Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits) [IPV6]: Consolidate the ip6_pol_route_(input|output) pair [TCP]: Make snd_cwnd_cnt 32-bit [TCP]: Update the /proc/net/tcp documentation [NETNS]: Don't panic on creating the namespace's loopback [NEIGH]: Ensure that pneigh_lookup is protected with RTNL [INET]: kmalloc+memset -> kzalloc in frag_alloc_queue [ISDN]: Fix compile with CONFIG_ISDN_X25 disabled. [IPV6]: Replace sk_buff ** with sk_buff * in input handlers [SELINUX]: Update for netfilter ->hook() arg changes. [INET]: Consolidate the xxx_put [INET]: Small cleanup for xxx_put after evictor consolidation [INET]: Consolidate the xxx_evictor [INET]: Consolidate the xxx_frag_destroy [INET]: Consolidate xxx_the secret_rebuild [INET]: Consolidate the xxx_frag_kill [INET]: Collect common frag sysctl variables together [INET]: Collect frag queues management objects together [INET]: Move common fields from frag_queues in one place. [TG3]: Fix performance regression on 5705. [ISDN]: Remove local copy of device name to make sure renames work. ...
author: Linus Torvalds <torvalds@woody.linux-foundation.org> 2007-10-15 17:06:58 -0400
committer: Linus Torvalds <torvalds@woody.linux-foundation.org> 2007-10-15 17:06:58 -0400
commit: a52cefc80fc92981592c688d1c8067442afe4cec (patch)
tree: ad119b5a4f5e4a257779c0ef324b5c9354c915f1
parent: fba956c46a72f9e7503fd464ffee43c632307e31 (diff)
parent: 4acad72ded8e3f0211bd2a762e23c28229c61a51 (diff)
165 files changed, 2019 insertions, 2255 deletions
diff --git a/Documentation/networking/proc_net_tcp.txt b/Documentation/networking/proc_net_tcp.txt
index 5e21f7cb6383..4a79209e77a7 100644
--- a/Documentation/networking/proc_net_tcp.txt
+++ b/Documentation/networking/proc_net_tcp.txt
@@ -1,8 +1,9 @@
 This document describes the interfaces /proc/net/tcp and /proc/net/tcp6.
+Note that these interfaces are deprecated in favor of tcp_diag.
 These /proc interfaces provide information about currently active TCP 
-connections, and are implemented by tcp_get_info() in net/ipv4/tcp_ipv4.c and
+connections, and are implemented by tcp4_seq_show() in net/ipv4/tcp_ipv4.c
-tcp6_get_info() in net/ipv6/tcp_ipv6.c, respectively.
+and tcp6_seq_show() in net/ipv6/tcp_ipv6.c, respectively.
 It will first list all listening TCP sockets, and next list all established
 TCP connections. A typical entry of /proc/net/tcp would look like this (split 
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 7c9cb7e19f2e..b39d1f5b378e 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -328,7 +328,7 @@ isdn_net_autohup(void)
                        l->cps = (l->transcount * HZ) / (jiffies - last_jiffies);
                l->transcount = 0;
                if (dev->net_verbose > 3)
-                        printk(KERN_DEBUG "%s: %d bogocps\n", l->name, l->cps);
+                        printk(KERN_DEBUG "%s: %d bogocps\n", p->dev->name, l->cps);
                if ((l->flags & ISDN_NET_CONNECTED) && (!l->dialstate)) {
                        anymore = 1;
                        l->huptimer++;
@@ -350,12 +350,12 @@ isdn_net_autohup(void)
                                        if (l->hupflags & ISDN_CHARGEHUP) {
                                                if (l->hupflags & ISDN_WAITCHARGE) {
                                                        printk(KERN_DEBUG "isdn_net: Hupflags of %s are %X\n",
-                                                               l->name, l->hupflags);
+                                                               p->dev->name, l->hupflags);
                                                        isdn_net_hangup(p->dev);
                                                } else if (time_after(jiffies, l->chargetime + l->chargeint)) {
                                                        printk(KERN_DEBUG
                                                               "isdn_net: %s: chtime = %lu, chint = %d\n",
-                                                               l->name, l->chargetime, l->chargeint);
+                                                               p->dev->name, l->chargetime, l->chargeint);
                                                        isdn_net_hangup(p->dev);
                                                }
                                        } else
@@ -442,8 +442,8 @@ isdn_net_stat_callback(int idx, isdn_ctrl *c)
 #endif
                                        isdn_net_lp_disconnected(lp);
                                        isdn_all_eaz(lp->isdn_device, lp->isdn_channel);
-                                        printk(KERN_INFO "%s: remote hangup\n", lp->name);
+                                        printk(KERN_INFO "%s: remote hangup\n", p->dev->name);
-                                        printk(KERN_INFO "%s: Chargesum is %d\n", lp->name,
+                                        printk(KERN_INFO "%s: Chargesum is %d\n", p->dev->name,
                                               lp->charge);
                                        isdn_net_unbind_channel(lp);
                                        return 1;
@@ -487,7 +487,7 @@ isdn_net_stat_callback(int idx, isdn_ctrl *c)
                                                                isdn_net_add_to_bundle(nd, lp);
                                                        }
                                                }
-                                                printk(KERN_INFO "isdn_net: %s connected\n", lp->name);
+                                                printk(KERN_INFO "isdn_net: %s connected\n", p->dev->name);
                                                /* If first Chargeinfo comes before B-Channel connect,
                                                 * we correct the timestamp here.
                                                 */
@@ -534,7 +534,7 @@ isdn_net_stat_callback(int idx, isdn_ctrl *c)
                                        lp->hupflags |= ISDN_HAVECHARGE;
                                lp->chargetime = jiffies;
                                printk(KERN_DEBUG "isdn_net: Got CINF chargetime of %s now %lu\n",
-                                       lp->name, lp->chargetime);
+                                       p->dev->name, lp->chargetime);
                                return 1;
                }
        }
@@ -565,7 +565,7 @@ isdn_net_dial(void)
 #ifdef ISDN_DEBUG_NET_DIAL
                if (lp->dialstate)
-                        printk(KERN_DEBUG "%s: dialstate=%d\n", lp->name, lp->dialstate);
+                        printk(KERN_DEBUG "%s: dialstate=%d\n", p->dev->name, lp->dialstate);
 #endif
                switch (lp->dialstate) {
                        case 0:
@@ -578,7 +578,7 @@ isdn_net_dial(void)
                                lp->dial = lp->phone[1];
                                if (!lp->dial) {
                                        printk(KERN_WARNING "%s: phone number deleted?\n",
-                                               lp->name);
+                                               p->dev->name);
                                        isdn_net_hangup(p->dev);
                                        break;
                                }
@@ -632,13 +632,13 @@ isdn_net_dial(void)
                                cmd.arg = lp->isdn_channel;
                                if (!lp->dial) {
                                        printk(KERN_WARNING "%s: phone number deleted?\n",
-                                               lp->name);
+                                               p->dev->name);
                                        isdn_net_hangup(p->dev);
                                        break;
                                }
                                if (!strncmp(lp->dial->num, "LEASED", strlen("LEASED"))) {
                                        lp->dialstate = 4;
-                                        printk(KERN_INFO "%s: Open leased line ...\n", lp->name);
+                                        printk(KERN_INFO "%s: Open leased line ...\n", p->dev->name);
                                } else {
                                        if(lp->dialtimeout > 0)
                                                if (time_after(jiffies, lp->dialstarted + lp->dialtimeout)) {
@@ -688,7 +688,7 @@ isdn_net_dial(void)
                                                dev->usage[i] |= ISDN_USAGE_OUTGOING;
                                                isdn_info_update();
                                        }
-                                        printk(KERN_INFO "%s: dialing %d %s... %s\n", lp->name,
+                                        printk(KERN_INFO "%s: dialing %d %s... %s\n", p->dev->name,
                                               lp->dialretry, cmd.parm.setup.phone,
                                               (cmd.parm.setup.si1 == 1) ? "DOV" : "");
                                        lp->dtimer = 0;
@@ -797,7 +797,7 @@ isdn_net_dial(void)
                                 */
                                if (lp->dtimer++ > lp->cbdelay)
                                {
-                                        printk(KERN_INFO "%s: hangup waiting for callback ...\n", lp->name);
+                                        printk(KERN_INFO "%s: hangup waiting for callback ...\n", p->dev->name);
                                        lp->dtimer = 0;
                                        lp->dialstate = 4;
                                        cmd.driver = lp->isdn_device;
@@ -810,7 +810,7 @@ isdn_net_dial(void)
                                break;
                        default:
                                printk(KERN_WARNING "isdn_net: Illegal dialstate %d for device %s\n",
-                                       lp->dialstate, lp->name);
+                                       lp->dialstate, p->dev->name);
                }
                p = (isdn_net_dev *) p->next;
        }
@@ -836,11 +836,11 @@ isdn_net_hangup(struct net_device *d)
                        if (slp->flags & ISDN_NET_CONNECTED) {
                                printk(KERN_INFO
                                        "isdn_net: hang up slave %s before %s\n",
-                                        slp->name, lp->name);
+                                        lp->slave->name, d->name);
                                isdn_net_hangup(lp->slave);
                        }
                }
-                printk(KERN_INFO "isdn_net: local hangup %s\n", lp->name);
+                printk(KERN_INFO "isdn_net: local hangup %s\n", d->name);
 #ifdef CONFIG_ISDN_PPP
                if (lp->p_encap == ISDN_NET_ENCAP_SYNCPPP)
                        isdn_ppp_free(lp);
@@ -858,7 +858,7 @@ isdn_net_hangup(struct net_device *d)
                cmd.command = ISDN_CMD_HANGUP;
                cmd.arg = lp->isdn_channel;
                isdn_command(&cmd);
-                printk(KERN_INFO "%s: Chargesum is %d\n", lp->name, lp->charge);
+                printk(KERN_INFO "%s: Chargesum is %d\n", d->name, lp->charge);
                isdn_all_eaz(lp->isdn_device, lp->isdn_channel);
        }
        isdn_net_unbind_channel(lp);
@@ -885,7 +885,7 @@ isdn_net_log_skb(struct sk_buff * skb, isdn_net_local * lp)
                /* fall back to old isdn_net_log_packet method() */
                char * buf = skb->data;
-                printk(KERN_DEBUG "isdn_net: protocol %04x is buggy, dev %s\n", skb->protocol, lp->name);
+                printk(KERN_DEBUG "isdn_net: protocol %04x is buggy, dev %s\n", skb->protocol, lp->netdev->dev->name);
                p = buf;
                proto = ETH_P_IP;
                switch (lp->p_encap) {
@@ -1023,7 +1023,7 @@ void isdn_net_writebuf_skb(isdn_net_local *lp, struct sk_buff *skb)
        ret = isdn_writebuf_skb_stub(lp->isdn_device, lp->isdn_channel, 1, skb);
        if (ret != len) {
                /* we should never get here */
-                printk(KERN_WARNING "%s: HL driver queue full\n", lp->name);
+                printk(KERN_WARNING "%s: HL driver queue full\n", lp->netdev->dev->name);
                goto error;
        }
        
@@ -1461,7 +1461,7 @@ isdn_ciscohdlck_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                mod_timer(&lp->cisco_timer, expires);
                                printk(KERN_INFO "%s: Keepalive period set "
                                        "to %d seconds.\n",
-                                        lp->name, lp->cisco_keepalive_period);
+                                        dev->name, lp->cisco_keepalive_period);
                        }
                        break;
@@ -1512,7 +1512,7 @@ isdn_net_ciscohdlck_slarp_send_keepalive(unsigned long data)
                lp->cisco_line_state = 0;
                printk (KERN_WARNING
                                "UPDOWN: Line protocol on Interface %s,"
-                                " changed state to down\n", lp->name);
+                                " changed state to down\n", lp->netdev->dev->name);
                /* should stop routing higher-level data accross */
        } else if ((!lp->cisco_line_state) &&
                (myseq_diff >= 0) && (myseq_diff <= 2)) {
@@ -1520,14 +1520,14 @@ isdn_net_ciscohdlck_slarp_send_keepalive(unsigned long data)
                lp->cisco_line_state = 1;
                printk (KERN_WARNING
                                "UPDOWN: Line protocol on Interface %s,"
-                                " changed state to up\n", lp->name);
+                                " changed state to up\n", lp->netdev->dev->name);
                /* restart routing higher-level data accross */
        }
        if (lp->cisco_debserint)
                printk (KERN_DEBUG "%s: HDLC "
                        "myseq %lu, mineseen %lu%c, yourseen %lu, %s\n",
-                        lp->name, last_cisco_myseq, lp->cisco_mineseen,
+                        lp->netdev->dev->name, last_cisco_myseq, lp->cisco_mineseen,
                        ((last_cisco_myseq == lp->cisco_mineseen) ? '*' : 040),
                        lp->cisco_yourseq,
                        ((lp->cisco_line_state) ? "line up" : "line down"));
@@ -1682,7 +1682,7 @@ isdn_net_ciscohdlck_slarp_in(isdn_net_local *lp, struct sk_buff *skb)
                        "remote ip: %d.%d.%d.%d, "
                        "local ip: %d.%d.%d.%d "
                        "mask: %d.%d.%d.%d\n",
-                       lp->name,
+                       lp->netdev->dev->name,
                       HIPQUAD(addr),
                       HIPQUAD(local),
                       HIPQUAD(mask));
@@ -1690,7 +1690,7 @@ isdn_net_ciscohdlck_slarp_in(isdn_net_local *lp, struct sk_buff *skb)
  slarp_reply_out:
                 printk(KERN_INFO "%s: got invalid slarp "
                                 "reply (%d.%d.%d.%d/%d.%d.%d.%d) "
-                                 "- ignored\n", lp->name,
