[PATCH v2] proc: only bump parent nlink when registering directories

[PATCH v2] proc: only bump parent nlink when registering directories

[Krzysztof Wilczyński]

proc_register() increments the parent directory's link count for every
entry it registers, while remove_proc_entry() and remove_proc_subtree()
decrement it only when the removed entry is a directory.  Regular files
thus inflate the parent's count while they exist, and leak one link
permanently on every create and remove cycle.

For example, /proc/bus/pci/00 with twenty-two device files and no
subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
and disable cycles, each creating and removing the VF config space
entries under /proc/bus/pci/<bus>, inflate the link count of that
directory without bound.

Before commit e06689bf5701 ("proc: change ->nlink under
proc_subdir_lock"), the increment lived in proc_mkdir_data() and
proc_create_mount_point(), and was therefore applied only to
directories.  Moving it into proc_register() to bring it under
proc_subdir_lock dropped the S_ISDIR check.

Thus, move the nlink accounting into pde_subdir_insert() and
pde_erase(), only updating it for directories in both, so the link
count is always changed together with the directory entry itself.

Fixes: e06689bf5701 ("proc: change ->nlink under proc_subdir_lock")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
---
Changes in v2:
  https://lore.kernel.org/linux-fsdevel/20260612153031.536525-1-kwilczynski@kernel.org/

  - Moved the nlink accounting into pde_subdir_insert() and
    pde_erase() instead of adding a check in proc_register(), as
    suggested by Alexey Dobriyan.

 fs/proc/generic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 8bb81e58c9d8..32b6b0f97967 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -112,6 +112,8 @@ static bool pde_subdir_insert(struct proc_dir_entry *dir,
 	/* Add new node and rebalance tree. */
 	rb_link_node(&de->subdir_node, parent, new);
 	rb_insert_color(&de->subdir_node, root);
+	if (S_ISDIR(de->mode))
+		dir->nlink++;
 	return true;
 }
 
@@ -404,7 +406,6 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
 		write_unlock(&proc_subdir_lock);
 		goto out_free_inum;
 	}
-	dir->nlink++;
 	write_unlock(&proc_subdir_lock);
 
 	return dp;
@@ -702,6 +703,8 @@ static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent)
 {
 	rb_erase(&pde->subdir_node, &parent->subdir);
 	RB_CLEAR_NODE(&pde->subdir_node);
+	if (S_ISDIR(pde->mode))
+		parent->nlink--;
 }
 
 /*
@@ -727,8 +730,6 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
 			de = NULL;
 		} else {
 			pde_erase(de, parent);
-			if (S_ISDIR(de->mode))
-				parent->nlink--;
 		}
 	}
 	write_unlock(&proc_subdir_lock);
@@ -787,8 +788,6 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)
 			continue;
 		}
 		next = de->parent;
-		if (S_ISDIR(de->mode))
-			next->nlink--;
 		write_unlock(&proc_subdir_lock);
 
 		proc_entry_rundown(de);
-- 
2.54.0

Re: [PATCH v2] proc: only bump parent nlink when registering directories

[Christian Brauner]

On Sat, 13 Jun 2026 21:10:05 +0000, Krzysztof Wilczyński wrote:
> proc_register() increments the parent directory's link count for every
> entry it registers, while remove_proc_entry() and remove_proc_subtree()
> decrement it only when the removed entry is a directory.  Regular files
> thus inflate the parent's count while they exist, and leak one link
> permanently on every create and remove cycle.
> 
> For example, /proc/bus/pci/00 with twenty-two device files and no
> subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
> and disable cycles, each creating and removing the VF config space
> entries under /proc/bus/pci/<bus>, inflate the link count of that
> directory without bound.
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] proc: only bump parent nlink when registering directories
      https://git.kernel.org/vfs/vfs/c/552864f6ac8f

Re: [PATCH v2] proc: only bump parent nlink when registering directories

[Krzysztof Wilczyński]

