/proc/sys/kernel/pty/nr broken, possibly since 2.6.28

["H. Peter Anvin" <hpa@zytor.com>]

I just noticed that /proc/sys/kernel/pty/nr is broken, and the most
likely culprit seems to be the series of checkins that include 8b0a88d5
and bf970ee4, during the 2.6.28 merge window.  This is thus a
regression.  I haven't verified that the bug really goes that far back
-- I should do a bisection -- but it is at least present in 2.6.30.9 and
2.6.32-rc6.

The symptom is that /proc/sys/kernel/pty/nr is properly increased, but
never decreased when a pty gets dropped.  It is in fact rather trivial
to escalate /proc/sys/kernel/pty/nr far above /proc/sys/kernel/pty/max.

As far as I read this series, the indent was to have this accounting
handled in pty_unix98_remove(), however, it would appear that that
function never gets called.  I'm wondering if this may be a symptom of a
bigger problem as well.

	-hpa