lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
                        if (atomic_read(&rt->dst.__refcnt) > 1 ||
                            (now - rt->dst.lastuse) < expire) {
-                               rtp = &rt->dst.dn_next;
+                               rtp = &rt->dn_next;
                                continue;
                        }
-                       *rtp = rt->dst.dn_next;
-                       rt->dst.dn_next = NULL;
+                       *rtp = rt->dn_next;
+                       rt->dn_next = NULL;
                        dst_dev_put(&rt->dst);
                        dst_release(&rt->dst);
                }
                                                lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
                        if (atomic_read(&rt->dst.__refcnt) > 1 ||
                            (now - rt->dst.lastuse) < expire) {
-                               rtp = &rt->dst.dn_next;
+                               rtp = &rt->dn_next;
                                continue;
                        }
-                       *rtp = rt->dst.dn_next;
-                       rt->dst.dn_next = NULL;
+                       *rtp = rt->dn_next;
+                       rt->dn_next = NULL;
                        dst_dev_put(&rt->dst);
                        dst_release(&rt->dst);
                        break;
                                                lockdep_is_held(&dn_rt_hash_table[hash].lock))) != NULL) {
                if (compare_keys(&rth->fld, &rt->fld)) {
                        /* Put it first */
-                       *rthp = rth->dst.dn_next;
-                       rcu_assign_pointer(rth->dst.dn_next,
+                       *rthp = rth->dn_next;
+                       rcu_assign_pointer(rth->dn_next,
                                           dn_rt_hash_table[hash].chain);
                        rcu_assign_pointer(dn_rt_hash_table[hash].chain, rth);
 
                        *rp = rth;
                        return 0;
                }
-               rthp = &rth->dst.dn_next;
+               rthp = &rth->dn_next;
        }
 
-       rcu_assign_pointer(rt->dst.dn_next, dn_rt_hash_table[hash].chain);
+       rcu_assign_pointer(rt->dn_next, dn_rt_hash_table[hash].chain);
        rcu_assign_pointer(dn_rt_hash_table[hash].chain, rt);
 
        dst_hold_and_use(&rt->dst, now);
                        goto nothing_to_declare;
 
                for(; rt; rt = next) {
-                       next = rcu_dereference_raw(rt->dst.dn_next);
-                       RCU_INIT_POINTER(rt->dst.dn_next, NULL);
+                       next = rcu_dereference_raw(rt->dn_next);
+                       RCU_INIT_POINTER(rt->dn_next, NULL);
                        dst_dev_put(&rt->dst);
                        dst_release(&rt->dst);
                }
        if (rt == NULL)
                goto e_nobufs;
 
+       rt->dn_next = NULL;
        memset(&rt->fld, 0, sizeof(rt->fld));
        rt->fld.saddr        = oldflp->saddr;
        rt->fld.daddr        = oldflp->daddr;
        if (!(flags & MSG_TRYHARD)) {
                rcu_read_lock_bh();
                for (rt = rcu_dereference_bh(dn_rt_hash_table[hash].chain); rt;
-                       rt = rcu_dereference_bh(rt->dst.dn_next)) {
+                       rt = rcu_dereference_bh(rt->dn_next)) {
                        if ((flp->daddr == rt->fld.daddr) &&
                            (flp->saddr == rt->fld.saddr) &&
                            (flp->flowidn_mark == rt->fld.flowidn_mark) &&
        if (rt == NULL)
                goto e_nobufs;
 
+       rt->dn_next = NULL;
        memset(&rt->fld, 0, sizeof(rt->fld));
        rt->rt_saddr      = fld.saddr;
        rt->rt_daddr      = fld.daddr;
 
        rcu_read_lock();
        for(rt = rcu_dereference(dn_rt_hash_table[hash].chain); rt != NULL;
-           rt = rcu_dereference(rt->dst.dn_next)) {
+           rt = rcu_dereference(rt->dn_next)) {
                if ((rt->fld.saddr == cb->src) &&
                    (rt->fld.daddr == cb->dst) &&
                    (rt->fld.flowidn_oif == 0) &&
                rcu_read_lock_bh();
                for(rt = rcu_dereference_bh(dn_rt_hash_table[h].chain), idx = 0;
                        rt;
-                       rt = rcu_dereference_bh(rt->dst.dn_next), idx++) {
+                       rt = rcu_dereference_bh(rt->dn_next), idx++) {
                        if (idx < s_idx)
                                continue;
                        skb_dst_set(skb, dst_clone(&rt->dst));
 {
        struct dn_rt_cache_iter_state *s = seq->private;
 
-       rt = rcu_dereference_bh(rt->dst.dn_next);
+       rt = rcu_dereference_bh(rt->dn_next);
        while (!rt) {
                rcu_read_unlock_bh();
                if (--s->bucket < 0)