+                                 "- ignored\n", lp->netdev->dev->name,
                                 HIPQUAD(addr), HIPQUAD(mask));
                break;
        case CISCO_SLARP_KEEPALIVE:
@@ -1701,7 +1701,8 @@ isdn_net_ciscohdlck_slarp_in(isdn_net_local *lp, struct sk_buff *skb)
                                lp->cisco_last_slarp_in) {
                        printk(KERN_DEBUG "%s: Keepalive period mismatch - "
                                "is %d but should be %d.\n",
-                                lp->name, period, lp->cisco_keepalive_period);
+                                lp->netdev->dev->name, period,
+                                lp->cisco_keepalive_period);
                }
                lp->cisco_last_slarp_in = jiffies;
                p += get_u32(p, &my_seq);
@@ -1732,12 +1733,12 @@ isdn_net_ciscohdlck_receive(isdn_net_local *lp, struct sk_buff *skb)
        
        if (addr != CISCO_ADDR_UNICAST && addr != CISCO_ADDR_BROADCAST) {
                printk(KERN_WARNING "%s: Unknown Cisco addr 0x%02x\n",
-                       lp->name, addr);
+                       lp->netdev->dev->name, addr);
                goto out_free;
        }
        if (ctrl != CISCO_CTRL) {
                printk(KERN_WARNING "%s: Unknown Cisco ctrl 0x%02x\n",
-                       lp->name, ctrl);
+                       lp->netdev->dev->name, ctrl);
                goto out_free;
        }
@@ -1748,7 +1749,8 @@ isdn_net_ciscohdlck_receive(isdn_net_local *lp, struct sk_buff *skb)
        case CISCO_TYPE_CDP:
                if (lp->cisco_debserint)
                        printk(KERN_DEBUG "%s: Received CDP packet. use "
-                                "\"no cdp enable\" on cisco.\n", lp->name);
+                                "\"no cdp enable\" on cisco.\n",
+                                lp->netdev->dev->name);
                goto out_free;
        default:
                /* no special cisco protocol */
@@ -1843,7 +1845,7 @@ isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
                                };
 #endif /* CONFIG_ISDN_X25 */
                        printk(KERN_WARNING "%s: unknown encapsulation, dropping\n",
-                               lp->name);
+                               lp->netdev->dev->name);
                        kfree_skb(skb);
                        return;
        }
@@ -2174,7 +2176,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                        wret = matchret;
 #ifdef ISDN_DEBUG_NET_ICALL
                printk(KERN_DEBUG "n_fi: if='%s', l.msn=%s, l.flags=%d, l.dstate=%d\n",
-                       lp->name, lp->msn, lp->flags, lp->dialstate);
+                       p->dev->name, lp->msn, lp->flags, lp->dialstate);
 #endif
                if ((!matchret) &&                                        /* EAZ is matching   */
                    (((!(lp->flags & ISDN_NET_CONNECTED)) &&              /* but not connected */
@@ -2277,7 +2279,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                 * */
                                if (ISDN_NET_DIALMODE(*lp) == ISDN_NET_DM_OFF) {
                                        printk(KERN_INFO "incoming call, interface %s `stopped' -> rejected\n",
-                                               lp->name);
+                                               p->dev->name);
                                        return 3;
                                }
                                /*
@@ -2286,7 +2288,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                 */
                                if (!isdn_net_device_started(p)) {
                                        printk(KERN_INFO "%s: incoming call, interface down -> rejected\n",
-                                               lp->name);
+                                               p->dev->name);
                                        return 3;
                                }
                                /* Interface is up, now see if it's a slave. If so, see if
@@ -2294,8 +2296,8 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                 */
                                if (lp->master) {
                                        isdn_net_local *mlp = (isdn_net_local *) lp->master->priv;
-                                        printk(KERN_DEBUG "ICALLslv: %s\n", lp->name);
+                                        printk(KERN_DEBUG "ICALLslv: %s\n", p->dev->name);
-                                        printk(KERN_DEBUG "master=%s\n", mlp->name);
+                                        printk(KERN_DEBUG "master=%s\n", lp->master->name);
                                        if (mlp->flags & ISDN_NET_CONNECTED) {
                                                printk(KERN_DEBUG "master online\n");
                                                /* Master is online, find parent-slave (master if first slave) */
@@ -2322,11 +2324,11 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                         * */
                                        if (ISDN_NET_DIALMODE(*lp) == ISDN_NET_DM_OFF) {
                                                printk(KERN_INFO "incoming call for callback, interface %s `off' -> rejected\n",
-                                                       lp->name);
+                                                       p->dev->name);
                                                return 3;
                                        }
                                        printk(KERN_DEBUG "%s: call from %s -> %s, start callback\n",
-                                               lp->name, nr, eaz);
+                                               p->dev->name, nr, eaz);
                                        if (lp->phone[1]) {
                                                /* Grab a free ISDN-Channel */
                                                spin_lock_irqsave(&dev->lock, flags);
@@ -2340,7 +2342,8 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                                                lp->msn)
                                                                ) < 0) {
-                                                        printk(KERN_WARNING "isdn_net_find_icall: No channel for %s\n", lp->name);
+                                                        printk(KERN_WARNING "isdn_net_find_icall: No channel for %s\n",
+                                                                p->dev->name);
                                                        spin_unlock_irqrestore(&dev->lock, flags);
                                                        return 0;
                                                }
@@ -2361,11 +2364,12 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
                                                /* Initiate dialing by returning 2 or 4 */
                                                return (lp->flags & ISDN_NET_CBHUP) ? 2 : 4;
                                        } else
-                                                printk(KERN_WARNING "isdn_net: %s: No phone number\n", lp->name);
+                                                printk(KERN_WARNING "isdn_net: %s: No phone number\n",
+                                                        p->dev->name);
                                        return 0;
                                } else {
-                                        printk(KERN_DEBUG "%s: call from %s -> %s accepted\n", lp->name, nr,
+                                        printk(KERN_DEBUG "%s: call from %s -> %s accepted\n",
-                                               eaz);
+                                                p->dev->name, nr, eaz);
                                        /* if this interface is dialing, it does it probably on a different
                                           device, so free this device */
                                        if ((lp->dialstate == 4) || (lp->dialstate == 12)) {
@@ -2424,7 +2428,7 @@ isdn_net_findif(char *name)
        isdn_net_dev *p = dev->netdev;
        while (p) {
-                if (!strcmp(p->local->name, name))
+                if (!strcmp(p->dev->name, name))
                        return p;
                p = (isdn_net_dev *) p->next;
        }
@@ -2453,7 +2457,8 @@ isdn_net_force_dial_lp(isdn_net_local * lp)
                                        lp->pre_device,
                                        lp->pre_channel,
                                        lp->msn)) < 0) {
-                                printk(KERN_WARNING "isdn_net_force_dial: No channel for %s\n", lp->name);
+                                printk(KERN_WARNING "isdn_net_force_dial: No channel for %s\n",
+                                        lp->netdev->dev->name);
                                spin_unlock_irqrestore(&dev->lock, flags);
                                return -EAGAIN;
                        }
@@ -2556,7 +2561,7 @@ isdn_net_new(char *name, struct net_device *master)
                return NULL;
        }
        if (name == NULL)
-                name = "         ";
+                return NULL;
        if (!(netdev = kzalloc(sizeof(isdn_net_dev), GFP_KERNEL))) {
                printk(KERN_WARNING "isdn_net: Could not allocate net-device\n");
                return NULL;
@@ -2568,7 +2573,6 @@ isdn_net_new(char *name, struct net_device *master)
                return NULL;
        }
        netdev->local = netdev->dev->priv;
-        strcpy(netdev->local->name, netdev->dev->name);
        netdev->dev->init = isdn_net_init;
        if (master) {
                /* Device shall be a slave */
@@ -2673,7 +2677,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
 #endif
                        if (isdn_net_device_started(p)) {
                                printk(KERN_WARNING "%s: cannot change encap when if is up\n",
-                                       lp->name);
+                                       p->dev->name);
                                return -EBUSY;
                        }
 #ifdef CONFIG_ISDN_X25
@@ -2698,7 +2702,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
                case ISDN_NET_ENCAP_SYNCPPP:
 #ifndef CONFIG_ISDN_PPP
                        printk(KERN_WARNING "%s: SyncPPP support not configured\n",
-                               lp->name);
+                               p->dev->name);
                        return -EINVAL;
 #else
                        p->dev->type = ARPHRD_PPP;      /* change ARP type */
@@ -2709,7 +2713,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
                case ISDN_NET_ENCAP_X25IFACE:
 #ifndef CONFIG_ISDN_X25
                        printk(KERN_WARNING "%s: isdn-x25 support not configured\n",
-                               p->local->name);
+                               p->dev->name);
                        return -EINVAL;
 #else
                        p->dev->type = ARPHRD_X25;      /* change ARP type */
@@ -2725,7 +2729,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
                                break;
                        printk(KERN_WARNING
                               "%s: encapsulation protocol %d not supported\n",
-                               p->local->name, cfg->p_encap);
+                               p->dev->name, cfg->p_encap);
                        return -EINVAL;
                }
                if (strlen(cfg->drvid)) {
@@ -2902,13 +2906,18 @@ isdn_net_getcfg(isdn_net_ioctl_cfg * cfg)
                cfg->pppbind = lp->pppbind;
                cfg->dialtimeout = lp->dialtimeout >= 0 ? lp->dialtimeout / HZ : -1;
                cfg->dialwait = lp->dialwait / HZ;
-                if (lp->slave)
+                if (lp->slave) {
-                        strcpy(cfg->slave, ((isdn_net_local *) lp->slave->priv)->name);
+                        if (strlen(lp->slave->name) > 8)
-                else
+                                strcpy(cfg->slave, "too-long");
+                        else
+                                strcpy(cfg->slave, lp->slave->name);
+                } else
                        cfg->slave[0] = '\0';
-                if (lp->master)
+                if (lp->master) {
-                        strcpy(cfg->master, ((isdn_net_local *) lp->master->priv)->name);
+                        if (strlen(lp->master->name) > 8)
-                else
+                                strcpy(cfg->master, "too-long");
+                        strcpy(cfg->master, lp->master->name);
+                } else
                        cfg->master[0] = '\0';
                return 0;
        }
@@ -2978,7 +2987,8 @@ isdn_net_getpeer(isdn_net_ioctl_phone *phone, isdn_net_ioctl_phone __user *peer)
        isdn_net_dev *p = isdn_net_findif(phone->name);
        int ch, dv, idx;
-        if (!p) return -ENODEV;
+        if (!p)
+                return -ENODEV;
        /*
         * Theoretical race: while this executes, the remote number might
         * become invalid (hang up) or change (new connection), resulting
@@ -2987,14 +2997,18 @@ isdn_net_getpeer(isdn_net_ioctl_phone *phone, isdn_net_ioctl_phone __user *peer)
         */
        ch = p->local->isdn_channel;
        dv = p->local->isdn_device;
-        if(ch<0 && dv<0) return -ENOTCONN;
+        if(ch < 0 && dv < 0)
+                return -ENOTCONN;
        idx = isdn_dc2minor(dv, ch);
-        if (idx<0) return -ENODEV;
+        if (idx <0 )
+                return -ENODEV;
        /* for pre-bound channels, we need this extra check */
-        if ( strncmp(dev->num[idx],"???",3) == 0 ) return -ENOTCONN;
+        if (strncmp(dev->num[idx], "???", 3) == 0)
-        strncpy(phone->phone,dev->num[idx],ISDN_MSNLEN);
+                return -ENOTCONN;
-        phone->outgoing=USG_OUTGOING(dev->usage[idx]);
+        strncpy(phone->phone, dev->num[idx], ISDN_MSNLEN);
-        if ( copy_to_user(peer,phone,sizeof(*peer)) ) return -EFAULT;
+        phone->outgoing = USG_OUTGOING(dev->usage[idx]);
+        if (copy_to_user(peer, phone, sizeof(*peer)))
+                return -EFAULT;
        return 0;
 }
 /*
@@ -3113,18 +3127,18 @@ isdn_net_realrm(isdn_net_dev * p, isdn_net_dev * q)
                dev->netdev = p->next;
        if (p->local->slave) {
                /* If this interface has a slave, remove it also */
-                char *slavename = ((isdn_net_local *) (p->local->slave->priv))->name;
+                char *slavename = p->local->slave->name;
                isdn_net_dev *n = dev->netdev;
                q = NULL;
                while (n) {
-                        if (!strcmp(n->local->name, slavename)) {
+                        if (!strcmp(n->dev->name, slavename)) {
                                spin_unlock_irqrestore(&dev->lock, flags);
                                isdn_net_realrm(n, q);
