Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6cbe8368 authored by Johannes Berg's avatar Johannes Berg Committed by Greg Kroah-Hartman
Browse files

um: chan_user: Fix winch_tramp() return value 



commit 57ae0b67b747031bc41fb44643aa5344ab58607e upstream.

The previous fix here was only partially correct, it did
result in returning a proper error value in case of error,
but it also clobbered the pid that we need to return from
this function (not just zero for success).

As a result, it returned 0 here, but later this is treated
as a pid and used to kill the process, but since it's now
0 we kill(0, SIGKILL), which makes UML kill itself rather
than just the helper thread.

Fix that and make it more obvious by using a separate
variable for the pid.

Fixes: ccf1236ecac4 ("um: fix error return code in winch_tramp()")
Reported-and-tested-by: default avatarNathan Chancellor <nathan@kernel.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3466e426

arch/um/drivers/chan_user.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -220,7 +220,7 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, 
		       unsigned long *stack_out)

		       unsigned long *stack_out)

{

{

	struct winch_data data;

	struct winch_data data;

	int fds[2], n, err;

	int fds[2], n, err, pid;

	char c;

	char c;





	err = os_pipe(fds, 1, 1);

	err = os_pipe(fds, 1, 1);
@@ -238,8 +238,9 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, 
	 * problem with /dev/net/tun, which if held open by this

	 * problem with /dev/net/tun, which if held open by this

	 * thread, prevents the TUN/TAP device from being reused.

	 * thread, prevents the TUN/TAP device from being reused.

	 */

	 */

	err = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out);

	pid = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out);

	if (err < 0) {

	if (pid < 0) {

		err = pid;

		printk(UM_KERN_ERR "fork of winch_thread failed - errno = %d\n",

		printk(UM_KERN_ERR "fork of winch_thread failed - errno = %d\n",

		       -err);

		       -err);

		goto out_close;

		goto out_close;
@@ -263,7 +264,7 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, 
		goto out_close;

		goto out_close;

	}

	}





	return err;

	return pid;





 out_close:

 out_close:

	close(fds[1]);

	close(fds[1]);