Subject: Re: [PATCH net v2] ipv4: icmp: validate reply type before using icmp_pointers

From: Simon Horman <[email-masked]>
Date: Thu, 23 Apr 2026 18:00:46 +0100

On Tue, Apr 21, 2026 at 12:16:31PM +0800, Ren Wei wrote:
> From: Ruide Cao <[email-masked]>
> 
> Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
> That value is outside the range covered by icmp_pointers[], which only
> describes the traditional ICMP types up to NR_ICMP_TYPES.
> 
> Avoid consulting icmp_pointers[] for reply types outside that range, and
> use array_index_nospec() for the remaining in-range lookup. Normal ICMP
> replies keep their existing behavior unchanged.
> 
> Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
> Cc: [email-masked]
> Reported-by: Yuan Tan <[email-masked]>
> Reported-by: Yifan Wu <[email-masked]>
> Reported-by: Juefei Pu <[email-masked]>
> Reported-by: Xin Liu <[email-masked]>
> Signed-off-by: Ruide Cao <[email-masked]>
> Signed-off-by: Ren Wei <[email-masked]>
> ---
> changes in v2:
> use array_index_nospec()
> v1 link: https://lore.kernel.org/all/efb[email-masked]/

Reviewed-by: Simon Horman <[email-masked]>

Sashiko has generated a review of this patch.  I do not believe the
problems flagged there need to be addressed as the array indexes used in
those cases have are always valid.  However, I would appreciate it if you
could look over this.