[PATCH RFC net] icmp: skip IPv6 probe lookup when IPv6 is disabled

[Slavin Liu]

With CONFIG_IPV6=y and ipv6.disable=1, inet6_init() skips address
configuration, leaving inet6_addr_lst unallocated. An enabled IPv4
extended-echo probe can still request an IPv6 address lookup.

Check ipv6_mod_enabled() before the lookup so the existing no-interface
reply handles this case. This fixes the new lookup-internal NULL access;
it is not a patch for the removed IPv6 stub ERR_PTR sink.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: d98adfbdd5c0 ("ipv4: drop ipv6_stub usage and use direct function calls")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
---
 net/ipv4/icmp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 0caedfc7ca92..d8683b0151b7 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1360,6 +1360,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr)
 		case ICMP_AFI_IP6:
 			if (iio->ident.addr.ctype3_hdr.addrlen != sizeof(struct in6_addr))
 				goto send_mal_query;
+			if (!ipv6_mod_enabled())
+				break;
 			dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
 			dev_hold(dev);
 			break;