Commit 614aefe56af8 for kernel

commit 614aefe56af8e13331e50220c936fc0689cf5675
Author: Weiming Shi <bestswngs@gmail.com>
Date:   Wed Mar 18 21:06:01 2026 +0800

    icmp: fix NULL pointer dereference in icmp_tag_validation()

    icmp_tag_validation() unconditionally dereferences the result of
    rcu_dereference(inet_protos[proto]) without checking for NULL.
    The inet_protos[] array is sparse -- only about 15 of 256 protocol
    numbers have registered handlers. When ip_no_pmtu_disc is set to 3
    (hardened PMTU mode) and the kernel receives an ICMP Fragmentation
    Needed error with a quoted inner IP header containing an unregistered
    protocol number, the NULL dereference causes a kernel panic in
    softirq context.

     Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
     KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
     RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)
     Call Trace:
      <IRQ>
      icmp_rcv (net/ipv4/icmp.c:1527)
      ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)
      ip_local_deliver_finish (net/ipv4/ip_input.c:242)
      ip_local_deliver (net/ipv4/ip_input.c:262)
      ip_rcv (net/ipv4/ip_input.c:573)
      __netif_receive_skb_one_core (net/core/dev.c:6164)
      process_backlog (net/core/dev.c:6628)
      handle_softirqs (kernel/softirq.c:561)
      </IRQ>

    Add a NULL check before accessing icmp_strict_tag_validation. If the
    protocol has no registered handler, return false since it cannot
    perform strict tag validation.

    Fixes: 8ed1dc44d3e9 ("ipv4: introduce hardened ip_no_pmtu_disc mode")
    Reported-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Weiming Shi <bestswngs@gmail.com>
    Link: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a62b4c4033cc..568bd1e95d44 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1079,10 +1079,12 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)

 static bool icmp_tag_validation(int proto)
 {
+	const struct net_protocol *ipprot;
 	bool ok;

 	rcu_read_lock();
-	ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+	ipprot = rcu_dereference(inet_protos[proto]);
+	ok = ipprot ? ipprot->icmp_strict_tag_validation : false;
 	rcu_read_unlock();
 	return ok;
 }