cn_proc_mcast_ctl() does not validate mcast_op before storing it in the per-socket proc_input, so an invalid value is kept as the socket's state. The IGNORE case only tests prev_mc_op != PROC_CN_MCAST_IGNORE, so a following PROC_CN_MCAST_IGNORE decrements proc_event_num_listeners for a socket that never did LISTEN. Since commit bfdfdc2f3b70 ("connector/cn_proc: Allow non-root users access") any user in the initial namespaces can send these messages. Alternating an invalid operation and IGNORE drives the count negative; every proc_*_connector() then returns early and no process events are delivered to any subscriber, including root-owned monitors. Fix by rejecting an operation other than LISTEN or IGNORE before any per-socket state is created or modified. The default case of the switch becomes unreachable and is removed. Fixes: 2aa1f7a1f47c ("connector/cn_proc: Add filtering to fix some bugs") Cc: stable@vger.kernel.org Cc: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- The bug was found and this fix was developed with the assistance of an LLM-based code analysis tool. The analysis, the patch and its testing were reviewed and verified by the author. drivers/connector/cn_proc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c index 0056ab81fbc3..4f613c0648ae 100644 --- a/drivers/connector/cn_proc.c +++ b/drivers/connector/cn_proc.c @@ -421,6 +421,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg, return; } + if (mc_op != PROC_CN_MCAST_LISTEN && + mc_op != PROC_CN_MCAST_IGNORE) { + err = EINVAL; + goto out; + } + ev_type = valid_event((enum proc_cn_event)ev_type); if (ev_type == PROC_EVENT_NONE) @@ -455,9 +461,6 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg, ((struct proc_input *)(sk->sk_user_data))->event_type = PROC_EVENT_NONE; break; - default: - err = EINVAL; - break; } out: -- 2.55.0