[PATCH net 1/1] ipv4: icmp: validate reply type before using icmp_pointers

[PATCH net 1/1] ipv4: icmp: validate reply type before using icmp_pointers

[Ren Wei]

From: Ruide Cao <caoruide123@gmail.com>

Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
That value is outside the range covered by icmp_pointers[], which only
describes the traditional ICMP types up to NR_ICMP_TYPES.

Avoid consulting icmp_pointers[] for reply types outside that range and
keep the existing behavior for normal ICMP replies unchanged.

Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Ruide Cao <caoruide123@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
 net/ipv4/icmp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 4e2a6c70dcd8..d8036663f035 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -373,7 +373,8 @@ static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
 				      to, len);
 
 	skb->csum = csum_block_add(skb->csum, csum, odd);
-	if (icmp_pointers[icmp_param->data.icmph.type].error)
+	if (icmp_param->data.icmph.type <= NR_ICMP_TYPES &&
+	    icmp_pointers[icmp_param->data.icmph.type].error)
 		nf_ct_attach(skb, icmp_param->skb);
 	return 0;
 }
-- 
2.34.1

Re: [PATCH net 1/1] ipv4: icmp: validate reply type before using icmp_pointers

[Eric Dumazet]

On Sun, Apr 19, 2026 at 3:24 AM Ren Wei <n05ec@lzu.edu.cn> wrote:
>
> From: Ruide Cao <caoruide123@gmail.com>
>
> Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
> That value is outside the range covered by icmp_pointers[], which only
> describes the traditional ICMP types up to NR_ICMP_TYPES.
>
> Avoid consulting icmp_pointers[] for reply types outside that range and
> keep the existing behavior for normal ICMP replies unchanged.
>
> Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Signed-off-by: Ruide Cao <caoruide123@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> ---
>  net/ipv4/icmp.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
> index 4e2a6c70dcd8..d8036663f035 100644
> --- a/net/ipv4/icmp.c
> +++ b/net/ipv4/icmp.c
> @@ -373,7 +373,8 @@ static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd,
>                                       to, len);
>
>         skb->csum = csum_block_add(skb->csum, csum, odd);
> -       if (icmp_pointers[icmp_param->data.icmph.type].error)
> +       if (icmp_param->data.icmph.type <= NR_ICMP_TYPES &&
> +           icmp_pointers[icmp_param->data.icmph.type].error)
>                 nf_ct_attach(skb, icmp_param->skb);
>         return 0;

Pedantic mode: Perhaps also use array_index_nospec()

Re: [PATCH net 1/1] ipv4: icmp: validate reply type before using icmp_pointers

[Simon Horman]

On Sun, Apr 19, 2026 at 06:19:18PM +0800, Ren Wei wrote:
> From: Ruide Cao <caoruide123@gmail.com>
> 
> Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
> That value is outside the range covered by icmp_pointers[], which only
> describes the traditional ICMP types up to NR_ICMP_TYPES.
> 
> Avoid consulting icmp_pointers[] for reply types outside that range and
> keep the existing behavior for normal ICMP replies unchanged.
> 
> Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Signed-off-by: Ruide Cao <caoruide123@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Reviewed-by: Simon Horman <horms@kernel.org>

Sashiko has generated a review of this patch.  I do not believe the
problems flagged there need to be addressed as the array indexes used in
those cases have are always valid.  However, I would appreciate it if you
could look over this.

Re: [PATCH net 1/1] ipv4: icmp: validate reply type before using icmp_pointers

[Simon Horman]

On Thu, Apr 23, 2026 at 05:58:59PM +0100, Simon Horman wrote:
> On Sun, Apr 19, 2026 at 06:19:18PM +0800, Ren Wei wrote:
> > From: Ruide Cao <caoruide123@gmail.com>
> > 
> > Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
> > That value is outside the range covered by icmp_pointers[], which only
> > describes the traditional ICMP types up to NR_ICMP_TYPES.
> > 
> > Avoid consulting icmp_pointers[] for reply types outside that range and
> > keep the existing behavior for normal ICMP replies unchanged.
> > 
> > Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
> > Cc: stable@kernel.org
> > Reported-by: Yuan Tan <yuantan098@gmail.com>
> > Reported-by: Yifan Wu <yifanwucs@gmail.com>
> > Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> > Reported-by: Xin Liu <bird@lzu.edu.cn>
> > Signed-off-by: Ruide Cao <caoruide123@gmail.com>
> > Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> 
> Reviewed-by: Simon Horman <horms@kernel.org>
> 
> Sashiko has generated a review of this patch.  I do not believe the
> problems flagged there need to be addressed as the array indexes used in
> those cases have are always valid.  However, I would appreciate it if you
> could look over this.

Sorry, I meant that to be a reply to v2.
I will respond there too.