[PATCH] proc: only bump parent nlink when registering directories

[PATCH] proc: only bump parent nlink when registering directories

[Krzysztof Wilczyński]

proc_register() increments the parent directory's link count for every
entry it registers, while remove_proc_entry() and remove_proc_subtree()
decrement it only when the removed entry is a directory.  Regular files
thus inflate the parent's count while they exist, and leak one link
permanently on every create and remove cycle.

For example, /proc/bus/pci/00 with twenty-two device files and no
subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
and disable cycles, each creating and removing the VF config space
entries under /proc/bus/pci/<bus>, inflate the link count of that
directory without bound.

Before commit e06689bf5701 ("proc: change ->nlink under
proc_subdir_lock"), the increment lived in proc_mkdir_data() and
proc_create_mount_point(), and was therefore applied only to
directories.  Moving it into proc_register() to bring it under
proc_subdir_lock dropped the S_ISDIR check.

Thus, increment the parent link count only for directories, matching
the decrements in remove_proc_entry() and remove_proc_subtree().

Fixes: e06689bf5701 ("proc: change ->nlink under proc_subdir_lock")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
---
 fs/proc/generic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 8bb81e58c9d8..3ac825c79313 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -404,7 +404,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
 		write_unlock(&proc_subdir_lock);
 		goto out_free_inum;
 	}
-	dir->nlink++;
+	if (S_ISDIR(dp->mode))
+		dir->nlink++;
 	write_unlock(&proc_subdir_lock);
 
 	return dp;
-- 
2.54.0

Re: [PATCH] proc: only bump parent nlink when registering directories

[Alexey Dobriyan]

On Fri, Jun 12, 2026 at 03:30:31PM +0000, Krzysztof Wilczyński wrote:
> proc_register() increments the parent directory's link count for every
> entry it registers, while remove_proc_entry() and remove_proc_subtree()
> decrement it only when the removed entry is a directory.  Regular files
> thus inflate the parent's count while they exist, and leak one link
> permanently on every create and remove cycle.
> 
> For example, /proc/bus/pci/00 with twenty-two device files and no
> subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
> and disable cycles, each creating and removing the VF config space
> entries under /proc/bus/pci/<bus>, inflate the link count of that
> directory without bound.
> 
> Before commit e06689bf5701 ("proc: change ->nlink under
> proc_subdir_lock"), the increment lived in proc_mkdir_data() and
> proc_create_mount_point(), and was therefore applied only to
> directories.  Moving it into proc_register() to bring it under
> proc_subdir_lock dropped the S_ISDIR check.
> 
> Thus, increment the parent link count only for directories, matching
> the decrements in remove_proc_entry() and remove_proc_subtree().
> 
> Fixes: e06689bf5701 ("proc: change ->nlink under proc_subdir_lock")
> Cc: stable@vger.kernel.org # v5.5+
> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>

> --- a/fs/proc/generic.c
> +++ b/fs/proc/generic.c
> @@ -404,7 +404,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
>  		write_unlock(&proc_subdir_lock);
>  		goto out_free_inum;
>  	}
> -	dir->nlink++;
> +	if (S_ISDIR(dp->mode))
> +		dir->nlink++;
>  	write_unlock(&proc_subdir_lock);

nlink accounting should be folded into pde_subdir_insert/pde_erase
probably but as minimal patch it's OK.

Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>

Re: [PATCH] proc: only bump parent nlink when registering directories

[Krzysztof Wilczyński]

Hello,

> > --- a/fs/proc/generic.c
> > +++ b/fs/proc/generic.c
> > @@ -404,7 +404,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
> >  		write_unlock(&proc_subdir_lock);
> >  		goto out_free_inum;
> >  	}
> > -	dir->nlink++;
> > +	if (S_ISDIR(dp->mode))
> > +		dir->nlink++;
> >  	write_unlock(&proc_subdir_lock);
> 
> nlink accounting should be folded into pde_subdir_insert/pde_erase
> probably but as minimal patch it's OK.

I will follow-up with a v2, then.  Thank you for the review!

All the best,

	Krzysztof