2 files changed, 8 insertions, 4 deletions

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 0a37ddc7af51..0013cacf7164 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
+        else
+                iif = l3mdev_master_ifindex(skb->dev);
 
         /*
          *      Must not send error if the source does not uniquely
@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         else if (!fl6.flowi6_oif)
                 fl6.flowi6_oif = np->ucast_oif;
 
-        if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
-
         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
         if (IS_ERR(dst))
                 goto out;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 711d209f9124..f443c6b0ce16 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -810,8 +810,13 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
         fl6.flowi6_proto = IPPROTO_TCP;
         if (rt6_need_strict(&fl6.daddr) && !oif)
                 fl6.flowi6_oif = tcp_v6_iif(skb);
-        else
+        else {
+                if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                        oif = skb->skb_iif;
+
                 fl6.flowi6_oif = oif;
+        }
+
         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
         fl6.fl6_dport = t1->dest;
         fl6.fl6_sport = t1->source;