lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 22 Mar 2019 12:15:16 +0100
From:   Greg Kroah-Hartman <>
Cc:     Greg Kroah-Hartman <>,, Varad Gautam <>,
        Zheng Wang <>,
        Brandon Schwartz <>,
        David Woodhouse <>,
        Maximilian Heyne <>,
        Stefan Nuernberger <>, Amit Shah <>,
        Linus Torvalds <>,
        Al Viro <>,
        Christian Brauner <>,
        "Eric W. Biederman" <>,
        Matthew Wilcox <>,
        Eric Biggers <>,
        Al Viro <>,
        Nicolas Pernas Maradei <>
Subject: [PATCH 4.19 163/280] fs/devpts: always delete dcache dentry-s in dput()

4.19-stable review patch.  If anyone has any objections, please let me know.


From: Varad Gautam <>

commit 73052b0daee0b750b39af18460dfec683e4f5887 upstream.

d_delete only unhashes an entry if it is reached with
dentry->d_lockref.count != 1. Prior to commit 8ead9dd54716 ("devpts:
more pty driver interface cleanups"), d_delete was called on a dentry
from devpts_pty_kill with two references held, which would trigger the
unhashing, and the subsequent dputs would release it.

Commit 8ead9dd54716 reworked devpts_pty_kill to stop acquiring the second
reference from d_find_alias, and the d_delete call left the dentries
still on the hashed list without actually ever being dropped from dcache
before explicit cleanup. This causes the number of negative dentries for
devpts to pile up, and an `ls /dev/pts` invocation can take seconds to

Provide always_delete_dentry() from simple_dentry_operations
as .d_delete for devpts, to make the dentry be dropped from dcache.

Without this cleanup, the number of dentries in /dev/pts/ can be grown
arbitrarily as:

`python -c 'import pty; pty.spawn(["ls", "/dev/pts"])'`

A systemtap probe on dcache_readdir to count d_subdirs shows this count
to increase with each pty spawn invocation above:

probe kernel.function("dcache_readdir") {
    subdirs = &@...t($file->f_path->dentry, "dentry")->d_subdirs;
    p = subdirs;
    p = @cast(p, "list_head")->next;
    i = 0
    while (p != subdirs) {
      p = @cast(p, "list_head")->next;
      i = i+1;
    printf("number of dentries: %d\n", i);

Fixes: 8ead9dd54716 ("devpts: more pty driver interface cleanups")
Signed-off-by: Varad Gautam <>
Reported-by: Zheng Wang <>
Reported-by: Brandon Schwartz <>
Root-caused-by: Maximilian Heyne <>
Root-caused-by: Nicolas Pernas Maradei <>
CC: David Woodhouse <>
CC: Maximilian Heyne <>
CC: Stefan Nuernberger <>
CC: Amit Shah <>
CC: Linus Torvalds <>
CC: Greg Kroah-Hartman <>
CC: Al Viro <>
CC: Christian Brauner <>
CC: Eric W. Biederman <>
CC: Matthew Wilcox <>
CC: Eric Biggers <>
CC: <> # 4.9+
Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>

 fs/devpts/inode.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s,
 	s->s_blocksize_bits = 10;
 	s->s_magic = DEVPTS_SUPER_MAGIC;
 	s->s_op = &devpts_sops;
+	s->s_d_op = &simple_dentry_operations;
 	s->s_time_gran = 1;
 	error = -ENOMEM;

Powered by blists - more mailing lists