There is a dentry refcount leak in devpts_get_tty.

struct tty_struct *devpts_get_tty(int number)
{
        struct dentry *dentry = get_node(number);
        struct tty_struct *tty;

        tty = (IS_ERR(dentry) || !dentry->d_inode) ? NULL :
                        dentry->d_inode->u.generic_ip;

        up(&devpts_root->d_inode->i_sem);
        return tty;
}

The get_node function does a lookup on /dev/pts/<number> and returns the
dentry, taking a reference.  We should dput the dentry after extracting the
tty pointer.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>