2 files changed, 8 insertions, 4 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 12ef531b64ec..878f8027ebf6 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -130,7 +130,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
         }
 
         rcu_read_lock_bh();
-        nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+        nexthop = rt6_nexthop((struct rt6_info *)dst);
         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
         if (unlikely(!neigh))
                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
@@ -898,7 +898,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          */
         rt = (struct rt6_info *) *dst;
         rcu_read_lock_bh();
-        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
+        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
         rcu_read_unlock_bh();
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index bacce6c08644..225de3ec8351 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -848,7 +848,6 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                         if (ort->rt6i_dst.plen != 128 &&
                             ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                 rt->rt6i_flags |= RTF_ANYCAST;
-                        rt->rt6i_gateway = *daddr;
                 }
 
                 rt->rt6i_flags |= RTF_CACHE;
@@ -1245,6 +1244,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         rt->dst.flags |= DST_HOST;
         rt->dst.output  = ip6_output;
         atomic_set(&rt->dst.__refcnt, 1);
+        rt->rt6i_gateway  = fl6->daddr;
         rt->rt6i_dst.addr = fl6->daddr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_idev     = idev;
@@ -1801,7 +1801,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                         in6_dev_hold(rt->rt6i_idev);
                 rt->dst.lastuse = jiffies;
 
-                rt->rt6i_gateway = ort->rt6i_gateway;
+                if (ort->rt6i_flags & RTF_GATEWAY)
+                        rt->rt6i_gateway = ort->rt6i_gateway;
+                else
+                        rt->rt6i_gateway = *dest;
                 rt->rt6i_flags = ort->rt6i_flags;
                 if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
                     (RTF_DEFAULT | RTF_ADDRCONF))
@@ -2088,6 +2091,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         else
                 rt->rt6i_flags |= RTF_LOCAL;
 
+        rt->rt6i_gateway  = *addr;
         rt->rt6i_dst.addr = *addr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);