commit 9eb0db7e3ff347614cb1fac418c3b39e28ed33e4
Author: Florian Westphal <fw@strlen.de>
Date:   Tue Jul 28 13:15:43 2015 +0200

    ipv6: don't reject link-local local nexthop address on other interface

    48ed7b26faa7 ("ipv6: reject locally assigned nexthop addresses") is too
    strict; it rejects following corner-case:

    ip -6 route add default via fe80::12:34:56 dev eth1

    (where the nexthop link-local address is assigned to a different interface).

    We fix this by restricting search to given device if nh is linklocal.

    Joint work with Hannes Frederic Sowa.

    Fixes: 48ed7b26faa7 ("ipv6: reject locally assigned nexthop addresses")
    Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6090969..9de4d2b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1831,6 +1831,7 @@ int ip6_route_add(struct fib6_config *cfg)
                int gwa_type;

                gw_addr = &cfg->fc_gateway;
+               gwa_type = ipv6_addr_type(gw_addr);

                /* if gw_addr is local we will fail to detect this in case
                 * address is still TENTATIVE (DAD in progress). rt6_lookup()
@@ -1838,11 +1839,12 @@ int ip6_route_add(struct fib6_config *cfg)
                 * prefix route was assigned to, which might be non-loopback.
                 */
                err = -EINVAL;
-               if (ipv6_chk_addr_and_flags(net, gw_addr, NULL, 0, 0))
+               if (ipv6_chk_addr_and_flags(net, gw_addr,
+                                           gwa_type & IPV6_ADDR_LINKLOCAL ?
+                                           dev : NULL, 0, 0))
                        goto out;

                rt->rt6i_gateway = *gw_addr;
-               gwa_type = ipv6_addr_type(gw_addr);

                if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
                        struct rt6_info *grt;