1 files changed, 3 insertions, 3 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e1374ab034bb..0bc95f3977d2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1466,7 +1466,7 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
  *      structure to pass arguments.
  */
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
-                   struct ip_reply_arg *arg, unsigned int len)
+                   const struct ip_reply_arg *arg, unsigned int len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ip_options_data replyopts;
@@ -1489,7 +1489,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
         }
 
         flowi4_init_output(&fl4, arg->bound_dev_if, 0,
-                           RT_TOS(ip_hdr(skb)->tos),
+                           RT_TOS(arg->tos),
                            RT_SCOPE_UNIVERSE, sk->sk_protocol,
                            ip_reply_arg_flowi_flags(arg),
                            daddr, rt->rt_spec_dst,
@@ -1506,7 +1506,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
            with locally disabled BH and that sk cannot be already spinlocked.
          */
         bh_lock_sock(sk);
-        inet->tos = ip_hdr(skb)->tos;
+        inet->tos = arg->tos;
         sk->sk_priority = skb->priority;
         sk->sk_protocol = ip_hdr(skb)->protocol;
         sk->sk_bound_dev_if = arg->bound_dev_if;