1 files changed, 4 insertions, 1 deletions

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index d38cbba92a4d..e238b17f554c 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -514,7 +514,10 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
         saddr = iph->daddr;
         if (!(rt->rt_flags & RTCF_LOCAL)) {
-                if (sysctl_icmp_errors_use_inbound_ifaddr)
+                /* This is broken, skb_in->dev points to the outgoing device
+                 * after the packet passes through ip_output().
+                 */
+                if (skb_in->dev && sysctl_icmp_errors_use_inbound_ifaddr)
                         saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
                 else
                         saddr = 0;