1 files changed, 9 insertions, 5 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d3588885f097..c73ae5039e46 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2504,9 +2504,9 @@ static int ip6_route_multipath(struct fib6_config *cfg, int add)
         int attrlen;
         int err = 0, last_err = 0;
 
+        remaining = cfg->fc_mp_len;
 beginning:
         rtnh = (struct rtnexthop *)cfg->fc_mp;
-        remaining = cfg->fc_mp_len;
 
         /* Parse a Multipath Entry */
         while (rtnh_ok(rtnh, remaining)) {
@@ -2536,15 +2536,19 @@ beginning:
                                  * next hops that have been already added.
                                  */
                                 add = 0;
+                                remaining = cfg->fc_mp_len - remaining;
                                 goto beginning;
                         }
                 }
                 /* Because each route is added like a single route we remove
-                 * this flag after the first nexthop (if there is a collision,
-                 * we have already fail to add the first nexthop:
-                 * fib6_add_rt2node() has reject it).
+                 * these flags after the first nexthop: if there is a collision,
+                 * we have already failed to add the first nexthop:
+                 * fib6_add_rt2node() has rejected it; when replacing, old
+                 * nexthops have been replaced by first new, the rest should
+                 * be added to it.
                  */
-                cfg->fc_nlinfo.nlh->nlmsg_flags &= ~NLM_F_EXCL;
+                cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
+                                                     NLM_F_REPLACE);
                 rtnh = rtnh_next(rtnh, &remaining);
         }