2 files changed, 12 insertions, 14 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 349fae58c1a3..913266cd9902 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -825,7 +825,7 @@ int ip_append_data(struct sock *sk,
                 inet->cork.fragsize = mtu = inet->pmtudisc == IP_PMTUDISC_PROBE ?
                                             rt->u.dst.dev->mtu :
                                             dst_mtu(rt->u.dst.path);
-                inet->cork.rt = rt;
+                inet->cork.dst = &rt->u.dst;
                 inet->cork.length = 0;
                 sk->sk_sndmsg_page = NULL;
                 sk->sk_sndmsg_off = 0;
@@ -834,7 +834,7 @@ int ip_append_data(struct sock *sk,
                         transhdrlen += exthdrlen;
                 }
         } else {
-                rt = inet->cork.rt;
+                rt = (struct rtable *)inet->cork.dst;
                 if (inet->cork.flags & IPCORK_OPT)
                         opt = inet->cork.opt;
 
@@ -1083,7 +1083,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         if (skb_queue_empty(&sk->sk_write_queue))
                 return -EINVAL;
 
-        rt = inet->cork.rt;
+        rt = (struct rtable *)inet->cork.dst;
         if (inet->cork.flags & IPCORK_OPT)
                 opt = inet->cork.opt;
 
@@ -1208,10 +1208,8 @@ static void ip_cork_release(struct inet_sock *inet)
         inet->cork.flags &= ~IPCORK_OPT;
         kfree(inet->cork.opt);
         inet->cork.opt = NULL;
-        if (inet->cork.rt) {
-                ip_rt_put(inet->cork.rt);
-                inet->cork.rt = NULL;
-        }
+        dst_release(inet->cork.dst);
+        inet->cork.dst = NULL;
 }
 
 /*
@@ -1224,7 +1222,7 @@ int ip_push_pending_frames(struct sock *sk)
         struct sk_buff **tail_skb;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_options *opt = NULL;
-        struct rtable *rt = inet->cork.rt;
+        struct rtable *rt = (struct rtable *)inet->cork.dst;
         struct iphdr *iph;
         __be16 df = 0;
         __u8 ttl;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 98762fde2b65..ed6482667a25 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1115,7 +1115,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                         /* need source address above miyazawa*/
                 }
                 dst_hold(&rt->u.dst);
-                np->cork.rt = rt;
+                inet->cork.dst = &rt->u.dst;
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
@@ -1136,7 +1136,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
         } else {
-                rt = np->cork.rt;
+                rt = (struct rt6_info *)inet->cork.dst;
                 fl = &inet->cork.fl;
                 if (inet->cork.flags & IPCORK_OPT)
                         opt = np->cork.opt;
@@ -1381,9 +1381,9 @@ static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
         inet->cork.flags &= ~IPCORK_OPT;
         kfree(np->cork.opt);
         np->cork.opt = NULL;
-        if (np->cork.rt) {
-                dst_release(&np->cork.rt->u.dst);
-                np->cork.rt = NULL;
+        if (inet->cork.dst) {
+                dst_release(inet->cork.dst);
+                inet->cork.dst = NULL;
                 inet->cork.flags &= ~IPCORK_ALLFRAG;
         }
         memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
@@ -1398,7 +1398,7 @@ int ip6_push_pending_frames(struct sock *sk)
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct ipv6hdr *hdr;
         struct ipv6_txoptions *opt = np->cork.opt;
-        struct rt6_info *rt = np->cork.rt;
+        struct rt6_info *rt = (struct rt6_info *)inet->cork.dst;
         struct flowi *fl = &inet->cork.fl;
         unsigned char proto = fl->proto;
         int err = 0;