diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 0404aa5fa7cbb91a008b75a5ce3ff2f1b563d00e..0a0a22a0666df2edd76e053ad24ccc99bf85e2f9 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -536,8 +536,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
 			fp = &b->ht[h];
 			for (pfp = rtnl_dereference(*fp); pfp;
 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
-				if (pfp == f) {
-					*fp = f->next;
+				if (pfp == fold) {
+					rcu_assign_pointer(*fp, fold->next);
 					break;
 				}
 			}