[PATCH net 0/2] connector/cn_proc: fix listener count and socket state cleanup

[Cen Zhang (Microsoft)]

Two independent bugs in the process events connector, both reachable
by an unprivileged user:

1. proc_event_num_listeners can go negative because cn_proc_mcast_ctl()
   does not validate mcast_op before storing it as socket state. All
   process events are then suppressed for every subscriber.

2. sk_user_data leaks and the listener count stays too high because
   cn_release() frees the state only for multicast group members and
   never drops the count.

Both were found and fixed with the assistance of an LLM-based code
analysis tool and verified by the author.

Cen Zhang (Microsoft) (2):
  connector/cn_proc: reject invalid mcast_op before touching socket
    state
  connector/cn_proc: release socket state and listener count on close

 drivers/connector/cn_proc.c   | 23 ++++++++++++++++++++---
 drivers/connector/connector.c |  7 +++----
 include/linux/cn_proc.h       |  6 ++++++
 3 files changed, 29 insertions(+), 7 deletions(-)


base-commit: 94cea342e8915812b45f93c56e134041c7fdb4d7
-- 
2.55.0