1 files changed, 5 insertions, 3 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ea37741062a9..53b6a4192b16 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -981,9 +981,10 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
         struct flowi fl;
-        struct net *net = dev_net(skb->dst->dev);
+        struct net *net = dev_net(skb_dst(skb)->dev);
         struct sock *ctl_sk = net->ipv6.tcp_sk;
         unsigned int tot_len = sizeof(struct tcphdr);
+        struct dst_entry *dst;
         __be32 *topt;
 
         if (ts)
@@ -1052,8 +1053,9 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
          * Underlying function will use this to retrieve the network
          * namespace
          */
-        if (!ip6_dst_lookup(ctl_sk, &buff->dst, &fl)) {
-                if (xfrm_lookup(net, &buff->dst, &fl, NULL, 0) >= 0) {
+        if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
+                if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
+                        skb_dst_set(buff, dst);
                         ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
                         if (rst)