2 files changed, 3 insertions, 2 deletions

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 5383b33db8ca..a4051afaf776 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -635,7 +635,7 @@ static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                                         struct sk_buff *skb)
 {
         if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
-                ipv6_copy_dscp(ipv6h, ipv6_hdr(skb));
+                ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
 
         if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
                 IP6_ECN_set_ce(ipv6_hdr(skb));
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index fd84e2217274..9a43ea722481 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -95,7 +95,8 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         nh = skb_network_header(skb);
         if (nh[IP6CB(skb)->nhoff] == IPPROTO_IPV6) {
                 if (x->props.flags & XFRM_STATE_DECAP_DSCP)
-                        ipv6_copy_dscp(ipv6_hdr(skb), ipipv6_hdr(skb));
+                        ipv6_copy_dscp(ipv6_get_dsfield(ipv6_hdr(skb)),
+                                       ipipv6_hdr(skb));
                 if (!(x->props.flags & XFRM_STATE_NOECN))
                         ipip6_ecn_decapsulate(skb);
         } else {