2 files changed, 9 insertions, 4 deletions

diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 60aba45023ff..77bfdfeb966e 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -260,7 +260,10 @@ struct ip_vs_conn *ip_vs_ct_in_get
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (cp->af == af &&
                     ip_vs_addr_equal(af, s_addr, &cp->caddr) &&
-                    ip_vs_addr_equal(af, d_addr, &cp->vaddr) &&
+                    /* protocol should only be IPPROTO_IP if
+                     * d_addr is a fwmark */
+                    ip_vs_addr_equal(protocol == IPPROTO_IP ? AF_UNSPEC : af,
+                                     d_addr, &cp->vaddr) &&
                     s_port == cp->cport && d_port == cp->vport &&
                     cp->flags & IP_VS_CONN_F_TEMPLATE &&
                     protocol == cp->protocol) {
@@ -698,7 +701,9 @@ ip_vs_conn_new(int af, int proto, const union nf_inet_addr *caddr, __be16 cport,
         cp->cport          = cport;
         ip_vs_addr_copy(af, &cp->vaddr, vaddr);
         cp->vport          = vport;
-        ip_vs_addr_copy(af, &cp->daddr, daddr);
+        /* proto should only be IPPROTO_IP if d_addr is a fwmark */
+        ip_vs_addr_copy(proto == IPPROTO_IP ? AF_UNSPEC : af,
+                        &cp->daddr, daddr);
         cp->dport          = dport;
         cp->flags          = flags;
         spin_lock_init(&cp->lock);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index cb3e031335eb..8dddb17a947a 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -278,7 +278,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  */
                 if (svc->fwmark) {
                         union nf_inet_addr fwmark = {
-                                .all = { 0, 0, 0, htonl(svc->fwmark) }
+                                .ip = htonl(svc->fwmark)
                         };
 
                         ct = ip_vs_ct_in_get(svc->af, IPPROTO_IP, &snet, 0,
@@ -306,7 +306,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                          */
                         if (svc->fwmark) {
                                 union nf_inet_addr fwmark = {
-                                        .all = { 0, 0, 0, htonl(svc->fwmark) }
+                                        .ip = htonl(svc->fwmark)
                                 };
 
                                 ct = ip_vs_conn_new(svc->af, IPPROTO_IP,