diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 93578b2ec35fb55ca1f56c3e558661989568639e..49cd31dcff3957c982f1c1418945d5367305d4e4 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -2012,11 +2012,12 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
                if (rt->fib6_metric == leaf->fib6_metric &&
                    rt6_qualify_for_ecmp(leaf))
                        notify_del = true;
+               WRITE_ONCE(rt->fib6_nsiblings, 0);
                list_for_each_entry_safe(sibling, next_sibling,
-                                        &rt->fib6_siblings, fib6_siblings)
+                                        &rt->fib6_siblings, fib6_siblings) {
+                       list_del_rcu(&sibling->fib6_siblings);
                        sibling->fib6_nsiblings--;
-               rt->fib6_nsiblings = 0;
-               list_del_rcu(&rt->fib6_siblings);
+               }
                rt6_multipath_rebalance(next_sibling);
        }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 79c8f1acf8a35e465ab1a21aca50a554ca6f513b..58fce85223a29657777d3ea1f2a7a2ffb7f610b8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5346,7 +5346,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,
         */
        rcu_read_lock();
 
-       if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) {
+       if ((nlflags & NLM_F_APPEND) && rt_last &&
+           READ_ONCE(rt_last->fib6_nsiblings)) {
                rt = list_first_or_null_rcu(&rt_last->fib6_siblings,
                                            struct fib6_info,
                                            fib6_siblings);
@@ -5681,7 +5682,7 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i)
                struct fib6_info *sibling;
 
                nexthop_len = 0;
-               if (f6i->fib6_nsiblings) {
+               if (READ_ONCE(f6i->fib6_nsiblings)) {
                        rt6_nh_nlmsg_size(nh, &nexthop_len);
 
                        rcu_read_lock();
@@ -5854,7 +5855,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                if (dst->lwtstate &&
                    lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0)
                        goto nla_put_failure;
-       } else if (rt->fib6_nsiblings) {
+       } else if (READ_ONCE(rt->fib6_nsiblings)) {
                struct fib6_info *sibling;
                struct nlattr *mp;
 
@@ -5956,14 +5957,18 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i,
        if (f6i->fib6_nh->fib_nh_dev == dev)
                return true;
 
-       if (f6i->fib6_nsiblings) {
-               struct fib6_info *sibling, *next_sibling;
+       if (READ_ONCE(f6i->fib6_nsiblings)) {
+               const struct fib6_info *sibling;
 
-               list_for_each_entry_safe(sibling, next_sibling,
-                                        &f6i->fib6_siblings, fib6_siblings) {
-                       if (sibling->fib6_nh->fib_nh_dev == dev)
+               rcu_read_lock();
+               list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
+                                       fib6_siblings) {
+                       if (sibling->fib6_nh->fib_nh_dev == dev) {
+                               rcu_read_unlock();
                                return true;
+                       }
                }
+               rcu_read_unlock();
        }
 
        return false;
@@ -6321,8 +6326,9 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
 void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info,
                     unsigned int nlm_flags)
 {
-       struct sk_buff *skb;
        struct net *net = info->nl_net;
+       struct sk_buff *skb;
+       size_t sz;
        u32 seq;
        int err;
 
@@ -6330,17 +6336,21 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info,
        seq = info->nlh ? info->nlh->nlmsg_seq : 0;
 
        rcu_read_lock();
-
-       skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC);
+       sz = rt6_nlmsg_size(rt);
+retry:
+       skb = nlmsg_new(sz, GFP_ATOMIC);
        if (!skb)
                goto errout;
 
        err = rt6_fill_node(net, skb, rt, NULL, NULL, NULL, 0,
                            event, info->portid, seq, nlm_flags);
        if (err < 0) {
-               /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
-               WARN_ON(err == -EMSGSIZE);
                kfree_skb(skb);
+               /* -EMSGSIZE implies needed space grew under us. */
+               if (err == -EMSGSIZE) {
+                       sz = max(rt6_nlmsg_size(rt), sz << 1);
+                       goto retry;
+               }
                goto errout;
        }