• Varad Gautam's avatar
    fs/devpts: always delete dcache dentry-s in dput() · 73052b0d
    Varad Gautam authored
    d_delete only unhashes an entry if it is reached with
    dentry->d_lockref.count != 1. Prior to commit 8ead9dd5 ("devpts:
    more pty driver interface cleanups"), d_delete was called on a dentry
    from devpts_pty_kill with two references held, which would trigger the
    unhashing, and the subsequent dputs would release it.
    
    Commit 8ead9dd5 reworked devpts_pty_kill to stop acquiring the second
    reference from d_find_alias, and the d_delete call left the dentries
    still on the hashed list without actually ever being dropped from dcache
    before explicit cleanup. This causes the number of negative dentries for
    devpts to pile up, and an `ls /dev/pts` invocation can take seconds to
    return.
    
    Provide always_delete_dentry() from simple_dentry_operations
    as .d_delete for devpts, to make the dentry be dropped from dcache.
    
    Without this cleanup, the number of dentries in /dev/pts/ can be grown
    arbitrarily as:
    
    `python -c 'import pty; pty.spawn(["ls", "/dev/pts"])'`
    
    A systemtap probe on dcache_readdir to count d_subdirs shows this count
    to increase with each pty spawn invocation above:
    
    probe kernel.function("dcache_readdir") {
        subdirs = &@cast($file->f_path->dentry, "dentry")->d_subdirs;
        p = subdirs;
        p = @cast(p, "list_head")->next;
        i = 0
        while (p != subdirs) {
          p = @cast(p, "list_head")->next;
          i = i+1;
        }
        printf("number of dentries: %d\n", i);
    }
    
    Fixes: 8ead9dd5 ("devpts: more pty driver interface cleanups")
    Signed-off-by: default avatarVarad Gautam <vrd@amazon.de>
    Reported-by: default avatarZheng Wang <wanz@amazon.de>
    Reported-by: default avatarBrandon Schwartz <bsschwar@amazon.de>
    Root-caused-by: default avatarMaximilian Heyne <mheyne@amazon.de>
    Root-caused-by: default avatarNicolas Pernas Maradei <npernas@amazon.de>
    CC: David Woodhouse <dwmw@amazon.co.uk>
    CC: Maximilian Heyne <mheyne@amazon.de>
    CC: Stefan Nuernberger <snu@amazon.de>
    CC: Amit Shah <aams@amazon.de>
    CC: Linus Torvalds <torvalds@linux-foundation.org>
    CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    CC: Al Viro <viro@ZenIV.linux.org.uk>
    CC: Christian Brauner <christian.brauner@ubuntu.com>
    CC: Eric W. Biederman <ebiederm@xmission.com>
    CC: Matthew Wilcox <willy@infradead.org>
    CC: Eric Biggers <ebiggers@google.com>
    CC: <stable@vger.kernel.org> # 4.9+
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    73052b0d
inode.c 14.8 KB