                                spin_lock_irqsave(&dev->lock, flags);
                                break;
                        }
                        q = n;
-                        n = (isdn_net_dev *) n->next;
+                        n = (isdn_net_dev *)n->next;
                }
        }
        spin_unlock_irqrestore(&dev->lock, flags);
@@ -3152,7 +3166,7 @@ isdn_net_rm(char *name)
        p = dev->netdev;
        q = NULL;
        while (p) {
-                if (!strcmp(p->local->name, name)) {
+                if (!strcmp(p->dev->name, name)) {
                        spin_unlock_irqrestore(&dev->lock, flags);
                        return (isdn_net_realrm(p, q));
                }
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 0e5e59f84344..9f5fe372f83d 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -190,9 +190,11 @@ isdn_ppp_bind(isdn_net_local * lp)
                retval = -1;
                goto out;
        }
-        unit = isdn_ppp_if_get_unit(lp->name);  /* get unit number from interface name .. ugly! */
+        /* get unit number from interface name .. ugly! */
+        unit = isdn_ppp_if_get_unit(lp->netdev->dev->name);
        if (unit < 0) {
-                printk(KERN_ERR "isdn_ppp_bind: illegal interface name %s.\n", lp->name);
+                printk(KERN_ERR "isdn_ppp_bind: illegal interface name %s.\n",
+                        lp->netdev->dev->name);
                retval = -1;
                goto out;
        }
@@ -507,7 +509,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
                case PPPIOCGIFNAME:
                        if(!lp)
                                return -EINVAL;
-                        if ((r = set_arg(argp, lp->name, strlen(lp->name))))
+                        if ((r = set_arg(argp, lp->netdev->dev->name,
+                                strlen(lp->netdev->dev->name))))
                                return r;
                        break;
                case PPPIOCGMPFLAGS:    /* get configuration flags */
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index be25aa33971c..662b8d16803c 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -265,17 +265,16 @@ static __net_init int loopback_net_init(struct net *net)
        if (err)
                goto out_free_netdev;
-        err = 0;
        net->loopback_dev = dev;
+        return 0;
-out:
-        if (err)
-                panic("loopback: Failed to register netdevice: %d\n", err);
-        return err;
 out_free_netdev:
        free_netdev(dev);
-        goto out;
+out:
+        if (net == &init_net)
+                panic("loopback: Failed to register netdevice: %d\n", err);
+        return err;
 }
 static __net_exit void loopback_net_exit(struct net *net)
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 43bfe7e6b6f5..ed1f9bbb2a32 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -6123,19 +6123,19 @@ static int __devinit niu_pci_probe_sprom(struct niu *np)
        val = nr64(ESPC_PHY_TYPE);
        switch (np->port) {
        case 0:
-                val = (val & ESPC_PHY_TYPE_PORT0) >>
+                val8 = (val & ESPC_PHY_TYPE_PORT0) >>
                        ESPC_PHY_TYPE_PORT0_SHIFT;
                break;
        case 1:
-                val = (val & ESPC_PHY_TYPE_PORT1) >>
+                val8 = (val & ESPC_PHY_TYPE_PORT1) >>
                        ESPC_PHY_TYPE_PORT1_SHIFT;
                break;
        case 2:
-                val = (val & ESPC_PHY_TYPE_PORT2) >>
+                val8 = (val & ESPC_PHY_TYPE_PORT2) >>
                        ESPC_PHY_TYPE_PORT2_SHIFT;
                break;
        case 3:
-                val = (val & ESPC_PHY_TYPE_PORT3) >>
+                val8 = (val & ESPC_PHY_TYPE_PORT3) >>
                        ESPC_PHY_TYPE_PORT3_SHIFT;
                break;
        default:
@@ -6143,9 +6143,9 @@ static int __devinit niu_pci_probe_sprom(struct niu *np)
                        np->port);
                return -EINVAL;
        }
-        niudbg(PROBE, "SPROM: PHY type %llx\n", (unsigned long long) val);
+        niudbg(PROBE, "SPROM: PHY type %x\n", val8);
-        switch (val) {
+        switch (val8) {
        case ESPC_PHY_TYPE_1G_COPPER:
                /* 1G copper, MII */
                np->flags &= ~(NIU_FLAGS_FIBER |
@@ -6175,8 +6175,7 @@ static int __devinit niu_pci_probe_sprom(struct niu *np)
                break;
        default:
-                dev_err(np->device, PFX "Bogus SPROM phy type %llu\n",
+                dev_err(np->device, PFX "Bogus SPROM phy type %u\n", val8);
-                        (unsigned long long) val);
                return -EINVAL;
        }
@@ -6213,7 +6212,7 @@ static int __devinit niu_pci_probe_sprom(struct niu *np)
        val = nr64(ESPC_MOD_STR_LEN);
        niudbg(PROBE, "SPROM: MOD_STR_LEN[%llu]\n",
               (unsigned long long) val);
-        if (val > 8 * 4)
+        if (val >= 8 * 4)
                return -EINVAL;
        for (i = 0; i < val; i += 4) {
@@ -6229,7 +6228,7 @@ static int __devinit niu_pci_probe_sprom(struct niu *np)
        val = nr64(ESPC_BD_MOD_STR_LEN);
        niudbg(PROBE, "SPROM: BD_MOD_STR_LEN[%llu]\n",
               (unsigned long long) val);
-        if (val > 4 * 4)
+        if (val >= 4 * 4)
                return -EINVAL;
        for (i = 0; i < val; i += 4) {
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 76efb3feffbf..014dc2cfe4d6 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.83"
+#define DRV_MODULE_VERSION      "3.84"
-#define DRV_MODULE_RELDATE      "October 10, 2007"
+#define DRV_MODULE_RELDATE      "October 12, 2007"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -5056,6 +5056,12 @@ static void tg3_restore_pci_state(struct tg3 *tp)
        pci_write_config_dword(tp->pdev, TG3PCI_COMMAND, tp->pci_cmd);
+        if (!(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
+                pci_write_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE,
+                                      tp->pci_cacheline_sz);
+                pci_write_config_byte(tp->pdev, PCI_LATENCY_TIMER,
+                                      tp->pci_lat_timer);
+        }
        /* Make sure PCI-X relaxed ordering bit is clear. */
        if (tp->pcix_cap) {
                u16 pcix_cmd;
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 99e3a1a00099..58e43e566457 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -107,7 +107,7 @@ struct __fdb_entry
 extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
 extern struct sk_buff *(*br_handle_frame_hook)(struct net_bridge_port *p,
                                               struct sk_buff *skb);
-extern int (*br_should_route_hook)(struct sk_buff **pskb);
+extern int (*br_should_route_hook)(struct sk_buff *skb);
 #endif
diff --git a/include/linux/isdn.h b/include/linux/isdn.h
index ad09506554a3..d5dda4b643ac 100644
--- a/include/linux/isdn.h
+++ b/include/linux/isdn.h
@@ -286,7 +286,6 @@ typedef struct {
 /* Local interface-data */
 typedef struct isdn_net_local_s {
  ulong                  magic;
-  char                   name[10];     /* Name of device                   */
  struct net_device_stats stats;       /* Ethernet Statistics              */
  int                    isdn_device;  /* Index to isdn-device             */
  int                    isdn_channel; /* Index to isdn-channel            */
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 1dd075eda595..16adac688af5 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -51,7 +51,7 @@ struct sk_buff;
 struct net_device;
 typedef unsigned int nf_hookfn(unsigned int hooknum,
-                               struct sk_buff **skb,
+                               struct sk_buff *skb,
                               const struct net_device *in,
                               const struct net_device *out,
                               int (*okfn)(struct sk_buff *));
@@ -183,7 +183,7 @@ void nf_log_packet(int pf,
                   struct nf_loginfo *li,
                   const char *fmt, ...);
-int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
+int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
                 struct net_device *indev, struct net_device *outdev,
                 int (*okfn)(struct sk_buff *), int thresh);
@@ -195,7 +195,7 @@ int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
 *      value indicates the packet has been consumed by the hook.
 */
 static inline int nf_hook_thresh(int pf, unsigned int hook,
-                                 struct sk_buff **pskb,
+                                 struct sk_buff *skb,
                                 struct net_device *indev,
                                 struct net_device *outdev,
                                 int (*okfn)(struct sk_buff *), int thresh,
@@ -207,14 +207,14 @@ static inline int nf_hook_thresh(int pf, unsigned int hook,
        if (list_empty(&nf_hooks[pf][hook]))
                return 1;
 #endif
-        return nf_hook_slow(pf, hook, pskb, indev, outdev, okfn, thresh);
+        return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
 }
-static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
+static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
                          struct net_device *indev, struct net_device *outdev,
                          int (*okfn)(struct sk_buff *))
 {
-        return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
+        return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN, 1);
 }
                   
 /* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -241,13 +241,13 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
 #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)             \
 ({int __ret;                                                                   \
-if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
+if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)\
        __ret = (okfn)(skb);                                                   \
 __ret;})
 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)                 \
 ({int __ret;                                                                   \
-if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
+if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
        __ret = (okfn)(skb);                                                   \
 __ret;})
@@ -287,7 +287,7 @@ extern void nf_invalidate_cache(int pf);
 /* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
-extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
+extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
 static inline void nf_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
 {
@@ -317,7 +317,7 @@ struct nf_afinfo {
                                    unsigned int dataoff, u_int8_t protocol);
        void            (*saveroute)(const struct sk_buff *skb,
                                     struct nf_info *info);
-        int             (*reroute)(struct sk_buff **skb,
+        int             (*reroute)(struct sk_buff *skb,
                                   const struct nf_info *info);
        int             route_key_size;
 };
@@ -371,15 +371,15 @@ extern struct proc_dir_entry *proc_net_netfilter;
 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
 static inline int nf_hook_thresh(int pf, unsigned int hook,
-                                 struct sk_buff **pskb,
+                                 struct sk_buff *skb,
                                 struct net_device *indev,
                                 struct net_device *outdev,
                                 int (*okfn)(struct sk_buff *), int thresh,
                                 int cond)
 {
-        return okfn(*pskb);
+        return okfn(skb);
 }
-static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
+static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
                          struct net_device *indev, struct net_device *outdev,
                          int (*okfn)(struct sk_buff *))
 {
diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 26c223544ae8..0bb5a6976bf3 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -2,7 +2,7 @@
 #define _NF_CONNTRACK_AMANDA_H
 /* AMANDA tracking. */
-extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
                                          enum ip_conntrack_info ctinfo,
                                          unsigned int matchoff,
                                          unsigned int matchlen,
diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
index b7c360ffd0d0..47727d7546ea 100644
--- a/include/linux/netfilter/nf_conntrack_ftp.h
+++ b/include/linux/netfilter/nf_conntrack_ftp.h
@@ -32,7 +32,7 @@ struct nf_conntrack_expect;
 /* For NAT to hook in when we find a packet which describes what other
 * connection we should expect. */
-extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
                                       enum nf_ct_ftp_type type,
                                       unsigned int matchoff,
diff --git a/include/linux/netfilter/nf_conntrack_h323.h b/include/linux/netfilter/nf_conntrack_h323.h
index 08e2f4977c2e..aabd24ac7631 100644
--- a/include/linux/netfilter/nf_conntrack_h323.h
+++ b/include/linux/netfilter/nf_conntrack_h323.h
@@ -36,27 +36,27 @@ extern void nf_conntrack_h245_expect(struct nf_conn *new,
                                     struct nf_conntrack_expect *this);
 extern void nf_conntrack_q931_expect(struct nf_conn *new,
                                     struct nf_conntrack_expect *this);
-extern int (*set_h245_addr_hook) (struct sk_buff **pskb,
+extern int (*set_h245_addr_hook) (struct sk_buff *skb,
                                  unsigned char **data, int dataoff,
                                  H245_TransportAddress *taddr,
                                  union nf_conntrack_address *addr,
                                  __be16 port);
-extern int (*set_h225_addr_hook) (struct sk_buff **pskb,
+extern int (*set_h225_addr_hook) (struct sk_buff *skb,
                                  unsigned char **data, int dataoff,
                                  TransportAddress *taddr,
                                  union nf_conntrack_address *addr,
                                  __be16 port);
-extern int (*set_sig_addr_hook) (struct sk_buff **pskb,
+extern int (*set_sig_addr_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
                                 unsigned char **data,
                                 TransportAddress *taddr, int count);
-extern int (*set_ras_addr_hook) (struct sk_buff **pskb,
+extern int (*set_ras_addr_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
                                 unsigned char **data,
                                 TransportAddress *taddr, int count);
-extern int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
+extern int (*nat_rtp_rtcp_hook) (struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
