Re: [bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 4/10/26 12:51 PM, Fernando Fernandez Mancera wrote:
> On 4/10/26 12:16 PM, Dan Carpenter wrote:
>> Hello Yiqi Sun,
>>
>> Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
>> icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the
>> following Smatch static checker warning:
>>
>>     net/ipv4/icmp.c:1351 icmp_build_probe()
>>     warn: 'dev' is not an error pointer
>>
>> net/ipv4/icmp.c
>>      1341 #if IS_ENABLED(CONFIG_IPV6)
>>      1342                 case ICMP_AFI_IP6:
>>      1343                         if (iio- 
>> >ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
>>      1344                                 goto send_mal_query;
>>      1345                         dev = ipv6_dev_find(net, &iio- 
>> >ident.addr.ip_addr.ipv6_addr, dev);
>>      1346
>>      1347                         /*
>>      1348                          * If IPv6 identifier lookup is 
>> unavailable, silently
>>      1349                          * discard the request instead of 
>> misreporting NO_IF.
>>      1350                          */
>> --> 1351                         if (IS_ERR(dev))
>>      1352                                 return false;
>>
>> It looks like there were two patches that went in around the same
>> time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
>> icmp_build_probe()") updated the checking for
>> ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage
>> and use direct function calls") changed it to not return error pointers.
>>
>> This IS_ERR() check can be removed.
>>
> 
> Yes, I thought it was going to happen during merging but I guess it 
> makes sense to do it on a separate patch.
> 

Actually, I believe this has been handled during the net merge with 
net-next.

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=b6e39e48469e37057fce27a1b87cf6d3e456aa42

It should reach linux-next, so all good.

Thanks,
Fernando.