Re: [bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 4/10/26 12:16 PM, Dan Carpenter wrote:
> Hello Yiqi Sun,
> 
> Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
> icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	net/ipv4/icmp.c:1351 icmp_build_probe()
> 	warn: 'dev' is not an error pointer
> 
> net/ipv4/icmp.c
>      1341 #if IS_ENABLED(CONFIG_IPV6)
>      1342                 case ICMP_AFI_IP6:
>      1343                         if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
>      1344                                 goto send_mal_query;
>      1345                         dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
>      1346
>      1347                         /*
>      1348                          * If IPv6 identifier lookup is unavailable, silently
>      1349                          * discard the request instead of misreporting NO_IF.
>      1350                          */
> --> 1351                         if (IS_ERR(dev))
>      1352                                 return false;
> 
> It looks like there were two patches that went in around the same
> time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
> icmp_build_probe()") updated the checking for
> ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage
> and use direct function calls") changed it to not return error pointers.
> 
> This IS_ERR() check can be removed.
> 

Yes, I thought it was going to happen during merging but I guess it 
makes sense to do it on a separate patch.

I am sending a patch to net-next addressing this.

Thanks!