                                 unsigned char **data, int dataoff,
@@ -64,24 +64,24 @@ extern int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
                                 __be16 port, __be16 rtp_port,
                                 struct nf_conntrack_expect *rtp_exp,
                                 struct nf_conntrack_expect *rtcp_exp);
-extern int (*nat_t120_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+extern int (*nat_t120_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
                             unsigned char **data, int dataoff,
                             H245_TransportAddress *taddr, __be16 port,
                             struct nf_conntrack_expect *exp);
-extern int (*nat_h245_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+extern int (*nat_h245_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
                             unsigned char **data, int dataoff,
                             TransportAddress *taddr, __be16 port,
                             struct nf_conntrack_expect *exp);
-extern int (*nat_callforwarding_hook) (struct sk_buff **pskb,
+extern int (*nat_callforwarding_hook) (struct sk_buff *skb,
                                       struct nf_conn *ct,
                                       enum ip_conntrack_info ctinfo,
                                       unsigned char **data, int dataoff,
                                       TransportAddress *taddr,
                                       __be16 port,
                                       struct nf_conntrack_expect *exp);
-extern int (*nat_q931_hook) (struct sk_buff **pskb, struct nf_conn *ct,
+extern int (*nat_q931_hook) (struct sk_buff *skb, struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo,
                             unsigned char **data, TransportAddress *taddr,
                             int idx, __be16 port,
diff --git a/include/linux/netfilter/nf_conntrack_irc.h b/include/linux/netfilter/nf_conntrack_irc.h
index 2ab6b8255911..36282bf71b63 100644
--- a/include/linux/netfilter/nf_conntrack_irc.h
+++ b/include/linux/netfilter/nf_conntrack_irc.h
@@ -5,7 +5,7 @@
 #define IRC_PORT        6667
-extern unsigned int (*nf_nat_irc_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
                                       unsigned int matchoff,
                                       unsigned int matchlen,
diff --git a/include/linux/netfilter/nf_conntrack_pptp.h b/include/linux/netfilter/nf_conntrack_pptp.h
index c93061f33144..23435496d24a 100644
--- a/include/linux/netfilter/nf_conntrack_pptp.h
+++ b/include/linux/netfilter/nf_conntrack_pptp.h
@@ -301,13 +301,13 @@ struct nf_conn;
 struct nf_conntrack_expect;
 extern int
-(*nf_nat_pptp_hook_outbound)(struct sk_buff **pskb,
+(*nf_nat_pptp_hook_outbound)(struct sk_buff *skb,
                             struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                             struct PptpControlHeader *ctlh,
                             union pptp_ctrl_union *pptpReq);
 extern int
-(*nf_nat_pptp_hook_inbound)(struct sk_buff **pskb,
+(*nf_nat_pptp_hook_inbound)(struct sk_buff *skb,
                            struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                            struct PptpControlHeader *ctlh,
                            union pptp_ctrl_union *pptpReq);
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index bb7f2041db74..9fff19779bd5 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -21,11 +21,11 @@ enum sip_header_pos {
        POS_SDP_HEADER,
 };
-extern unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
                                       struct nf_conn *ct,
                                       const char **dptr);
-extern unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
                                       enum ip_conntrack_info ctinfo,
                                       struct nf_conntrack_expect *exp,
                                       const char *dptr);
diff --git a/include/linux/netfilter/nf_conntrack_tftp.h b/include/linux/netfilter/nf_conntrack_tftp.h
index 0d79b7ae051f..c78d38fdb050 100644
--- a/include/linux/netfilter/nf_conntrack_tftp.h
+++ b/include/linux/netfilter/nf_conntrack_tftp.h
@@ -13,7 +13,7 @@ struct tftphdr {
 #define TFTP_OPCODE_ACK         4
 #define TFTP_OPCODE_ERROR       5
-extern unsigned int (*nf_nat_tftp_hook)(struct sk_buff **pskb,
+extern unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
                                        enum ip_conntrack_info ctinfo,
                                        struct nf_conntrack_expect *exp);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 64f425a855bb..03e6ce979eaa 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -191,7 +191,7 @@ struct xt_target
        /* Returns verdict. Argument order changed since 2.6.9, as this
           must now handle non-linear skbs, using skb_copy_bits and
           skb_ip_make_writable. */
-        unsigned int (*target)(struct sk_buff **pskb,
+        unsigned int (*target)(struct sk_buff *skb,
                               const struct net_device *in,
                               const struct net_device *out,
                               unsigned int hooknum,
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 584cd1b18f12..2fc73fa8e37f 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -287,7 +287,7 @@ struct arpt_error
 extern int arpt_register_table(struct arpt_table *table,
                               const struct arpt_replace *repl);
 extern void arpt_unregister_table(struct arpt_table *table);
-extern unsigned int arpt_do_table(struct sk_buff **pskb,
+extern unsigned int arpt_do_table(struct sk_buff *skb,
                                  unsigned int hook,
                                  const struct net_device *in,
                                  const struct net_device *out,
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 94e0a7dc0cb2..892f5b7771c7 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -237,7 +237,7 @@ struct ebt_target
        struct list_head list;
        const char name[EBT_FUNCTION_MAXNAMELEN];
        /* returns one of the standard verdicts */
-        int (*target)(struct sk_buff **pskb, unsigned int hooknr,
+        int (*target)(struct sk_buff *skb, unsigned int hooknr,
           const struct net_device *in, const struct net_device *out,
           const void *targetdata, unsigned int datalen);
        /* 0 == let it in */
@@ -294,7 +294,7 @@ extern int ebt_register_watcher(struct ebt_watcher *watcher);
 extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
 extern int ebt_register_target(struct ebt_target *target);
 extern void ebt_unregister_target(struct ebt_target *target);
-extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
+extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff *skb,
   const struct net_device *in, const struct net_device *out,
   struct ebt_table *table);
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index ceae87a4c891..1a63adf5c4c1 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -75,8 +75,8 @@ enum nf_ip_hook_priorities {
 #define SO_ORIGINAL_DST 80
 #ifdef __KERNEL__
-extern int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type);
+extern int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type);
-extern int ip_xfrm_me_harder(struct sk_buff **pskb);
+extern int ip_xfrm_me_harder(struct sk_buff *skb);
 extern __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
                                   unsigned int dataoff, u_int8_t protocol);
 #endif /*__KERNEL__*/
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index e992cd6b28f5..d79ed69cbc1f 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -337,7 +337,7 @@ struct ipt_error
        .target.errorname = "ERROR",                                           \
 }
-extern unsigned int ipt_do_table(struct sk_buff **pskb,
+extern unsigned int ipt_do_table(struct sk_buff *skb,
                                 unsigned int hook,
                                 const struct net_device *in,
                                 const struct net_device *out,
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 9a720f05888f..7dc481ce7cba 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -336,7 +336,7 @@ extern void ip6t_init(void) __init;
 extern int ip6t_register_table(struct xt_table *table,
                               const struct ip6t_replace *repl);
 extern void ip6t_unregister_table(struct xt_table *table);
-extern unsigned int ip6t_do_table(struct sk_buff **pskb,
+extern unsigned int ip6t_do_table(struct sk_buff *skb,
                                  unsigned int hook,
                                  const struct net_device *in,
                                  const struct net_device *out,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 8101e8b0d7ba..f93f22b3d2ff 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -357,6 +357,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
 }
 extern void            kfree_skbmem(struct sk_buff *skb);
+extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
                                 gfp_t priority);
 extern struct sk_buff *skb_copy(const struct sk_buff *skb,
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index c5b94c1a5ee2..bac17c59b24e 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -315,7 +315,7 @@ struct tcp_sock {
 */
        u32     snd_ssthresh;   /* Slow start size threshold            */
        u32     snd_cwnd;       /* Sending congestion window            */
-        u16     snd_cwnd_cnt;   /* Linear increase counter              */
+        u32     snd_cwnd_cnt;   /* Linear increase counter              */
        u32     snd_cwnd_clamp; /* Do not allow snd_cwnd to grow above this */
        u32     snd_cwnd_used;
        u32     snd_cwnd_stamp;
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
new file mode 100644
index 000000000000..911c2cd02941
--- /dev/null
+++ b/include/net/inet_frag.h
@@ -0,0 +1,60 @@
+#ifndef __NET_FRAG_H__
+#define __NET_FRAG_H__
+struct inet_frag_queue {
+        struct hlist_node       list;
+        struct list_head        lru_list;   /* lru list member */
+        spinlock_t              lock;
+        atomic_t                refcnt;
+        struct timer_list       timer;      /* when will this queue expire? */
+        struct sk_buff          *fragments; /* list of received fragments */
+        ktime_t                 stamp;
+        int                     len;        /* total length of orig datagram */
+        int                     meat;
+        __u8                    last_in;    /* first/last segment arrived? */
+#define COMPLETE                4
+#define FIRST_IN                2
+#define LAST_IN                 1
+};
+#define INETFRAGS_HASHSZ                64
+struct inet_frags_ctl {
+        int high_thresh;
+        int low_thresh;
+        int timeout;
+        int secret_interval;
+};
+struct inet_frags {
+        struct list_head        lru_list;
+        struct hlist_head       hash[INETFRAGS_HASHSZ];
+        rwlock_t                lock;
+        u32                     rnd;
+        int                     nqueues;
+        int                     qsize;
+        atomic_t                mem;
+        struct timer_list       secret_timer;
+        struct inet_frags_ctl   *ctl;
+        unsigned int            (*hashfn)(struct inet_frag_queue *);
+        void                    (*destructor)(struct inet_frag_queue *);
+        void                    (*skb_free)(struct sk_buff *);
+};
+void inet_frags_init(struct inet_frags *);
+void inet_frags_fini(struct inet_frags *);
+void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f);
+void inet_frag_destroy(struct inet_frag_queue *q,
+                                struct inet_frags *f, int *work);
+int inet_frag_evictor(struct inet_frags *f);
+static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
+{
+        if (atomic_dec_and_test(&q->refcnt))
+                inet_frag_destroy(q, f, NULL);
+}
+#endif
diff --git a/include/net/ip.h b/include/net/ip.h
index 3af3ed9d320b..840dd91b513b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -160,6 +160,7 @@ DECLARE_SNMP_STAT(struct ipstats_mib, ip_statistics);
 #define IP_INC_STATS(field)             SNMP_INC_STATS(ip_statistics, field)
 #define IP_INC_STATS_BH(field)          SNMP_INC_STATS_BH(ip_statistics, field)
 #define IP_INC_STATS_USER(field)        SNMP_INC_STATS_USER(ip_statistics, field)
+#define IP_ADD_STATS_BH(field, val)     SNMP_ADD_STATS_BH(ip_statistics, field, val)
 DECLARE_SNMP_STAT(struct linux_mib, net_statistics);
 #define NET_INC_STATS(field)            SNMP_INC_STATS(net_statistics, field)
 #define NET_INC_STATS_BH(field)         SNMP_INC_STATS_BH(net_statistics, field)
@@ -177,10 +178,8 @@ extern int sysctl_ip_default_ttl;
 extern int sysctl_ip_nonlocal_bind;
 /* From ip_fragment.c */
-extern int sysctl_ipfrag_high_thresh; 
+struct inet_frags_ctl;
-extern int sysctl_ipfrag_low_thresh;
+extern struct inet_frags_ctl ip4_frags_ctl;
-extern int sysctl_ipfrag_time;
-extern int sysctl_ipfrag_secret_interval;
 extern int sysctl_ipfrag_max_dist;
 /* From inetpeer.c */
@@ -332,9 +331,9 @@ enum ip_defrag_users
        IP_DEFRAG_VS_FWD
 };
-struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user);
+int ip_defrag(struct sk_buff *skb, u32 user);
-extern int ip_frag_nqueues;
+int ip_frag_mem(void);
-extern atomic_t ip_frag_mem;
+int ip_frag_nqueues(void);
 /*
 *      Functions provided by ip_forward.c
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 672564e5a81d..41870564df8e 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -464,10 +464,10 @@ struct ip_vs_protocol {
                        unsigned int proto_off,
                        int inverse);
-        int (*snat_handler)(struct sk_buff **pskb,
+        int (*snat_handler)(struct sk_buff *skb,
                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
-        int (*dnat_handler)(struct sk_buff **pskb,
+        int (*dnat_handler)(struct sk_buff *skb,
                            struct ip_vs_protocol *pp, struct ip_vs_conn *cp);
        int (*csum_check)(struct sk_buff *skb, struct ip_vs_protocol *pp);
@@ -654,11 +654,11 @@ struct ip_vs_app
        /* output hook: return false if can't linearize. diff set for TCP.  */
        int (*pkt_out)(struct ip_vs_app *, struct ip_vs_conn *,
-                       struct sk_buff **, int *diff);
+                       struct sk_buff *, int *diff);
        /* input hook: return false if can't linearize. diff set for TCP. */
        int (*pkt_in)(struct ip_vs_app *, struct ip_vs_conn *,
-                      struct sk_buff **, int *diff);
+                      struct sk_buff *, int *diff);
        /* ip_vs_app initializer */
