if (IS_ERR(rt))
                return PTR_ERR(rt);
 
+       rcu_read_lock();
+
        err = ip6_route_info_create_nh(rt, cfg, extack);
        if (err)
-               return err;
+               goto unlock;
 
        err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
        fib6_info_release(rt);
+unlock:
+       rcu_read_unlock();
 
        return err;
 }
 
        switch (cmd) {
        case SIOCADDRT:
-               rtnl_lock();
                /* Only do the default setting of fc_metric in route adding */
                if (cfg.fc_metric == 0)
                        cfg.fc_metric = IP6_RT_PRIO_USER;
                err = ip6_route_add(&cfg, GFP_KERNEL, NULL);
-               rtnl_unlock();
                break;
        case SIOCDELRT:
                err = ip6_route_del(&cfg, NULL);
        } while (rtnh_ok(rtnh, remaining));
 
        return lwtunnel_valid_encap_type_attr(cfg->fc_mp, cfg->fc_mp_len,
-                                             extack, newroute);
+                                             extack, false);
 }
 
 static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
                cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);
 
                err = lwtunnel_valid_encap_type(cfg->fc_encap_type,
-                                               extack, newroute);
+                                               extack, false);
                if (err < 0)
                        goto errout;
        }
        if (err)
                return err;
 
+       rcu_read_lock();
+
        err = ip6_route_mpath_info_create_nh(&rt6_nh_list, extack);
        if (err)
                goto cleanup;
        }
 
 cleanup:
+       rcu_read_unlock();
+
        list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, list) {
                fib6_info_release(nh->fib6_info);
                list_del(&nh->list);
 
 static const struct rtnl_msg_handler ip6_route_rtnl_msg_handlers[] __initconst_or_module = {
        {.owner = THIS_MODULE, .protocol = PF_INET6, .msgtype = RTM_NEWROUTE,
-        .doit = inet6_rtm_newroute},
+        .doit = inet6_rtm_newroute, .flags = RTNL_FLAG_DOIT_UNLOCKED},
        {.owner = THIS_MODULE, .protocol = PF_INET6, .msgtype = RTM_DELROUTE,
         .doit = inet6_rtm_delroute, .flags = RTNL_FLAG_DOIT_UNLOCKED},
        {.owner = THIS_MODULE, .protocol = PF_INET6, .msgtype = RTM_GETROUTE,