1 files changed, 8 insertions, 6 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 544f435d1aff..ba9f137f5aa7 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -791,6 +791,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 {
         struct inet_sock *inet = inet_sk(sk);
         struct udp_sock *up = udp_sk(sk);
+        struct flowi4 fl4_stack;
         struct flowi4 *fl4;
         int ulen = len;
         struct ipcm_cookie ipc;
@@ -919,17 +920,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (connected)
                 rt = (struct rtable *)sk_dst_check(sk, 0);
 
+        fl4 = &inet->cork.fl.u.ip4;
         if (rt == NULL) {
-                struct flowi4 fl4;
                 struct net *net = sock_net(sk);
 
-                flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+                fl4 = &fl4_stack;
+                flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                    RT_SCOPE_UNIVERSE, sk->sk_protocol,
                                    inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
                                    faddr, saddr, dport, inet->inet_sport);
 
-                security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-                rt = ip_route_output_flow(net, &fl4, sk);
+                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+                rt = ip_route_output_flow(net, fl4, sk);
                 if (IS_ERR(rt)) {
                         err = PTR_ERR(rt);
                         rt = NULL;
@@ -950,9 +952,9 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 goto do_confirm;
 back_from_confirm:
 
-        saddr = rt->rt_src;
+        saddr = fl4->saddr;
         if (!ipc.addr)
-                daddr = ipc.addr = rt->rt_dst;
+                daddr = ipc.addr = fl4->daddr;
 
         /* Lockless fast path for the non-corking case. */
         if (!corkreq) {