[PATCH net 1/2] connector/cn_proc: reject invalid mcast_op before touching socket state

[Cen Zhang (Microsoft)]

cn_proc_mcast_ctl() does not validate mcast_op before storing it in the
per-socket proc_input, so an invalid value is kept as the socket's
state. The IGNORE case only tests prev_mc_op != PROC_CN_MCAST_IGNORE, so
a following PROC_CN_MCAST_IGNORE decrements proc_event_num_listeners for
a socket that never did LISTEN.

Since commit bfdfdc2f3b70
("connector/cn_proc: Allow non-root users access") any user in the initial
namespaces can send these messages. Alternating an invalid operation and
IGNORE drives the count negative; every proc_*_connector() then returns
early and no process events are delivered to any subscriber, including
root-owned monitors.

Fix by rejecting an operation other than LISTEN or IGNORE before any
per-socket state is created or modified. The default case of the switch
becomes unreachable and is removed.

Fixes: 2aa1f7a1f47c ("connector/cn_proc: Add filtering to fix some bugs")
Cc: stable@xxxxxxxxxxxxxxx
Cc: AutonomousCodeSecurity@xxxxxxxxxxxxx
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@xxxxxxxxxxxxxxxxxxx>
---
The bug was found and this fix was developed with the assistance of an
LLM-based code analysis tool. The analysis, the patch and its testing
were reviewed and verified by the author.

 drivers/connector/cn_proc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 0056ab81fbc3..4f613c0648ae 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -421,6 +421,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
 		return;
 	}
 
+	if (mc_op != PROC_CN_MCAST_LISTEN &&
+	    mc_op != PROC_CN_MCAST_IGNORE) {
+		err = EINVAL;
+		goto out;
+	}
+
 	ev_type = valid_event((enum proc_cn_event)ev_type);
 
 	if (ev_type == PROC_EVENT_NONE)
@@ -455,9 +461,6 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
 		((struct proc_input *)(sk->sk_user_data))->event_type =
 			PROC_EVENT_NONE;
 		break;
-	default:
-		err = EINVAL;
-		break;
 	}
 
 out:
-- 
2.55.0