From: David Ahern <redacted>
Date: Sun, 27 Nov 2016 18:52:53 -0800

Andrey reported the following while fuzzing the kernel with syzkaller:

 ...

icmp6_send / icmpv6_send is invoked for both rx and tx paths. In both
cases the dst->dev should be preferred for determining the L3 domain
if the dst has been set on the skb. Fallback to the skb->dev if it has
not. This covers the case reported here where icmp6_send is invoked on
Rx before the route lookup.

Fixes: 5d41ce29e ("net: icmp6_send should use dst dev to determine L3 domain")
Reported-by: Andrey Konovalov <redacted>
Signed-off-by: David Ahern <redacted>

Applied, thanks David.