On Tue, Mar 10, 2026 at 11:14 AM Jiayuan Chen [off-list ref] wrote:

From: Jiayuan Chen <redacted>

syzkaller reported a bug [1], and the reproducer is available at [2].

When rose_connect() is called a second time on an already-connecting
socket, it overwrites rose->neighbour with the result of rose_get_neigh()
without releasing the previous reference. If rose_get_neigh() returns
NULL, the socket is left in an inconsistent state: rose->state remains
ROSE_STATE_1 from the first connect while rose->neighbour is NULL.

When the socket is subsequently closed, rose_release() sees ROSE_STATE_1
and calls rose_write_internal() -> rose_transmit_link(skb, NULL), causing
a NULL pointer dereference when accessing neigh->loopback.

Fix this by:
1. Releasing the old neighbour reference before attempting a reconnect
2. Resetting rose->state to ROSE_STATE_0 before the new connect attempt,
   so a failure leaves the socket in a clean state
3. Setting rose->neighbour to NULL in all error paths after
   rose_neigh_put() to prevent use-after-free on subsequent reconnects

[1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271
[2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d00f90e0af54102fb271@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0027.GAE@google.com/T/ (local)
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Jiayuan Chen <redacted>
---
 net/rose/af_rose.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

Normally, a connect() on a socket already connected should return an error.

disconnect is a special operation involving AF_UNSPEC

man connect
...
       Some  protocol  sockets  (e.g., TCP sockets as well as datagram
sockets in the UNIX and Internet domains) may dissolve the association
by
       connecting to an address with the sa_family member of sockaddr
set to AF_UNSPEC; thereafter, the socket can be connected to  another
ad‐
       dress.  (AF_UNSPEC is supported since Linux 2.2.)