1 files changed, 9 insertions, 4 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index dae1949019d7..d5d20cde8d92 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -381,9 +381,8 @@ int ip6_forward(struct sk_buff *skb)
          *      cannot be fragmented, because there is no warranty
          *      that different fragments will go along one path. --ANK
          */
-        if (opt->ra) {
-                u8 *ptr = skb_network_header(skb) + opt->ra;
-                if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
+        if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
+                if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
                         return 0;
         }
 
@@ -822,11 +821,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                           const struct flowi6 *fl6)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct rt6_info *rt = (struct rt6_info *)dst;
+        struct rt6_info *rt;
 
         if (!dst)
                 goto out;
 
+        if (dst->ops->family != AF_INET6) {
+                dst_release(dst);
+                return NULL;
+        }
+
+        rt = (struct rt6_info *)dst;
         /* Yes, checking route validity in not connected
          * case is not very simple. Take into account,
          * that we do not support routing by source, TOS,