Patch "icmp: prevent possible NULL dereferences from icmp_build_probe()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    icmp: prevent possible NULL dereferences from icmp_build_probe()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     icmp-prevent-possible-null-dereferences-from-icmp_bu.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 61a815e63670ad172fef07da2a19e8c09485798f
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Sat Apr 20 07:01:16 2024 +0000

    icmp: prevent possible NULL dereferences from icmp_build_probe()
    
    [ Upstream commit c58e88d49097bd12dfcfef4f075b43f5d5830941 ]
    
    First problem is a double call to __in_dev_get_rcu(), because
    the second one could return NULL.
    
    if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
    
    Second problem is a read from dev->ip6_ptr with no NULL check:
    
    if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))
    
    Use the correct RCU API to fix these.
    
    v2: add missing include <net/addrconf.h>
    
    Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Andreas Roeseler <andreas.a.roeseler@xxxxxxxxx>
    Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index b8607763d113a..3b221643206de 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -92,6 +92,7 @@
 #include <net/inet_common.h>
 #include <net/ip_fib.h>
 #include <net/l3mdev.h>
+#include <net/addrconf.h>
 
 /*
  *	Build xmit assembly blocks
@@ -1032,6 +1033,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 	struct icmp_ext_hdr *ext_hdr, _ext_hdr;
 	struct icmp_ext_echo_iio *iio, _iio;
 	struct net *net = dev_net(skb->dev);
+	struct inet6_dev *in6_dev;
+	struct in_device *in_dev;
 	struct net_device *dev;
 	char buff[IFNAMSIZ];
 	u16 ident_len;
@@ -1115,10 +1118,15 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 	/* Fill bits in reply message */
 	if (dev->flags & IFF_UP)
 		status |= ICMP_EXT_ECHOREPLY_ACTIVE;
-	if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
+
+	in_dev = __in_dev_get_rcu(dev);
+	if (in_dev && rcu_access_pointer(in_dev->ifa_list))
 		status |= ICMP_EXT_ECHOREPLY_IPV4;
-	if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list))
+
+	in6_dev = __in6_dev_get(dev);
+	if (in6_dev && !list_empty(&in6_dev->addr_list))
 		status |= ICMP_EXT_ECHOREPLY_IPV6;
+
 	dev_put(dev);
 	icmphdr->un.echo.sequence |= htons(status);
 	return true;