[bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[Dan Carpenter]

Hello Yiqi Sun,

Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the
following Smatch static checker warning:

	net/ipv4/icmp.c:1351 icmp_build_probe()
	warn: 'dev' is not an error pointer

net/ipv4/icmp.c
    1341 #if IS_ENABLED(CONFIG_IPV6)
    1342                 case ICMP_AFI_IP6:
    1343                         if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
    1344                                 goto send_mal_query;
    1345                         dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
    1346 
    1347                         /*
    1348                          * If IPv6 identifier lookup is unavailable, silently
    1349                          * discard the request instead of misreporting NO_IF.
    1350                          */
--> 1351                         if (IS_ERR(dev))
    1352                                 return false;

It looks like there were two patches that went in around the same
time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
icmp_build_probe()") updated the checking for
ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage
and use direct function calls") changed it to not return error pointers.

This IS_ERR() check can be removed.

    1353 
    1354                         dev_hold(dev);
    1355                         break;
    1356 #endif
    1357                 default:
    1358                         goto send_mal_query;
    1359                 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter

Re: [bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[Fernando Fernandez Mancera]

On 4/10/26 12:16 PM, Dan Carpenter wrote:
> Hello Yiqi Sun,
> 
> Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
> icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	net/ipv4/icmp.c:1351 icmp_build_probe()
> 	warn: 'dev' is not an error pointer
> 
> net/ipv4/icmp.c
>      1341 #if IS_ENABLED(CONFIG_IPV6)
>      1342                 case ICMP_AFI_IP6:
>      1343                         if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
>      1344                                 goto send_mal_query;
>      1345                         dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
>      1346
>      1347                         /*
>      1348                          * If IPv6 identifier lookup is unavailable, silently
>      1349                          * discard the request instead of misreporting NO_IF.
>      1350                          */
> --> 1351                         if (IS_ERR(dev))
>      1352                                 return false;
> 
> It looks like there were two patches that went in around the same
> time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
> icmp_build_probe()") updated the checking for
> ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage
> and use direct function calls") changed it to not return error pointers.
> 
> This IS_ERR() check can be removed.
> 

Yes, I thought it was going to happen during merging but I guess it 
makes sense to do it on a separate patch.

I am sending a patch to net-next addressing this.

Thanks!

Re: [bug report] ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

[Fernando Fernandez Mancera]

On 4/10/26 12:51 PM, Fernando Fernandez Mancera wrote:
> On 4/10/26 12:16 PM, Dan Carpenter wrote:
>> Hello Yiqi Sun,
>>
>> Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
>> icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the
>> following Smatch static checker warning:
>>
>>     net/ipv4/icmp.c:1351 icmp_build_probe()
>>     warn: 'dev' is not an error pointer
>>
>> net/ipv4/icmp.c
>>      1341 #if IS_ENABLED(CONFIG_IPV6)
>>      1342                 case ICMP_AFI_IP6:
>>      1343                         if (iio- 
>> >ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
>>      1344                                 goto send_mal_query;
>>      1345                         dev = ipv6_dev_find(net, &iio- 
>> >ident.addr.ip_addr.ipv6_addr, dev);
>>      1346
>>      1347                         /*
>>      1348                          * If IPv6 identifier lookup is 
>> unavailable, silently
>>      1349                          * discard the request instead of 
>> misreporting NO_IF.
>>      1350                          */
>> --> 1351                         if (IS_ERR(dev))
>>      1352                                 return false;
>>
>> It looks like there were two patches that went in around the same
>> time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in
>> icmp_build_probe()") updated the checking for
>> ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage
>> and use direct function calls") changed it to not return error pointers.
>>
>> This IS_ERR() check can be removed.
>>
> 
> Yes, I thought it was going to happen during merging but I guess it 
> makes sense to do it on a separate patch.
> 

Actually, I believe this has been handled during the net merge with 
net-next.

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=b6e39e48469e37057fce27a1b87cf6d3e456aa42

It should reach linux-next, so all good.

Thanks,
Fernando.