{
        struct inet_sock *inet = inet_sk(sk);
        struct udp_sock *up = udp_sk(sk);
+       struct flowi4 fl4_stack;
        struct flowi4 *fl4;
        int ulen = len;
        struct ipcm_cookie ipc;
        if (connected)
                rt = (struct rtable *)sk_dst_check(sk, 0);
 
+       fl4 = &inet->cork.fl.u.ip4;
        if (rt == NULL) {
-               struct flowi4 fl4;
                struct net *net = sock_net(sk);
 
-               flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+               fl4 = &fl4_stack;
+               flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
                                   faddr, saddr, dport, inet->inet_sport);
 
-               security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
-               rt = ip_route_output_flow(net, &fl4, sk);
+               security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
+               rt = ip_route_output_flow(net, fl4, sk);
                if (IS_ERR(rt)) {
                        err = PTR_ERR(rt);
                        rt = NULL;
                goto do_confirm;
 back_from_confirm:
 
-       saddr = rt->rt_src;
+       saddr = fl4->saddr;
        if (!ipc.addr)
-               daddr = ipc.addr = rt->rt_dst;
+               daddr = ipc.addr = fl4->daddr;
 
        /* Lockless fast path for the non-corking case. */
        if (!corkreq) {