TTY_AUDIT_BUF_SIZE
run = TTY_AUDIT_BUF_SIZE - buf->valid;
if (buf->valid == TTY_AUDIT_BUF_SIZE)
buf->data = kmalloc(TTY_AUDIT_BUF_SIZE, GFP_KERNEL);