Hello,

> > proc_register() increments the parent directory's link count for every
> > entry it registers, while remove_proc_entry() and remove_proc_subtree()
> > decrement it only when the removed entry is a directory.  Regular files
> > thus inflate the parent's count while they exist, and leak one link
> > permanently on every create and remove cycle.
> > 
> > For example, /proc/bus/pci/00 with twenty-two device files and no
> > subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
> > and disable cycles, each creating and removing the VF config space
> > entries under /proc/bus/pci/<bus>, inflate the link count of that
> > directory without bound.
> > 
> > [...]
> 
> Applied to the vfs.fixes branch of the vfs/vfs.git tree.
> Patches in the vfs.fixes branch should appear in linux-next soon.
[...] 
> [1/1] proc: only bump parent nlink when registering directories
>       https://git.kernel.org/vfs/vfs/c/552864f6ac8f

I assume this got lost?  Seems its missing from 7.2-rc1, sadly.

Thank you!

	Krzysztof

Re: [PATCH v2] proc: only bump parent nlink when registering directories

[Jan Kara]

Hello!

On Mon 29-06-26 14:42:17, Krzysztof Wilczyński wrote:
> > > proc_register() increments the parent directory's link count for every
> > > entry it registers, while remove_proc_entry() and remove_proc_subtree()
> > > decrement it only when the removed entry is a directory.  Regular files
> > > thus inflate the parent's count while they exist, and leak one link
> > > permanently on every create and remove cycle.
> > > 
> > > For example, /proc/bus/pci/00 with twenty-two device files and no
> > > subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
> > > and disable cycles, each creating and removing the VF config space
> > > entries under /proc/bus/pci/<bus>, inflate the link count of that
> > > directory without bound.
> > > 
> > > [...]
> > 
> > Applied to the vfs.fixes branch of the vfs/vfs.git tree.
> > Patches in the vfs.fixes branch should appear in linux-next soon.
> [...] 
> > [1/1] proc: only bump parent nlink when registering directories
> >       https://git.kernel.org/vfs/vfs/c/552864f6ac8f
> 
> I assume this got lost?  Seems its missing from 7.2-rc1, sadly.

I don't think it got lost. I'd expect Christian to send the fix for 7.2-rc2
(he merged it to his tree only during a merge window). I've checked his
tree to verify but apparently Christian didn't push out vfs.fixes or
vfs.all branch for a couple of weeks.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH v2] proc: only bump parent nlink when registering directories

[Krzysztof Wilczyński]

Hello,

> > > > proc_register() increments the parent directory's link count for every
> > > > entry it registers, while remove_proc_entry() and remove_proc_subtree()
> > > > decrement it only when the removed entry is a directory.  Regular files
> > > > thus inflate the parent's count while they exist, and leak one link
> > > > permanently on every create and remove cycle.
> > > > 
> > > > For example, /proc/bus/pci/00 with twenty-two device files and no
> > > > subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
> > > > and disable cycles, each creating and removing the VF config space
> > > > entries under /proc/bus/pci/<bus>, inflate the link count of that
> > > > directory without bound.
> > > > 
> > > > [...]
> > > 
> > > Applied to the vfs.fixes branch of the vfs/vfs.git tree.
> > > Patches in the vfs.fixes branch should appear in linux-next soon.
> > [...] 
> > > [1/1] proc: only bump parent nlink when registering directories
> > >       https://git.kernel.org/vfs/vfs/c/552864f6ac8f
> > 
> > I assume this got lost?  Seems its missing from 7.2-rc1, sadly.
> 
> I don't think it got lost. I'd expect Christian to send the fix for 7.2-rc2
> (he merged it to his tree only during a merge window). I've checked his
> tree to verify but apparently Christian didn't push out vfs.fixes or
> vfs.all branch for a couple of weeks.

I saw the patch landed.  Thank you for help!

All the best,

	Krzysztof