fl4->flowi4_flags |= FLOWI_FLAG_SKIP_NH_OIF;
        fl4->flowi4_iif = LOOPBACK_IFINDEX;
+       /* make sure oif is set to VRF device for lookup */
+       fl4->flowi4_oif = dev->ifindex;
        fl4->flowi4_tos = tos & IPTOS_RT_MASK;
        fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
                             RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
 
        unsigned int flags = 0;
        struct fib_result res;
        struct rtable *rth;
+       int master_idx;
        int orig_oif;
        int err = -ENETUNREACH;
 
 
        orig_oif = fl4->flowi4_oif;
 
+       master_idx = l3mdev_master_ifindex_by_index(net, fl4->flowi4_oif);
+       if (master_idx)
+               fl4->flowi4_oif = master_idx;
        fl4->flowi4_iif = LOOPBACK_IFINDEX;
        fl4->flowi4_tos = tos & IPTOS_RT_MASK;
        fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
 
        struct dst_entry *dst = NULL;
        struct net_device *dev;
 
-       dev = dev_get_by_index(net, fl6->flowi6_oif);
-       if (dev) {
-               if (netif_is_l3_master(dev) &&
+       if (fl6->flowi6_oif) {
+               rcu_read_lock();
+
+               dev = dev_get_by_index_rcu(net, fl6->flowi6_oif);
+               if (dev && netif_is_l3_slave(dev))
+                       dev = netdev_master_upper_dev_get_rcu(dev);
+
+               if (dev && netif_is_l3_master(dev) &&
                    dev->l3mdev_ops->l3mdev_get_rt6_dst)
                        dst = dev->l3mdev_ops->l3mdev_get_rt6_dst(dev, fl6);
-               dev_put(dev);
+
+               rcu_read_unlock();
        }
 
        return dst;
                rcu_read_lock();
 
                dev = dev_get_by_index_rcu(net, ifindex);
+               if (dev && netif_is_l3_slave(dev))
+                       dev = netdev_master_upper_dev_get_rcu(dev);
+
                if (dev && netif_is_l3_master(dev) &&
                    dev->l3mdev_ops->l3mdev_get_saddr)
                        rc = dev->l3mdev_ops->l3mdev_get_saddr(dev, fl4);