        int (*init_conn)(struct ip_vs_app *, struct ip_vs_conn *);
@@ -832,8 +832,8 @@ register_ip_vs_app_inc(struct ip_vs_app *app, __u16 proto, __u16 port);
 extern int ip_vs_app_inc_get(struct ip_vs_app *inc);
 extern void ip_vs_app_inc_put(struct ip_vs_app *inc);
-extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff **pskb);
+extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
-extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff **pskb);
+extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
 extern int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
                             char *o_buf, int o_len, char *n_buf, int n_len);
 extern int ip_vs_app_init(void);
@@ -984,7 +984,6 @@ static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp)
        return fwd;
 }
-extern int ip_vs_make_skb_writable(struct sk_buff **pskb, int len);
 extern void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
                struct ip_vs_conn *cp, int dir);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 31b3f1b45a2b..cc796cbc1b26 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -120,12 +120,21 @@ extern int sysctl_mld_max_msf;
        SNMP_INC_STATS##modifier(statname##_statistics, (field));       \
 })
+#define _DEVADD(statname, modifier, idev, field, val)                   \
+({                                                                      \
+        struct inet6_dev *_idev = (idev);                               \
+        if (likely(_idev != NULL))                                      \
+                SNMP_ADD_STATS##modifier((_idev)->stats.statname, (field), (val)); \
+        SNMP_ADD_STATS##modifier(statname##_statistics, (field), (val));\
+})
 /* MIBs */
 DECLARE_SNMP_STAT(struct ipstats_mib, ipv6_statistics);
 #define IP6_INC_STATS(idev,field)       _DEVINC(ipv6, , idev, field)
 #define IP6_INC_STATS_BH(idev,field)    _DEVINC(ipv6, _BH, idev, field)
 #define IP6_INC_STATS_USER(idev,field)  _DEVINC(ipv6, _USER, idev, field)
+#define IP6_ADD_STATS_BH(idev,field,val) _DEVADD(ipv6, _BH, idev, field, val)
 DECLARE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics);
 DECLARE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics);
@@ -240,7 +249,7 @@ extern int 			ip6_ra_control(struct sock *sk, int sel,
                                               void (*destructor)(struct sock *));
-extern int                      ipv6_parse_hopopts(struct sk_buff **skbp);
+extern int                      ipv6_parse_hopopts(struct sk_buff *skb);
 extern struct ipv6_txoptions *  ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt);
 extern struct ipv6_txoptions *  ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
@@ -252,8 +261,8 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 extern int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb);
-extern int ip6_frag_nqueues;
+int ip6_frag_nqueues(void);
-extern atomic_t ip6_frag_mem;
+int ip6_frag_mem(void);
 #define IPV6_FRAG_TIMEOUT       (60*HZ)         /* 60 seconds */
@@ -565,10 +574,8 @@ extern int inet6_hash_connect(struct inet_timewait_death_row *death_row,
 /*
 * reassembly.c
 */
-extern int sysctl_ip6frag_high_thresh;
+struct inet_frags_ctl;
-extern int sysctl_ip6frag_low_thresh;
+extern struct inet_frags_ctl ip6_frags_ctl;
-extern int sysctl_ip6frag_time;
-extern int sysctl_ip6frag_secret_interval;
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
index 070d12cb4634..f703533fb4db 100644
--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
@@ -15,8 +15,7 @@ extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                               struct net_device *out,
                               int (*okfn)(struct sk_buff *));
-extern unsigned int nf_ct_frag6_timeout;
+struct inet_frags_ctl;
-extern unsigned int nf_ct_frag6_low_thresh;
+extern struct inet_frags_ctl nf_frags_ctl;
-extern unsigned int nf_ct_frag6_high_thresh;
 #endif /* _NF_CONNTRACK_IPV6_H*/
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index 4056f5f08da1..a532e7b5ed6a 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -22,7 +22,7 @@
   of connection tracking. */
 extern unsigned int nf_conntrack_in(int pf,
                                    unsigned int hooknum,
-                                    struct sk_buff **pskb);
+                                    struct sk_buff *skb);
 extern int nf_conntrack_init(void);
 extern void nf_conntrack_cleanup(void);
@@ -60,17 +60,17 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 extern struct nf_conntrack_tuple_hash *
 nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple);
-extern int __nf_conntrack_confirm(struct sk_buff **pskb);
+extern int __nf_conntrack_confirm(struct sk_buff *skb);
 /* Confirm a connection: returns NF_DROP if packet must be dropped. */
-static inline int nf_conntrack_confirm(struct sk_buff **pskb)
+static inline int nf_conntrack_confirm(struct sk_buff *skb)
 {
-        struct nf_conn *ct = (struct nf_conn *)(*pskb)->nfct;
+        struct nf_conn *ct = (struct nf_conn *)skb->nfct;
        int ret = NF_ACCEPT;
        if (ct) {
                if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
-                        ret = __nf_conntrack_confirm(pskb);
+                        ret = __nf_conntrack_confirm(skb);
                nf_ct_deliver_cached_events(ct);
        }
        return ret;
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 0dcc4c828ce9..d7b2d5483a71 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -29,7 +29,7 @@ struct nf_conntrack_helper
        /* Function to call when data passes; return verdict, or -1 to
           invalidate. */
-        int (*help)(struct sk_buff **pskb,
+        int (*help)(struct sk_buff *skb,
                    unsigned int protoff,
                    struct nf_conn *ct,
                    enum ip_conntrack_info conntrackinfo);
diff --git a/include/net/netfilter/nf_nat_core.h b/include/net/netfilter/nf_nat_core.h
index c3cd127ba4bb..f29eeb9777e0 100644
--- a/include/net/netfilter/nf_nat_core.h
+++ b/include/net/netfilter/nf_nat_core.h
@@ -10,12 +10,12 @@
 extern unsigned int nf_nat_packet(struct nf_conn *ct,
                                  enum ip_conntrack_info ctinfo,
                                  unsigned int hooknum,
-                                  struct sk_buff **pskb);
+                                  struct sk_buff *skb);
 extern int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                                         enum ip_conntrack_info ctinfo,
                                         unsigned int hooknum,
-                                         struct sk_buff **pskb);
+                                         struct sk_buff *skb);
 static inline int nf_nat_initialized(struct nf_conn *ct,
                                     enum nf_nat_manip_type manip)
diff --git a/include/net/netfilter/nf_nat_helper.h b/include/net/netfilter/nf_nat_helper.h
index ec98ecf95fc8..58dd22687949 100644
--- a/include/net/netfilter/nf_nat_helper.h
+++ b/include/net/netfilter/nf_nat_helper.h
@@ -7,21 +7,21 @@
 struct sk_buff;
 /* These return true or false. */
-extern int nf_nat_mangle_tcp_packet(struct sk_buff **skb,
+extern int nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                    struct nf_conn *ct,
                                    enum ip_conntrack_info ctinfo,
                                    unsigned int match_offset,
                                    unsigned int match_len,
                                    const char *rep_buffer,
                                    unsigned int rep_len);
-extern int nf_nat_mangle_udp_packet(struct sk_buff **skb,
+extern int nf_nat_mangle_udp_packet(struct sk_buff *skb,
                                    struct nf_conn *ct,
                                    enum ip_conntrack_info ctinfo,
                                    unsigned int match_offset,
                                    unsigned int match_len,
                                    const char *rep_buffer,
                                    unsigned int rep_len);
-extern int nf_nat_seq_adjust(struct sk_buff **pskb,
+extern int nf_nat_seq_adjust(struct sk_buff *skb,
                             struct nf_conn *ct,
                             enum ip_conntrack_info ctinfo);
diff --git a/include/net/netfilter/nf_nat_protocol.h b/include/net/netfilter/nf_nat_protocol.h
index 14c7b2d7263c..04578bfe23e1 100644
--- a/include/net/netfilter/nf_nat_protocol.h
+++ b/include/net/netfilter/nf_nat_protocol.h
@@ -18,7 +18,7 @@ struct nf_nat_protocol
        /* Translate a packet to the target according to manip type.
           Return true if succeeded. */
-        int (*manip_pkt)(struct sk_buff **pskb,
+        int (*manip_pkt)(struct sk_buff *skb,
                         unsigned int iphdroff,
                         const struct nf_conntrack_tuple *tuple,
                         enum nf_nat_manip_type maniptype);
diff --git a/include/net/netfilter/nf_nat_rule.h b/include/net/netfilter/nf_nat_rule.h
index f9743187d57f..75d1825031d7 100644
--- a/include/net/netfilter/nf_nat_rule.h
+++ b/include/net/netfilter/nf_nat_rule.h
@@ -6,7 +6,7 @@
 extern int nf_nat_rule_init(void) __init;
 extern void nf_nat_rule_cleanup(void);
-extern int nf_nat_rule_find(struct sk_buff **pskb,
+extern int nf_nat_rule_find(struct sk_buff *skb,
                            unsigned int hooknum,
                            const struct net_device *in,
                            const struct net_device *out,
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 105bf12b0c79..1166ffb4b3ec 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -45,7 +45,7 @@ struct net_protocol {
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 struct inet6_protocol 
 {
-        int     (*handler)(struct sk_buff **skb);
+        int     (*handler)(struct sk_buff *skb);
        void    (*err_handler)(struct sk_buff *skb,
                               struct inet6_skb_parm *opt,
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 77be396ca633..0e844845f3f4 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1051,7 +1051,7 @@ extern int xfrm4_output(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi);
-extern int xfrm6_rcv(struct sk_buff **pskb);
+extern int xfrm6_rcv(struct sk_buff *skb);
 extern int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                            xfrm_address_t *saddr, u8 proto);
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family);
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 848b8fa8bedd..93867bb6cc97 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -23,7 +23,7 @@
 #include "br_private.h"
-int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
+int (*br_should_route_hook)(struct sk_buff *skb);
 static struct llc_sap *br_stp_sap;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 3a8a015c92e0..3cedd4eeeed6 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -126,6 +126,10 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
        if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
                goto drop;
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                return NULL;
        if (unlikely(is_link_local(dest))) {
                /* Pause frames shouldn't be passed up by driver anyway */
                if (skb->protocol == htons(ETH_P_PAUSE))
@@ -145,7 +149,7 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
        case BR_STATE_FORWARDING:
                if (br_should_route_hook) {
-                        if (br_should_route_hook(&skb))
+                        if (br_should_route_hook(skb))
                                return skb;
                        dest = eth_hdr(skb)->h_dest;
                }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 8245f051ccbb..da22f900e89d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -503,18 +503,14 @@ inhdr_error:
 * receiving device) to make netfilter happy, the REDIRECT
 * target in particular.  Save the original destination IP
 * address to be able to detect DNAT afterwards. */
-static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
        struct iphdr *iph;
-        struct sk_buff *skb = *pskb;
        __u32 len = nf_bridge_encap_header_len(skb);
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
-                return NF_STOLEN;
        if (unlikely(!pskb_may_pull(skb, len)))
                goto out;
@@ -584,13 +580,11 @@ out:
 * took place when the packet entered the bridge), but we
 * register an IPv4 PRE_ROUTING 'sabotage' hook that will
 * prevent this from happening. */
-static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                   const struct net_device *in,
                                   const struct net_device *out,
                                   int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff *skb = *pskb;
        if (skb->dst == (struct dst_entry *)&__fake_rtable) {
                dst_release(skb->dst);
                skb->dst = NULL;
@@ -625,12 +619,11 @@ static int br_nf_forward_finish(struct sk_buff *skb)
 * but we are still able to filter on the 'real' indev/outdev
 * because of the physdev module. For ARP, indev and outdev are the
 * bridge ports. */
-static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
                                     const struct net_device *in,
                                     const struct net_device *out,
                                     int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff *skb = *pskb;
        struct nf_bridge_info *nf_bridge;
        struct net_device *parent;
        int pf;
@@ -648,7 +641,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
        else
                pf = PF_INET6;
-        nf_bridge_pull_encap_header(*pskb);
+        nf_bridge_pull_encap_header(skb);
        nf_bridge = skb->nf_bridge;
        if (skb->pkt_type == PACKET_OTHERHOST) {
@@ -666,12 +659,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
        return NF_STOLEN;
 }
-static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff *skb = *pskb;
        struct net_device **d = (struct net_device **)(skb->cb);
 #ifdef CONFIG_SYSCTL
@@ -682,12 +674,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
        if (skb->protocol != htons(ETH_P_ARP)) {
                if (!IS_VLAN_ARP(skb))
                        return NF_ACCEPT;
-                nf_bridge_pull_encap_header(*pskb);
+                nf_bridge_pull_encap_header(skb);
        }
        if (arp_hdr(skb)->ar_pln != 4) {
                if (IS_VLAN_ARP(skb))
-                        nf_bridge_push_encap_header(*pskb);
+                        nf_bridge_push_encap_header(skb);
                return NF_ACCEPT;
        }
        *d = (struct net_device *)in;
@@ -709,13 +701,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
 * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
 * will be executed.
