2 files changed, 12 insertions, 7 deletions

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index da43038ae18e..02730ef26b0f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -581,7 +581,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         fl.fl4_dst = eiph->saddr;
         fl.fl4_tos = RT_TOS(eiph->tos);
         fl.proto = IPPROTO_IPIP;
-        if (ip_route_output_key(dev_net(skb->dev), &rt, &fl))
+        rt = ip_route_output_key(dev_net(skb->dev), &fl);
+        if (IS_ERR(rt))
                 goto out;
 
         skb2->dev = rt->dst.dev;
@@ -593,12 +594,14 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 fl.fl4_dst = eiph->daddr;
                 fl.fl4_src = eiph->saddr;
                 fl.fl4_tos = eiph->tos;
-                if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
+                rt = ip_route_output_key(dev_net(skb->dev), &fl);
+                if (IS_ERR(rt) ||
                     rt->dst.dev->type != ARPHRD_TUNNEL) {
-                        ip_rt_put(rt);
+                        if (!IS_ERR(rt))
+                                ip_rt_put(rt);
                         goto out;
                 }
-                skb_dst_set(skb2, (struct dst_entry *)rt);
+                skb_dst_set(skb2, &rt->dst);
         } else {
                 ip_rt_put(rt);
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b1599a345c10..b8c8adbd7cf6 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -738,7 +738,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                     .fl4_tos = RT_TOS(tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
-                if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                rt = ip_route_output_key(dev_net(dev), &fl);
+                if (IS_ERR(rt)) {
                         dev->stats.tx_carrier_errors++;
                         goto tx_error_icmp;
                 }
@@ -862,8 +863,9 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
                                     .fl4_tos = RT_TOS(iph->tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
-                struct rtable *rt;
-                if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                struct rtable *rt = ip_route_output_key(dev_net(dev), &fl);
+
+                if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
                         ip_rt_put(rt);
                 }