diff -ur v2.6.9-rc2-bk10/linux/net/ipv4/fib_hash.c linux/net/ipv4/fib_hash.c
--- v2.6.9-rc2-bk10/linux/net/ipv4/fib_hash.c	2004-09-26 16:52:11.000000000 +0300
+++ linux/net/ipv4/fib_hash.c	2004-09-26 16:52:32.790070008 +0300
@@ -438,17 +438,15 @@
 {
 	if (fn) {
 		struct list_head *head = &fn->fn_alias;
-		struct fib_alias *fa, *prev_fa;
+		struct fib_alias *fa;
 
-		prev_fa = NULL;
 		list_for_each_entry(fa, head, fa_list) {
-			if (fa->fa_tos != tos)
+			if (fa->fa_tos > tos)
 				continue;
-			prev_fa = fa;
-			if (prio <= fa->fa_info->fib_priority)
-				break;
+			if (fa->fa_info->fib_priority >= prio ||
+			    fa->fa_tos < tos)
+				return fa;
 		}
-		return prev_fa;
 	}
 	return NULL;
 }
@@ -505,7 +503,7 @@
 	 * and we need to allocate a new one of those as well.
 	 */
 
-	if (fa &&
+	if (fa && fa->fa_tos == tos &&
 	    fa->fa_info->fib_priority == fi->fib_priority) {
 		struct fib_alias *fa_orig;
 
@@ -586,7 +584,7 @@
 	write_lock_bh(&fib_hash_lock);
 	if (new_f)
 		fib_insert_node(fz, new_f);
-	list_add(&new_fa->fa_list,
+	list_add_tail(&new_fa->fa_list,
 		 (fa ? &fa->fa_list : &f->fn_alias));
 	write_unlock_bh(&fib_hash_lock);