]    = a3;	context->argv[3]    = a4;	state = context->state;	if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)		state = audit_filter_syscall(tsk, context, &audit_entlist);	if (likely(state == AUDIT_DISABLED))		return;	context->serial     = audit_serial();	context->ctime      = CURRENT_TIME;	context->in_syscall = 1;	context->auditable  = !!(state == AUDIT_RECORD_CONTEXT);}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/2fd6f58ba6efc82ea2c9c2630f7ff5ed9eeaf34a/auditsc.c/buggy/kernel/auditsc.c