ab = audit_buffer_alloc(GFP_ATOMIC); 
ab = audit_buffer_alloc(ctx, GFP_ATOMIC, type); 
struct audit_buffer *audit_log_start(struct audit_context *ctx, int type, int pid){	struct audit_buffer	*ab	= NULL;	struct timespec		t;	unsigned int		serial;	struct nlmsghdr *nlh;	if (!audit_initialized)		return NULL;	if (audit_backlog_limit	    && atomic_read(&audit_backlog) > audit_backlog_limit) {		if (audit_rate_check())			printk(KERN_WARNING			       "audit: audit_backlog=%d > "			       "audit_backlog_limit=%d\n",			       atomic_read(&audit_backlog),			       audit_backlog_limit);		audit_log_lost("backlog limit exceeded");		return NULL;	}	ab = audit_buffer_alloc(GFP_ATOMIC);	if (!ab) {		audit_log_lost("out of memory in audit_log_start");		return NULL;	}	ab->ctx   = ctx;	nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));	nlh->nlmsg_type = type;	nlh->nlmsg_flags = 0;	nlh->nlmsg_pid = pid;	nlh->nlmsg_seq = 0;	if (!audit_get_stamp(ab->ctx, &t, &serial)) {		t = CURRENT_TIME;		serial = 0;	}	audit_log_format(ab, "audit(%lu.%03lu:%u): ",			 t.tv_sec, t.tv_nsec/1000000, serial);	return ab;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/c04049939f88b29e235d2da217bce6e8ead44f32/audit.c/clean/kernel/audit.c