From: Varad Gautam <[email protected]>
d_delete only unhashes an entry if it is reached with
dentry->d_lockref.count != 1. Prior to commit 8ead9dd54716 ("devpts:
more pty driver interface cleanups"), d_delete was called on a dentry
from devpts_pty_kill with two references held, which would trigger the
unhashing, and the subsequent dputs would release it.
Commit 8ead9dd54716 reworked devpts_pty_kill to stop acquiring the second
reference from d_find_alias, and the d_delete call left the dentries
still on the hashed list without actually ever being dropped from dcache
before explicit cleanup. This causes the number of negative dentries for
devpts to pile up, and an `ls /dev/pts` invocation can take seconds to
return.
Provide always_delete_dentry() from simple_dentry_operations
as .d_delete for devpts, to make the dentry be dropped from dcache.
Without this cleanup, the number of dentries in /dev/pts/ can be grown
arbitrarily as:
`python -c 'import pty; pty.spawn(["ls", "/dev/pts"])'`
A systemtap probe on dcache_readdir to count d_subdirs shows this count
to increase with each pty spawn invocation above:
probe kernel.function("dcache_readdir") {
subdirs = &@cast($file->f_path->dentry, "dentry")->d_subdirs;
p = subdirs;
p = @cast(p, "list_head")->next;
i = 0
while (p != subdirs) {
p = @cast(p, "list_head")->next;
i = i+1;
}
printf("number of dentries: %d\n", i);
}
Fixes: 8ead9dd54716 ("devpts: more pty driver interface cleanups")
Signed-off-by: Varad Gautam <[email protected]>
Reported-by: Zheng Wang <[email protected]>
Reported-by: Brandon Schwartz <[email protected]>
Root-caused-by: Maximilian Heyne <[email protected]>
Root-caused-by: Nicolas Pernas Maradei <[email protected]>
CC: David Woodhouse <[email protected]>
CC: Maximilian Heyne <[email protected]>
CC: Stefan Nuernberger <[email protected]>
CC: Amit Shah <[email protected]>
CC: Linus Torvalds <[email protected]>
CC: Greg Kroah-Hartman <[email protected]>
CC: Al Viro <[email protected]>
CC: Christian Brauner <[email protected]>
CC: Eric W. Biederman <[email protected]>
CC: Matthew Wilcox <[email protected]>
CC: Eric Biggers <[email protected]>
CC: <[email protected]> # 4.9+
---
fs/devpts/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index c538145..553a3f3 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
s->s_blocksize_bits = 10;
s->s_magic = DEVPTS_SUPER_MAGIC;
s->s_op = &devpts_sops;
+ s->s_d_op = &simple_dentry_operations;
s->s_time_gran = 1;
error = -ENOMEM;
--
2.7.4
Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
On Thu, Jan 24, 2019 at 02:03:06PM +0100, [email protected] wrote:
> diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
> index c538145..553a3f3 100644
> --- a/fs/devpts/inode.c
> +++ b/fs/devpts/inode.c
> @@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
> s->s_blocksize_bits = 10;
> s->s_magic = DEVPTS_SUPER_MAGIC;
> s->s_op = &devpts_sops;
> + s->s_d_op = &simple_dentry_operations;
> s->s_time_gran = 1;
>
> error = -ENOMEM;
Applied.