ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

Hello Yiqi Sun,

Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the following Smatch static checker warning:

	net/ipv4/icmp.c:1351 icmp_build_probe()
	warn: 'dev' is not an error pointer

net/ipv4/icmp.c

     1341 #if IS_ENABLED(CONFIG_IPV6)
     1342                 case ICMP_AFI_IP6:
     1343                         if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
     1344                                 goto send_mal_query;
     1345                         dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
     1346
     1347                         /*
     1348                          * If IPv6 identifier lookup is unavailable, silently
     1349                          * discard the request instead of misreporting NO_IF.
     1350                          */
--> 1351                         if (IS_ERR(dev))
     1352                                 return false;

It looks like there were two patches that went in around the same time. Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()") updated the checking for ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage and use direct function calls") changed it to not return error pointers.

This IS_ERR() check can be removed.

Quoted 31 lines · Dan Carpenter

Hello Yiqi Sun,

Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()") from Apr 2, 2026 (linux-next), leads to the following Smatch static checker warning:

    net/ipv4/icmp.c:1351 icmp_build_probe()
    warn: 'dev' is not an error pointer

net/ipv4/icmp.c
     1341 #if IS_ENABLED(CONFIG_IPV6)
     1342                 case ICMP_AFI_IP6:
     1343                         if (iio-

Quoted 1 line

ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))

     1344                                 goto send_mal_query; 1345                         dev = ipv6_dev_find(net, &iio-

Quoted 1 line

ident.addr.ip_addr.ipv6_addr, dev);

     1346
     1347                         /*
     1348                          * If IPv6 identifier lookup is unavailable, silently 1349                          * discard the request instead of misreporting NO_IF. 1350                          */
--> 1351                         if (IS_ERR(dev))
     1352                                 return false;

It looks like there were two patches that went in around the same time.  Commit fde29fd93493 ("ipv4: icmp: fix null-ptr-deref in icmp_build_probe()") updated the checking for ipv6_stub->ipv6_dev_find() but d98adfbdd5c0 ("ipv4: drop ipv6_stub usage and use direct function calls") changed it to not return error pointers.

Quoted 2 lines

This IS_ERR() check can be removed.

Yes, I thought it was going to happen during merging but I guess it makes sense to do it on a separate patch.