1 files changed, 9 insertions, 5 deletions

diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index b6c73da5ff35..a7db762de14a 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -225,16 +225,20 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                                          struct ip6_flowlabel * fl,
                                          struct ipv6_txoptions * fopt)
 {
-        struct ipv6_txoptions * fl_opt = fl->opt;
+        struct ipv6_txoptions * fl_opt = fl ? fl->opt : NULL;
 
-        if (fopt == NULL || fopt->opt_flen == 0)
-                return fl_opt;
+        if (fopt == NULL || fopt->opt_flen == 0) {
+                if (!fl_opt || !fl_opt->dst0opt || fl_opt->srcrt)
+                        return fl_opt;
+        }
 
         if (fl_opt != NULL) {
                 opt_space->hopopt = fl_opt->hopopt;
-                opt_space->dst0opt = fl_opt->dst0opt;
+                opt_space->dst0opt = fl_opt->srcrt ? fl_opt->dst0opt : NULL;
                 opt_space->srcrt = fl_opt->srcrt;
                 opt_space->opt_nflen = fl_opt->opt_nflen;
+                if (fl_opt->dst0opt && !fl_opt->srcrt)
+                        opt_space->opt_nflen -= ipv6_optlen(fl_opt->dst0opt);
         } else {
                 if (fopt->opt_nflen == 0)
                         return fopt;
@@ -310,7 +314,7 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
                 msg.msg_control = (void*)(fl->opt+1);
                 flowi.oif = 0;
 
-                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk);
+                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;