[PATCH RFC net] icmp: skip IPv6 probe lookup when IPv6 is disabled

[PATCH RFC net] icmp: skip IPv6 probe lookup when IPv6 is disabled

[Slavin Liu]

With CONFIG_IPV6=y and ipv6.disable=1, inet6_init() skips address
configuration, leaving inet6_addr_lst unallocated. An enabled IPv4
extended-echo probe can still request an IPv6 address lookup.

Check ipv6_mod_enabled() before the lookup so the existing no-interface
reply handles this case. This fixes the new lookup-internal NULL access;
it is not a patch for the removed IPv6 stub ERR_PTR sink.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: d98adfbdd5c0 ("ipv4: drop ipv6_stub usage and use direct function calls")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 net/ipv4/icmp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 0caedfc7ca92..d8683b0151b7 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1360,6 +1360,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 		case ICMP_AFI_IP6:
 			if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
 				goto send_mal_query;
+			if (!ipv6_mod_enabled())
+				break;
 			dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
 			dev_hold(dev);
 			break;

Re: [PATCH RFC net] icmp: skip IPv6 probe lookup when IPv6 is disabled

[Ido Schimmel]

On Fri, Sep 11, 2026 at 02:09:25PM +0800, Slavin Liu wrote:
> With CONFIG_IPV6=y and ipv6.disable=1, inet6_init() skips address
> configuration, leaving inet6_addr_lst unallocated. An enabled IPv4
> extended-echo probe can still request an IPv6 address lookup.
> 
> Check ipv6_mod_enabled() before the lookup so the existing no-interface
> reply handles this case. This fixes the new lookup-internal NULL access;
> it is not a patch for the removed IPv6 stub ERR_PTR sink.

I don't understand what the last sentence means.

> 
> Detected by static analysis and reviewed with AI-assisted source auditing.
> 
> Fixes: d98adfbdd5c0 ("ipv4: drop ipv6_stub usage and use direct function calls")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---
>  net/ipv4/icmp.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
> index 0caedfc7ca92..d8683b0151b7 100644
> --- a/net/ipv4/icmp.c
> +++ b/net/ipv4/icmp.c
> @@ -1360,6 +1360,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
>  		case ICMP_AFI_IP6:
>  			if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
>  				goto send_mal_query;
> +			if (!ipv6_mod_enabled())

Moving this to ipv6_dev_find() would be consistent with other exported
functions that already have the check like ip6_fragment() and
ip6_dst_lookup_flow().

FTR, I wasn't aware that an IPv4 Extended Echo Request can identify a
probed interface by an IPv6 address, but RFC 8335 allows it:

"If the Interface Identification Object identifies the probed interface
by address, that address can be a member of any address family.  For
example, an ICMPv4 Extended Echo Request message can carry an Interface
Identification Object that identifies the probed interface by IPv4,
IPv6, or IEEE 802 address.  Likewise, an ICMPv6 Extended Echo Request
message can carry an Interface Identification Object that identifies the
probed interface by IPv4, IPv6, or IEEE 802 address."

> +				break;
>  			dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
>  			dev_hold(dev);
>  			break;