1 files changed, 12 insertions, 5 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index bcc490cc9452..f769098774b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -80,6 +80,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/hash.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mutex.h>
 #include <linux/string.h>
@@ -1988,8 +1989,12 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                         if (dev->real_num_tx_queues > 1)
                                 queue_index = skb_tx_hash(dev, skb);
 
-                        if (sk && sk->sk_dst_cache)
-                                sk_tx_queue_set(sk, queue_index);
+                        if (sk) {
+                                struct dst_entry *dst = rcu_dereference_bh(sk->sk_dst_cache);
+
+                                if (dst && skb_dst(skb) == dst)
+                                        sk_tx_queue_set(sk, queue_index);
+                        }
                 }
         }
 
@@ -2483,6 +2488,7 @@ int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
+        struct net_device *master;
         struct net_device *null_or_orig;
         struct net_device *null_or_bond;
         int ret = NET_RX_DROP;
@@ -2503,11 +2509,12 @@ int netif_receive_skb(struct sk_buff *skb)
 
         null_or_orig = NULL;
         orig_dev = skb->dev;
-        if (orig_dev->master) {
-                if (skb_bond_should_drop(skb))
+        master = ACCESS_ONCE(orig_dev->master);
+        if (master) {
+                if (skb_bond_should_drop(skb, master))
                         null_or_orig = orig_dev; /* deliver only exact match */
                 else
-                        skb->dev = orig_dev->master;
+                        skb->dev = master;
         }
 
         __get_cpu_var(netdev_rx_stat).total++;