From: Varad Gautam vrd@amazon.de

d_delete only unhashes an entry if it is reached with dentry->d_lockref.count != 1. Prior to commit 8ead9dd54716 ("devpts: more pty driver interface cleanups"), d_delete was called on a dentry from devpts_pty_kill with two references held, which would trigger the unhashing, and the subsequent dputs would release it.

Commit 8ead9dd54716 reworked devpts_pty_kill to stop acquiring the second reference from d_find_alias, and the d_delete call left the dentries still on the hashed list without actually ever being dropped from dcache before explicit cleanup. This causes the number of negative dentries for devpts to pile up, and an `ls /dev/pts` invocation can take seconds to return.

Provide always_delete_dentry() from simple_dentry_operations as .d_delete for devpts, to make the dentry be dropped from dcache.

Without this cleanup, the number of dentries in /dev/pts/ can be grown arbitrarily as:

`python -c 'import pty; pty.spawn(["ls", "/dev/pts"])'`

A systemtap probe on dcache_readdir to count d_subdirs shows this count to increase with each pty spawn invocation above:

probe kernel.function("dcache_readdir") { subdirs = &@cast($file->f_path->dentry, "dentry")->d_subdirs; p = subdirs; p = @cast(p, "list_head")->next; i = 0 while (p != subdirs) { p = @cast(p, "list_head")->next; i = i+1; } printf("number of dentries: %d\n", i); }

Fixes: 8ead9dd54716 ("devpts: more pty driver interface cleanups") Signed-off-by: Varad Gautam vrd@amazon.de Reported-by: Zheng Wang wanz@amazon.de Reported-by: Brandon Schwartz bsschwar@amazon.de Root-caused-by: Maximilian Heyne mheyne@amazon.de Root-caused-by: Nicolas Pernas Maradei npernas@amazon.de CC: David Woodhouse dwmw@amazon.co.uk CC: Maximilian Heyne mheyne@amazon.de CC: Stefan Nuernberger snu@amazon.de CC: Amit Shah aams@amazon.de CC: Linus Torvalds torvalds@linux-foundation.org CC: Greg Kroah-Hartman gregkh@linuxfoundation.org CC: Al Viro viro@ZenIV.linux.org.uk CC: Christian Brauner christian.brauner@ubuntu.com CC: Eric W. Biederman ebiederm@xmission.com CC: Matthew Wilcox willy@infradead.org CC: Eric Biggers ebiggers@google.com CC: stable@vger.kernel.org # 4.9+ --- fs/devpts/inode.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c index c538145..553a3f3 100644 --- a/fs/devpts/inode.c +++ b/fs/devpts/inode.c @@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent) s->s_blocksize_bits = 10; s->s_magic = DEVPTS_SUPER_MAGIC; s->s_op = &devpts_sops; + s->s_d_op = &simple_dentry_operations; s->s_time_gran = 1;

error = -ENOMEM;