 */
-static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
        struct net_device *realindev;
-        struct sk_buff *skb = *pskb;
        struct nf_bridge_info *nf_bridge;
        if (!skb->nf_bridge)
@@ -752,13 +743,12 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 }
 /* PF_BRIDGE/POST_ROUTING ********************************************/
-static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
+static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
                                       const struct net_device *in,
                                       const struct net_device *out,
                                       int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff *skb = *pskb;
+        struct nf_bridge_info *nf_bridge = skb->nf_bridge;
-        struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
        struct net_device *realoutdev = bridge_parent(skb->dev);
        int pf;
@@ -828,13 +818,13 @@ print_error:
 /* IP/SABOTAGE *****************************************************/
 /* Don't hand locally destined packets to PF_INET(6)/PRE_ROUTING
 * for the second time. */
-static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff **pskb,
+static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
                                   const struct net_device *in,
                                   const struct net_device *out,
                                   int (*okfn)(struct sk_buff *))
 {
-        if ((*pskb)->nf_bridge &&
+        if (skb->nf_bridge &&
-            !((*pskb)->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
+            !(skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
                return NF_STOP;
        }
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index ffe468a632e7..48a80e423287 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -15,7 +15,7 @@
 #include <net/arp.h>
 #include <linux/module.h>
-static int ebt_target_reply(struct sk_buff **pskb, unsigned int hooknr,
+static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
   const struct net_device *in, const struct net_device *out,
   const void *data, unsigned int datalen)
 {
@@ -23,7 +23,6 @@ static int ebt_target_reply(struct sk_buff **pskb, unsigned int hooknr,
        __be32 _sip, *siptr, _dip, *diptr;
        struct arphdr _ah, *ap;
        unsigned char _sha[ETH_ALEN], *shp;
-        struct sk_buff *skb = *pskb;
        ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
        if (ap == NULL)
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 4582659dff0e..74262e9a566a 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -8,29 +8,22 @@
 *
 */
+#include <linux/netfilter.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nat.h>
 #include <linux/module.h>
 #include <net/sock.h>
-static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
+static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
   const struct net_device *in, const struct net_device *out,
   const void *data, unsigned int datalen)
 {
        struct ebt_nat_info *info = (struct ebt_nat_info *)data;
-        if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+        if (skb_make_writable(skb, 0))
-                struct sk_buff *nskb;
+                return NF_DROP;
-                nskb = skb_copy(*pskb, GFP_ATOMIC);
+        memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
-                if (!nskb)
-                        return NF_DROP;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
-        memcpy(eth_hdr(*pskb)->h_dest, info->mac, ETH_ALEN);
        return info->target;
 }
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 62d23c7b25e6..6cba54309c09 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -17,7 +17,7 @@
 #include <linux/netfilter_bridge/ebt_mark_t.h>
 #include <linux/module.h>
-static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
+static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
   const struct net_device *in, const struct net_device *out,
   const void *data, unsigned int datalen)
 {
@@ -25,13 +25,13 @@ static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
        int action = info->target & -16;
        if (action == MARK_SET_VALUE)
-                (*pskb)->mark = info->mark;
+                skb->mark = info->mark;
        else if (action == MARK_OR_VALUE)
-                (*pskb)->mark |= info->mark;
+                skb->mark |= info->mark;
        else if (action == MARK_AND_VALUE)
-                (*pskb)->mark &= info->mark;
+                skb->mark &= info->mark;
        else
-                (*pskb)->mark ^= info->mark;
+                skb->mark ^= info->mark;
        return info->target | ~EBT_VERDICT_BITS;
 }
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 9f378eab72d0..422cb834cff9 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -8,35 +8,28 @@
 *
 */
+#include <linux/netfilter.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_redirect.h>
 #include <linux/module.h>
 #include <net/sock.h>
 #include "../br_private.h"
-static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
+static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
   const struct net_device *in, const struct net_device *out,
   const void *data, unsigned int datalen)
 {
        struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
-        if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+        if (skb_make_writable(skb, 0))
-                struct sk_buff *nskb;
+                return NF_DROP;
-                nskb = skb_copy(*pskb, GFP_ATOMIC);
-                if (!nskb)
-                        return NF_DROP;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
        if (hooknr != NF_BR_BROUTING)
-                memcpy(eth_hdr(*pskb)->h_dest,
+                memcpy(eth_hdr(skb)->h_dest,
                       in->br_port->br->dev->dev_addr, ETH_ALEN);
        else
-                memcpy(eth_hdr(*pskb)->h_dest, in->dev_addr, ETH_ALEN);
+                memcpy(eth_hdr(skb)->h_dest, in->dev_addr, ETH_ALEN);
-        (*pskb)->pkt_type = PACKET_HOST;
+        skb->pkt_type = PACKET_HOST;
        return info->target;
 }
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index a50722182bfe..425ac920904d 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -8,6 +8,7 @@
 *
 */
+#include <linux/netfilter.h>
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nat.h>
 #include <linux/module.h>
@@ -15,34 +16,26 @@
 #include <linux/if_arp.h>
 #include <net/arp.h>
-static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
+static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
   const struct net_device *in, const struct net_device *out,
   const void *data, unsigned int datalen)
 {
        struct ebt_nat_info *info = (struct ebt_nat_info *) data;
-        if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+        if (skb_make_writable(skb, 0))
-                struct sk_buff *nskb;
+                return NF_DROP;
-                nskb = skb_copy(*pskb, GFP_ATOMIC);
+        memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
-                if (!nskb)
-                        return NF_DROP;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
-        memcpy(eth_hdr(*pskb)->h_source, info->mac, ETH_ALEN);
        if (!(info->target & NAT_ARP_BIT) &&
-            eth_hdr(*pskb)->h_proto == htons(ETH_P_ARP)) {
+            eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
                struct arphdr _ah, *ap;
-                ap = skb_header_pointer(*pskb, 0, sizeof(_ah), &_ah);
+                ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
                if (ap == NULL)
                        return EBT_DROP;
                if (ap->ar_hln != ETH_ALEN)
                        goto out;
-                if (skb_store_bits(*pskb, sizeof(_ah), info->mac,ETH_ALEN))
+                if (skb_store_bits(skb, sizeof(_ah), info->mac,ETH_ALEN))
                        return EBT_DROP;
        }
 out:
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index d37ce0478938..e44519ebf1d2 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -51,11 +51,11 @@ static struct ebt_table broute_table =
        .me             = THIS_MODULE,
 };
-static int ebt_broute(struct sk_buff **pskb)
+static int ebt_broute(struct sk_buff *skb)
 {
        int ret;
-        ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
+        ret = ebt_do_table(NF_BR_BROUTING, skb, skb->dev, NULL,
           &broute_table);
        if (ret == NF_DROP)
                return 1; /* route it */
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 81d84145c417..210493f99bc4 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -61,10 +61,10 @@ static struct ebt_table frame_filter =
 };
 static unsigned int
-ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
+ebt_hook(unsigned int hook, struct sk_buff *skb, const struct net_device *in,
   const struct net_device *out, int (*okfn)(struct sk_buff *))
 {
-        return ebt_do_table(hook, pskb, in, out, &frame_filter);
+        return ebt_do_table(hook, skb, in, out, &frame_filter);
 }
 static struct nf_hook_ops ebt_ops_filter[] = {
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 9c50488b62eb..3e58c2e5ee21 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -61,17 +61,17 @@ static struct ebt_table frame_nat =
 };
 static unsigned int
-ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
+ebt_nat_dst(unsigned int hook, struct sk_buff *skb, const struct net_device *in
   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 {
-        return ebt_do_table(hook, pskb, in, out, &frame_nat);
+        return ebt_do_table(hook, skb, in, out, &frame_nat);
 }
 static unsigned int
-ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
+ebt_nat_src(unsigned int hook, struct sk_buff *skb, const struct net_device *in
   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 {
-        return ebt_do_table(hook, pskb, in, out, &frame_nat);
+        return ebt_do_table(hook, skb, in, out, &frame_nat);
 }
 static struct nf_hook_ops ebt_ops_nat[] = {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 6018d0e51938..d5a09eaef915 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -142,7 +142,7 @@ static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 }
 /* Do some firewalling */
-unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
+unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
   const struct net_device *in, const struct net_device *out,
   struct ebt_table *table)
 {
@@ -172,19 +172,19 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
        base = private->entries;
        i = 0;
        while (i < nentries) {
-                if (ebt_basic_match(point, eth_hdr(*pskb), in, out))
+                if (ebt_basic_match(point, eth_hdr(skb), in, out))
                        goto letscontinue;
-                if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
+                if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, in, out) != 0)
                        goto letscontinue;
                /* increase counter */
                (*(counter_base + i)).pcnt++;
-                (*(counter_base + i)).bcnt+=(**pskb).len;
+                (*(counter_base + i)).bcnt += skb->len;
                /* these should only watch: not modify, nor tell us
                   what to do with the packet */
-                EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
+                EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, hook, in,
                   out);
                t = (struct ebt_entry_target *)
@@ -193,7 +193,7 @@ unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
                if (!t->u.target->target)
                        verdict = ((struct ebt_standard_target *)t)->verdict;
                else
-                        verdict = t->u.target->target(pskb, hook,
+                        verdict = t->u.target->target(skb, hook,
                           in, out, t->data, t->target_size);
                if (verdict == EBT_ACCEPT) {
                        read_unlock_bh(&table->lock);
diff --git a/net/core/dev.c b/net/core/dev.c
index 99b7bda37d10..38b03da5c1ca 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1362,22 +1362,21 @@ int skb_checksum_help(struct sk_buff *skb)
                goto out_set_summed;
        }
-        if (skb_cloned(skb)) {
+        offset = skb->csum_start - skb_headroom(skb);
+        BUG_ON(offset >= skb_headlen(skb));
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        BUG_ON(offset + sizeof(__sum16) > skb_headlen(skb));
+        if (skb_cloned(skb) &&
+            !skb_clone_writable(skb, offset + sizeof(__sum16))) {
                ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
                if (ret)
                        goto out;
        }
-        offset = skb->csum_start - skb_headroom(skb);
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-        BUG_ON(offset > (int)skb->len);
-        csum = skb_checksum(skb, offset, skb->len-offset, 0);
-        offset = skb_headlen(skb) - offset;
-        BUG_ON(offset <= 0);
-        BUG_ON(skb->csum_offset + 2 > offset);
-        *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) =
-                csum_fold(csum);
 out_set_summed:
        skb->ip_summed = CHECKSUM_NONE;
 out:
@@ -1949,27 +1948,51 @@ static int ing_filter(struct sk_buff *skb)
        struct Qdisc *q;
        struct net_device *dev = skb->dev;
        int result = TC_ACT_OK;
+        u32 ttl = G_TC_RTTL(skb->tc_verd);
-        if (dev->qdisc_ingress) {
+        if (MAX_RED_LOOP < ttl++) {
-                __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
+                printk(KERN_WARNING
-                if (MAX_RED_LOOP < ttl++) {
+                       "Redir loop detected Dropping packet (%d->%d)\n",
-                        printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
+                       skb->iif, dev->ifindex);
-                                skb->iif, skb->dev->ifindex);
+                return TC_ACT_SHOT;
-                        return TC_ACT_SHOT;
+        }
-                }
+        skb->tc_verd = SET_TC_RTTL(skb->tc_verd, ttl);
+        skb->tc_verd = SET_TC_AT(skb->tc_verd, AT_INGRESS);
-                skb->tc_verd = SET_TC_RTTL(skb->tc_verd,ttl);
+        spin_lock(&dev->ingress_lock);
+        if ((q = dev->qdisc_ingress) != NULL)
+                result = q->enqueue(skb, q);
+        spin_unlock(&dev->ingress_lock);
-                skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
+        return result;
+}
+static inline struct sk_buff *handle_ing(struct sk_buff *skb,
+                                         struct packet_type **pt_prev,
+                                         int *ret, struct net_device *orig_dev)
+{
+        if (!skb->dev->qdisc_ingress)
+                goto out;
-                spin_lock(&dev->ingress_lock);
+        if (*pt_prev) {
-                if ((q = dev->qdisc_ingress) != NULL)
+                *ret = deliver_skb(skb, *pt_prev, orig_dev);
-                        result = q->enqueue(skb, q);
+                *pt_prev = NULL;
-                spin_unlock(&dev->ingress_lock);
+        } else {
+                /* Huh? Why does turning on AF_PACKET affect this? */
+                skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
+        }
+        switch (ing_filter(skb)) {
+        case TC_ACT_SHOT:
+        case TC_ACT_STOLEN:
+                kfree_skb(skb);
+                return NULL;
        }
-        return result;
+out:
+        skb->tc_verd = 0;
+        return skb;
 }
 #endif
@@ -2021,21 +2044,9 @@ int netif_receive_skb(struct sk_buff *skb)
        }
 #ifdef CONFIG_NET_CLS_ACT
-        if (pt_prev) {
+        skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
-                ret = deliver_skb(skb, pt_prev, orig_dev);
+        if (!skb)
-                pt_prev = NULL; /* noone else should process this after*/
-        } else {
-                skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
-        }
-        ret = ing_filter(skb);
-        if (ret == TC_ACT_SHOT || (ret == TC_ACT_STOLEN)) {
-                kfree_skb(skb);
                goto out;
-        }
-        skb->tc_verd = 0;
 ncls:
 #endif
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index c52df858d0be..cd3af59b38a1 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -481,6 +481,8 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl, const void *pkey,
        if (!creat)
                goto out;
+        ASSERT_RTNL();
        n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
        if (!n)
                goto out;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 944189d96323..70d9b5da96ae 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -362,6 +362,97 @@ void kfree_skb(struct sk_buff *skb)
        __kfree_skb(skb);
 }
+static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
+{
+        new->tstamp             = old->tstamp;
+        new->dev                = old->dev;
+        new->transport_header   = old->transport_header;
+        new->network_header     = old->network_header;
+        new->mac_header         = old->mac_header;
+        new->dst                = dst_clone(old->dst);
+#ifdef CONFIG_INET
+        new->sp                 = secpath_get(old->sp);
+#endif
+        memcpy(new->cb, old->cb, sizeof(old->cb));
+        new->csum_start         = old->csum_start;
+        new->csum_offset        = old->csum_offset;
+        new->local_df           = old->local_df;
+        new->pkt_type           = old->pkt_type;
+        new->ip_summed          = old->ip_summed;
+        skb_copy_queue_mapping(new, old);
+        new->priority           = old->priority;
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        new->ipvs_property      = old->ipvs_property;
+#endif
+        new->protocol           = old->protocol;
+        new->mark               = old->mark;
+        __nf_copy(new, old);
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+        new->nf_trace           = old->nf_trace;
+#endif
+#ifdef CONFIG_NET_SCHED
+        new->tc_index           = old->tc_index;
+#ifdef CONFIG_NET_CLS_ACT
+        new->tc_verd            = old->tc_verd;
+#endif
+#endif
+        skb_copy_secmark(new, old);
+}
+static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
+{
+#define C(x) n->x = skb->x
+        n->next = n->prev = NULL;
+        n->sk = NULL;
+        __copy_skb_header(n, skb);
+        C(len);
+        C(data_len);
+        C(mac_len);
+        n->cloned = 1;
+        n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
+        n->nohdr = 0;
+        n->destructor = NULL;
+#ifdef CONFIG_NET_CLS_ACT
+        /* FIXME What is this and why don't we do it in copy_skb_header? */
+        n->tc_verd = SET_TC_VERD(n->tc_verd,0);
+        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
+        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
+        C(iif);
+#endif
+        C(truesize);
+        atomic_set(&n->users, 1);
+        C(head);
+        C(data);
+        C(tail);
+        C(end);
+        atomic_inc(&(skb_shinfo(skb)->dataref));
+        skb->cloned = 1;
+        return n;
+#undef C
+}
+/**
+ *      skb_morph       -       morph one skb into another
+ *      @dst: the skb to receive the contents
+ *      @src: the skb to supply the contents
+ *
+ *      This is identical to skb_clone except that the target skb is
+ *      supplied by the user.
