/proc/sys/kernel/pty/nr broken, possibly since 2.6.28

H. Peter Anvin
2009-11-05T23:51:23Z

I just noticed that /proc/sys/kernel/pty/nr is broken, and the most
likely culprit seems to be the series of checkins that include 8b0a88d5
and bf970ee4, during the 2.6.28 merge window. This is thus a
regression. I haven't verified that the bug really goes that far back
-- I should do a bisection -- but it is at least present in 2.6.30.9 and
2.6.32-rc6.

The symptom is that /proc/sys/kernel/pty/nr is properly increased, but
never decreased when a pty gets dropped. It is in fact rather trivial
to escalate /proc/sys/kernel/pty/nr far above /proc/sys/kernel/pty/max.

As far as I read this series, the indent was to have this accounting
handled in pty_unix98_remove(), however, it would appear that that
function never gets called. I'm wondering if this may be a symptom of a
bigger problem as well.

-hpa