This is a note to let you know that I've just added the patch titled um: chan_user: Fix winch_tramp() return value to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: um-chan_user-fix-winch_tramp-return-value.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 57ae0b67b747031bc41fb44643aa5344ab58607e Mon Sep 17 00:00:00 2001 From: Johannes Berg <johannes.berg@xxxxxxxxx> Date: Fri, 20 May 2022 19:45:36 +0200 Subject: um: chan_user: Fix winch_tramp() return value From: Johannes Berg <johannes.berg@xxxxxxxxx> commit 57ae0b67b747031bc41fb44643aa5344ab58607e upstream. The previous fix here was only partially correct, it did result in returning a proper error value in case of error, but it also clobbered the pid that we need to return from this function (not just zero for success). As a result, it returned 0 here, but later this is treated as a pid and used to kill the process, but since it's now 0 we kill(0, SIGKILL), which makes UML kill itself rather than just the helper thread. Fix that and make it more obvious by using a separate variable for the pid. Fixes: ccf1236ecac4 ("um: fix error return code in winch_tramp()") Reported-and-tested-by: Nathan Chancellor <nathan@xxxxxxxxxx> Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Richard Weinberger <richard@xxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/um/drivers/chan_user.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/arch/um/drivers/chan_user.c +++ b/arch/um/drivers/chan_user.c @@ -220,7 +220,7 @@ static int winch_tramp(int fd, struct tt unsigned long *stack_out) { struct winch_data data; - int fds[2], n, err; + int fds[2], n, err, pid; char c; err = os_pipe(fds, 1, 1); @@ -238,8 +238,9 @@ static int winch_tramp(int fd, struct tt * problem with /dev/net/tun, which if held open by this * thread, prevents the TUN/TAP device from being reused. */ - err = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out); - if (err < 0) { + pid = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out); + if (pid < 0) { + err = pid; printk(UM_KERN_ERR "fork of winch_thread failed - errno = %d\n", -err); goto out_close; @@ -263,7 +264,7 @@ static int winch_tramp(int fd, struct tt goto out_close; } - return err; + return pid; out_close: close(fds[1]); Patches currently in stable-queue which might be from johannes.berg@xxxxxxxxx are queue-5.10/mac80211-upgrade-passive-scan-to-active-scan-on-dfs-channels-after-beacon-rx.patch queue-5.10/wifi-mac80211-fix-use-after-free-in-chanctx-code.patch queue-5.10/nl80211-show-ssid-for-p2p_go-interfaces.patch queue-5.10/iwlwifi-mvm-fix-assert-1f04-upon-reconfig.patch queue-5.10/cfg80211-declare-module_firmware-for-regulatory.db.patch queue-5.10/um-chan_user-fix-winch_tramp-return-value.patch