+ *
+ *      The target skb is returned upon exit.
+ */
+struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src)
+{
+        skb_release_data(dst);
+        return __skb_clone(dst, src);
+}
+EXPORT_SYMBOL_GPL(skb_morph);
 /**
 *      skb_clone       -       duplicate an sk_buff
 *      @skb: buffer to clone
@@ -393,66 +484,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
                n->fclone = SKB_FCLONE_UNAVAILABLE;
        }
-#define C(x) n->x = skb->x
+        return __skb_clone(n, skb);
-        n->next = n->prev = NULL;
-        n->sk = NULL;
-        C(tstamp);
-        C(dev);
-        C(transport_header);
-        C(network_header);
-        C(mac_header);
-        C(dst);
-        dst_clone(skb->dst);
-        C(sp);
-#ifdef CONFIG_INET
-        secpath_get(skb->sp);
-#endif
-        memcpy(n->cb, skb->cb, sizeof(skb->cb));
-        C(len);
-        C(data_len);
-        C(mac_len);
-        C(csum);
-        C(local_df);
-        n->cloned = 1;
-        n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
-        n->nohdr = 0;
-        C(pkt_type);
-        C(ip_summed);
-        skb_copy_queue_mapping(n, skb);
-        C(priority);
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-        C(ipvs_property);
-#endif
-        C(protocol);
-        n->destructor = NULL;
-        C(mark);
-        __nf_copy(n, skb);
-#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
-    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
-        C(nf_trace);
-#endif
-#ifdef CONFIG_NET_SCHED
-        C(tc_index);
-#ifdef CONFIG_NET_CLS_ACT
-        n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
-        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
-        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-        C(iif);
-#endif
-#endif
-        skb_copy_secmark(n, skb);
-        C(truesize);
-        atomic_set(&n->users, 1);
-        C(head);
-        C(data);
-        C(tail);
-        C(end);
-        atomic_inc(&(skb_shinfo(skb)->dataref));
-        skb->cloned = 1;
-        return n;
 }
 static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
@@ -463,50 +495,15 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         */
        unsigned long offset = new->data - old->data;
 #endif
-        new->sk         = NULL;
-        new->dev        = old->dev;
+        __copy_skb_header(new, old);
-        skb_copy_queue_mapping(new, old);
-        new->priority   = old->priority;
-        new->protocol   = old->protocol;
-        new->dst        = dst_clone(old->dst);
-#ifdef CONFIG_INET
-        new->sp         = secpath_get(old->sp);
-#endif
-        new->csum_start = old->csum_start;
-        new->csum_offset = old->csum_offset;
-        new->ip_summed = old->ip_summed;
-        new->transport_header = old->transport_header;
-        new->network_header   = old->network_header;
-        new->mac_header       = old->mac_header;
 #ifndef NET_SKBUFF_DATA_USES_OFFSET
        /* {transport,network,mac}_header are relative to skb->head */
        new->transport_header += offset;
        new->network_header   += offset;
        new->mac_header       += offset;
 #endif
-        memcpy(new->cb, old->cb, sizeof(old->cb));
-        new->local_df   = old->local_df;
-        new->fclone     = SKB_FCLONE_UNAVAILABLE;
-        new->pkt_type   = old->pkt_type;
-        new->tstamp     = old->tstamp;
-        new->destructor = NULL;
-        new->mark       = old->mark;
-        __nf_copy(new, old);
-#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
-    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
-        new->nf_trace   = old->nf_trace;
-#endif
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-        new->ipvs_property = old->ipvs_property;
-#endif
-#ifdef CONFIG_NET_SCHED
-#ifdef CONFIG_NET_CLS_ACT
-        new->tc_verd = old->tc_verd;
-#endif
-        new->tc_index   = old->tc_index;
-#endif
-        skb_copy_secmark(new, old);
-        atomic_set(&new->users, 1);
        skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size;
        skb_shinfo(new)->gso_segs = skb_shinfo(old)->gso_segs;
        skb_shinfo(new)->gso_type = skb_shinfo(old)->gso_type;
@@ -685,7 +682,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
        skb->transport_header += off;
        skb->network_header   += off;
        skb->mac_header       += off;
-        skb->csum_start       += off;
+        skb->csum_start       += nhead;
        skb->cloned   = 0;
        skb->hdr_len  = 0;
        skb->nohdr    = 0;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 006a3834fbcd..cac53548c2d8 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -767,10 +767,9 @@ discard:
        return 0;
 }
-static int dccp_v6_rcv(struct sk_buff **pskb)
+static int dccp_v6_rcv(struct sk_buff *skb)
 {
        const struct dccp_hdr *dh;
-        struct sk_buff *skb = *pskb;
        struct sock *sk;
        int min_cov;
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index f7fba7721e63..43fcd29046d1 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -88,12 +88,12 @@ static void dnrmg_send_peer(struct sk_buff *skb)
 static unsigned int dnrmg_hook(unsigned int hook,
-                        struct sk_buff **pskb,
+                        struct sk_buff *skb,
                        const struct net_device *in,
                        const struct net_device *out,
                        int (*okfn)(struct sk_buff *))
 {
-        dnrmg_send_peer(*pskb);
+        dnrmg_send_peer(skb);
        return NF_ACCEPT;
 }
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index a02c36d0a13e..93fe3966805d 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -10,7 +10,8 @@ obj-y     := route.o inetpeer.o protocol.o \
             tcp_minisocks.o tcp_cong.o \
             datagram.o raw.o udp.o udplite.o \
             arp.o icmp.o devinet.o af_inet.o  igmp.o \
-             sysctl_net_ipv4.o fib_frontend.o fib_semantics.o
+             sysctl_net_ipv4.o fib_frontend.o fib_semantics.o \
+             inet_fragment.o
 obj-$(CONFIG_IP_FIB_HASH) += fib_hash.o
 obj-$(CONFIG_IP_FIB_TRIE) += fib_trie.o
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
new file mode 100644
index 000000000000..484cf512858f
--- /dev/null
+++ b/net/ipv4/inet_fragment.c
@@ -0,0 +1,174 @@
+/*
+ * inet fragments management
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ *              Authors:        Pavel Emelyanov <xemul@openvz.org>
+ *                              Started as consolidation of ipv4/ip_fragment.c,
+ *                              ipv6/reassembly. and ipv6 nf conntrack reassembly
+ */
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/timer.h>
+#include <linux/mm.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <linux/rtnetlink.h>
+#include <net/inet_frag.h>
+static void inet_frag_secret_rebuild(unsigned long dummy)
+{
+        struct inet_frags *f = (struct inet_frags *)dummy;
+        unsigned long now = jiffies;
+        int i;
+        write_lock(&f->lock);
+        get_random_bytes(&f->rnd, sizeof(u32));
+        for (i = 0; i < INETFRAGS_HASHSZ; i++) {
+                struct inet_frag_queue *q;
+                struct hlist_node *p, *n;
+                hlist_for_each_entry_safe(q, p, n, &f->hash[i], list) {
+                        unsigned int hval = f->hashfn(q);
+                        if (hval != i) {
+                                hlist_del(&q->list);
+                                /* Relink to new hash chain. */
+                                hlist_add_head(&q->list, &f->hash[hval]);
+                        }
+                }
+        }
+        write_unlock(&f->lock);
+        mod_timer(&f->secret_timer, now + f->ctl->secret_interval);
+}
+void inet_frags_init(struct inet_frags *f)
+{
+        int i;
+        for (i = 0; i < INETFRAGS_HASHSZ; i++)
+                INIT_HLIST_HEAD(&f->hash[i]);
+        INIT_LIST_HEAD(&f->lru_list);
+        rwlock_init(&f->lock);
+        f->rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
+                                   (jiffies ^ (jiffies >> 6)));
+        f->nqueues = 0;
+        atomic_set(&f->mem, 0);
+        init_timer(&f->secret_timer);
+        f->secret_timer.function = inet_frag_secret_rebuild;
+        f->secret_timer.data = (unsigned long)f;
+        f->secret_timer.expires = jiffies + f->ctl->secret_interval;
+        add_timer(&f->secret_timer);
+}
+EXPORT_SYMBOL(inet_frags_init);
+void inet_frags_fini(struct inet_frags *f)
+{
+        del_timer(&f->secret_timer);
+}
+EXPORT_SYMBOL(inet_frags_fini);
+static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f)
+{
+        write_lock(&f->lock);
+        hlist_del(&fq->list);
+        list_del(&fq->lru_list);
+        f->nqueues--;
+        write_unlock(&f->lock);
+}
+void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f)
+{
+        if (del_timer(&fq->timer))
+                atomic_dec(&fq->refcnt);
+        if (!(fq->last_in & COMPLETE)) {
+                fq_unlink(fq, f);
+                atomic_dec(&fq->refcnt);
+                fq->last_in |= COMPLETE;
+        }
+}
+EXPORT_SYMBOL(inet_frag_kill);
+static inline void frag_kfree_skb(struct inet_frags *f, struct sk_buff *skb,
+                                                int *work)
+{
+        if (work)
+                *work -= skb->truesize;
+        atomic_sub(skb->truesize, &f->mem);
+        if (f->skb_free)
+                f->skb_free(skb);
+        kfree_skb(skb);
+}
+void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f,
+                                        int *work)
+{
+        struct sk_buff *fp;
+        BUG_TRAP(q->last_in & COMPLETE);
+        BUG_TRAP(del_timer(&q->timer) == 0);
+        /* Release all fragment data. */
+        fp = q->fragments;
+        while (fp) {
+                struct sk_buff *xp = fp->next;
+                frag_kfree_skb(f, fp, work);
+                fp = xp;
+        }
+        if (work)
+                *work -= f->qsize;
+        atomic_sub(f->qsize, &f->mem);
+        f->destructor(q);
+}
+EXPORT_SYMBOL(inet_frag_destroy);
+int inet_frag_evictor(struct inet_frags *f)
+{
+        struct inet_frag_queue *q;
+        int work, evicted = 0;
+        work = atomic_read(&f->mem) - f->ctl->low_thresh;
+        while (work > 0) {
+                read_lock(&f->lock);
+                if (list_empty(&f->lru_list)) {
+                        read_unlock(&f->lock);
+                        break;
+                }
+                q = list_first_entry(&f->lru_list,
+                                struct inet_frag_queue, lru_list);
+                atomic_inc(&q->refcnt);
+                read_unlock(&f->lock);
+                spin_lock(&q->lock);
+                if (!(q->last_in & COMPLETE))
+                        inet_frag_kill(q, f);
+                spin_unlock(&q->lock);
+                if (atomic_dec_and_test(&q->refcnt))
+                        inet_frag_destroy(q, f, &work);
+                evicted++;
+        }
+        return evicted;
+}
+EXPORT_SYMBOL(inet_frag_evictor);
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index afbf938836f5..877da3ed52e2 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -40,7 +40,7 @@
 #include <net/route.h>
 #include <net/xfrm.h>
-static inline int ip_forward_finish(struct sk_buff *skb)
+static int ip_forward_finish(struct sk_buff *skb)
 {
        struct ip_options * opt = &(IPCB(skb)->opt);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index fabb86db763b..443b3f89192f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -39,6 +39,7 @@
 #include <net/icmp.h>
 #include <net/checksum.h>
 #include <net/inetpeer.h>
+#include <net/inet_frag.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <linux/inet.h>
@@ -49,21 +50,8 @@
 * as well. Or notify me, at least. --ANK
 */
-/* Fragment cache limits. We will commit 256K at one time. Should we
- * cross that limit we will prune down to 192K. This should cope with
- * even the most extreme cases without allowing an attacker to measurably
- * harm machine performance.
- */
-int sysctl_ipfrag_high_thresh __read_mostly = 256*1024;
-int sysctl_ipfrag_low_thresh __read_mostly = 192*1024;
 int sysctl_ipfrag_max_dist __read_mostly = 64;
-/* Important NOTE! Fragment queue must be destroyed before MSL expires.
- * RFC791 is wrong proposing to prolongate timer each fragment arrival by TTL.
- */
-int sysctl_ipfrag_time __read_mostly = IP_FRAG_TIME;
 struct ipfrag_skb_cb
 {
        struct inet_skb_parm    h;
@@ -74,153 +62,102 @@ struct ipfrag_skb_cb
 /* Describe an entry in the "incomplete datagrams" queue. */
 struct ipq {
-        struct hlist_node list;
+        struct inet_frag_queue q;
-        struct list_head lru_list;      /* lru list member                      */
        u32             user;
        __be32          saddr;
        __be32          daddr;
        __be16          id;
        u8              protocol;
-        u8              last_in;
-#define COMPLETE                4
-#define FIRST_IN                2
-#define LAST_IN                 1
-        struct sk_buff  *fragments;     /* linked list of received fragments    */
-        int             len;            /* total length of original datagram    */
-        int             meat;
-        spinlock_t      lock;
-        atomic_t        refcnt;
-        struct timer_list timer;        /* when will this queue expire?         */
-        ktime_t         stamp;
        int             iif;
        unsigned int    rid;
        struct inet_peer *peer;
 };
-/* Hash table. */
+struct inet_frags_ctl ip4_frags_ctl __read_mostly = {
+        /*
+         * Fragment cache limits. We will commit 256K at one time. Should we
+         * cross that limit we will prune down to 192K. This should cope with
+         * even the most extreme cases without allowing an attacker to
+         * measurably harm machine performance.
+         */
+        .high_thresh     = 256 * 1024,
+        .low_thresh      = 192 * 1024,
-#define IPQ_HASHSZ      64
+        /*
+         * Important NOTE! Fragment queue must be destroyed before MSL expires.
+         * RFC791 is wrong proposing to prolongate timer each fragment arrival
+         * by TTL.
+         */
+        .timeout         = IP_FRAG_TIME,
+        .secret_interval = 10 * 60 * HZ,
+};
-/* Per-bucket lock is easy to add now. */
+static struct inet_frags ip4_frags;
-static struct hlist_head ipq_hash[IPQ_HASHSZ];
-static DEFINE_RWLOCK(ipfrag_lock);
-static u32 ipfrag_hash_rnd;
-static LIST_HEAD(ipq_lru_list);
-int ip_frag_nqueues = 0;
-static __inline__ void __ipq_unlink(struct ipq *qp)
+int ip_frag_nqueues(void)
 {
-        hlist_del(&qp->list);
+        return ip4_frags.nqueues;
-        list_del(&qp->lru_list);
-        ip_frag_nqueues--;
 }
-static __inline__ void ipq_unlink(struct ipq *ipq)
+int ip_frag_mem(void)
 {
-        write_lock(&ipfrag_lock);
+        return atomic_read(&ip4_frags.mem);
-        __ipq_unlink(ipq);
-        write_unlock(&ipfrag_lock);
 }
+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+                         struct net_device *dev);
 static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot)
 {
        return jhash_3words((__force u32)id << 16 | prot,
                            (__force u32)saddr, (__force u32)daddr,
-                            ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
+                            ip4_frags.rnd) & (INETFRAGS_HASHSZ - 1);
 }
-static struct timer_list ipfrag_secret_timer;
+static unsigned int ip4_hashfn(struct inet_frag_queue *q)
-int sysctl_ipfrag_secret_interval __read_mostly = 10 * 60 * HZ;
-static void ipfrag_secret_rebuild(unsigned long dummy)
 {
-        unsigned long now = jiffies;
+        struct ipq *ipq;
-        int i;
-        write_lock(&ipfrag_lock);
-        get_random_bytes(&ipfrag_hash_rnd, sizeof(u32));
-        for (i = 0; i < IPQ_HASHSZ; i++) {
-                struct ipq *q;
-                struct hlist_node *p, *n;
-                hlist_for_each_entry_safe(q, p, n, &ipq_hash[i], list) {
-                        unsigned int hval = ipqhashfn(q->id, q->saddr,
-                                                      q->daddr, q->protocol);
-                        if (hval != i) {
-                                hlist_del(&q->list);
-                                /* Relink to new hash chain. */
+        ipq = container_of(q, struct ipq, q);
-                                hlist_add_head(&q->list, &ipq_hash[hval]);
+        return ipqhashfn(ipq->id, ipq->saddr, ipq->daddr, ipq->protocol);
-                        }
-                }
-        }
-        write_unlock(&ipfrag_lock);
-        mod_timer(&ipfrag_secret_timer, now + sysctl_ipfrag_secret_interval);
 }
-atomic_t ip_frag_mem = ATOMIC_INIT(0);  /* Memory used for fragments */
 /* Memory Tracking Functions. */
 static __inline__ void frag_kfree_skb(struct sk_buff *skb, int *work)
 {
        if (work)
                *work -= skb->truesize;
-        atomic_sub(skb->truesize, &ip_frag_mem);
+        atomic_sub(skb->truesize, &ip4_frags.mem);
        kfree_skb(skb);
 }
-static __inline__ void frag_free_queue(struct ipq *qp, int *work)
+static __inline__ void ip4_frag_free(struct inet_frag_queue *q)
 {
-        if (work)
+        struct ipq *qp;
-                *work -= sizeof(struct ipq);
-        atomic_sub(sizeof(struct ipq), &ip_frag_mem);
+        qp = container_of(q, struct ipq, q);
+        if (qp->peer)
+                inet_putpeer(qp->peer);
        kfree(qp);
 }
 static __inline__ struct ipq *frag_alloc_queue(void)
 {
-        struct ipq *qp = kmalloc(sizeof(struct ipq), GFP_ATOMIC);
+        struct ipq *qp = kzalloc(sizeof(struct ipq), GFP_ATOMIC);
        if (!qp)
                return NULL;
-        atomic_add(sizeof(struct ipq), &ip_frag_mem);
+        atomic_add(sizeof(struct ipq), &ip4_frags.mem);
        return qp;
 }
 /* Destruction primitives. */
-/* Complete destruction of ipq. */
+static __inline__ void ipq_put(struct ipq *ipq)
-static void ip_frag_destroy(struct ipq *qp, int *work)
-{
-        struct sk_buff *fp;
-        BUG_TRAP(qp->last_in&COMPLETE);
-        BUG_TRAP(del_timer(&qp->timer) == 0);
-        if (qp->peer)
-                inet_putpeer(qp->peer);
-        /* Release all fragment data. */
-        fp = qp->fragments;
-        while (fp) {
-                struct sk_buff *xp = fp->next;
-                frag_kfree_skb(fp, work);
-                fp = xp;
-        }
-        /* Finally, release the queue descriptor itself. */
-        frag_free_queue(qp, work);
-}
-static __inline__ void ipq_put(struct ipq *ipq, int *work)
 {
-        if (atomic_dec_and_test(&ipq->refcnt))
+        inet_frag_put(&ipq->q, &ip4_frags);
-                ip_frag_destroy(ipq, work);
 }
 /* Kill ipq entry. It is not destroyed immediately,
@@ -228,14 +165,7 @@ static __inline__ void ipq_put(struct ipq *ipq, int *work)
 */
 static void ipq_kill(struct ipq *ipq)
 {
-        if (del_timer(&ipq->timer))
+        inet_frag_kill(&ipq->q, &ip4_frags);
-                atomic_dec(&ipq->refcnt);
-        if (!(ipq->last_in & COMPLETE)) {
-                ipq_unlink(ipq);
-                atomic_dec(&ipq->refcnt);
-                ipq->last_in |= COMPLETE;
-        }
 }
 /* Memory limiting on fragments.  Evictor trashes the oldest
@@ -243,33 +173,11 @@ static void ipq_kill(struct ipq *ipq)
 */
 static void ip_evictor(void)
 {
-        struct ipq *qp;
+        int evicted;
-        struct list_head *tmp;
-        int work;
-        work = atomic_read(&ip_frag_mem) - sysctl_ipfrag_low_thresh;
-        if (work <= 0)
-                return;
-        while (work > 0) {
-                read_lock(&ipfrag_lock);
-                if (list_empty(&ipq_lru_list)) {
-                        read_unlock(&ipfrag_lock);
-                        return;
-                }
-                tmp = ipq_lru_list.next;
-                qp = list_entry(tmp, struct ipq, lru_list);
-                atomic_inc(&qp->refcnt);
-                read_unlock(&ipfrag_lock);
-                spin_lock(&qp->lock);
+        evicted = inet_frag_evictor(&ip4_frags);
-                if (!(qp->last_in&COMPLETE))
+        if (evicted)
-                        ipq_kill(qp);
+                IP_ADD_STATS_BH(IPSTATS_MIB_REASMFAILS, evicted);
-                spin_unlock(&qp->lock);
-                ipq_put(qp, &work);
-                IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
-        }
 }
 /*
@@ -279,9 +187,9 @@ static void ip_expire(unsigned long arg)
 {
        struct ipq *qp = (struct ipq *) arg;
-        spin_lock(&qp->lock);
+        spin_lock(&qp->q.lock);
-        if (qp->last_in & COMPLETE)
+        if (qp->q.last_in & COMPLETE)
                goto out;
        ipq_kill(qp);
@@ -289,8 +197,8 @@ static void ip_expire(unsigned long arg)
        IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
        IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
-        if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
+        if ((qp->q.last_in&FIRST_IN) && qp->q.fragments != NULL) {
-                struct sk_buff *head = qp->fragments;
+                struct sk_buff *head = qp->q.fragments;
                /* Send an ICMP "Fragment Reassembly Timeout" message. */
                if ((head->dev = dev_get_by_index(&init_net, qp->iif)) != NULL) {
                        icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
@@ -298,8 +206,8 @@ static void ip_expire(unsigned long arg)
                }
        }
 out:
-        spin_unlock(&qp->lock);
+        spin_unlock(&qp->q.lock);
-        ipq_put(qp, NULL);
+        ipq_put(qp);
 }
 /* Creation primitives. */
@@ -312,7 +220,7 @@ static struct ipq *ip_frag_intern(struct ipq *qp_in)
 #endif
        unsigned int hash;
-        write_lock(&ipfrag_lock);
+        write_lock(&ip4_frags.lock);
        hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
                         qp_in->protocol);
 #ifdef CONFIG_SMP
@@ -320,31 +228,31 @@ static struct ipq *ip_frag_intern(struct ipq *qp_in)
         * such entry could be created on other cpu, while we
         * promoted read lock to write lock.
         */
-        hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
+        hlist_for_each_entry(qp, n, &ip4_frags.hash[hash], q.list) {
                if (qp->id == qp_in->id         &&
                    qp->saddr == qp_in->saddr   &&
                    qp->daddr == qp_in->daddr   &&
                    qp->protocol == qp_in->protocol &&
                    qp->user == qp_in->user) {
-                        atomic_inc(&qp->refcnt);
+                        atomic_inc(&qp->q.refcnt);
-                        write_unlock(&ipfrag_lock);
+                        write_unlock(&ip4_frags.lock);
-                        qp_in->last_in |= COMPLETE;
+                        qp_in->q.last_in |= COMPLETE;
-                        ipq_put(qp_in, NULL);
+                        ipq_put(qp_in);
                        return qp;
                }
        }
 #endif
        qp = qp_in;
-        if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time))
+        if (!mod_timer(&qp->q.timer, jiffies + ip4_frags_ctl.timeout))
-                atomic_inc(&qp->refcnt);
+                atomic_inc(&qp->q.refcnt);
-        atomic_inc(&qp->refcnt);
+        atomic_inc(&qp->q.refcnt);
-        hlist_add_head(&qp->list, &ipq_hash[hash]);
+        hlist_add_head(&qp->q.list, &ip4_frags.hash[hash]);
-        INIT_LIST_HEAD(&qp->lru_list);
+        INIT_LIST_HEAD(&qp->q.lru_list);
-        list_add_tail(&qp->lru_list, &ipq_lru_list);
+        list_add_tail(&qp->q.lru_list, &ip4_frags.lru_list);
-        ip_frag_nqueues++;
+        ip4_frags.nqueues++;
-        write_unlock(&ipfrag_lock);
+        write_unlock(&ip4_frags.lock);
        return qp;
 }
@@ -357,23 +265,18 @@ static struct ipq *ip_frag_create(struct iphdr *iph, u32 user)
                goto out_nomem;
        qp->protocol = iph->protocol;
-        qp->last_in = 0;
        qp->id = iph->id;
        qp->saddr = iph->saddr;
        qp->daddr = iph->daddr;
        qp->user = user;
-        qp->len = 0;
-        qp->meat = 0;
-        qp->fragments = NULL;
-        qp->iif = 0;
        qp->peer = sysctl_ipfrag_max_dist ? inet_getpeer(iph->saddr, 1) : NULL;
        /* Initialize a timer for this entry. */
-        init_timer(&qp->timer);
+        init_timer(&qp->q.timer);
-        qp->timer.data = (unsigned long) qp;    /* pointer to queue     */
+        qp->q.timer.data = (unsigned long) qp;  /* pointer to queue     */
-        qp->timer.function = ip_expire;         /* expire function      */
+        qp->q.timer.function = ip_expire;               /* expire function      */
-        spin_lock_init(&qp->lock);
+        spin_lock_init(&qp->q.lock);
-        atomic_set(&qp->refcnt, 1);
+        atomic_set(&qp->q.refcnt, 1);
        return ip_frag_intern(qp);
@@ -395,20 +298,20 @@ static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
        struct ipq *qp;
        struct hlist_node *n;
-        read_lock(&ipfrag_lock);
+        read_lock(&ip4_frags.lock);
        hash = ipqhashfn(id, saddr, daddr, protocol);
-        hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
+        hlist_for_each_entry(qp, n, &ip4_frags.hash[hash], q.list) {
                if (qp->id == id                &&
                    qp->saddr == saddr  &&
                    qp->daddr == daddr  &&
                    qp->protocol == protocol &&
                    qp->user == user) {
-                        atomic_inc(&qp->refcnt);
+                        atomic_inc(&qp->q.refcnt);
-                        read_unlock(&ipfrag_lock);
+                        read_unlock(&ip4_frags.lock);
                        return qp;
                }
        }
-        read_unlock(&ipfrag_lock);
+        read_unlock(&ip4_frags.lock);
        return ip_frag_create(iph, user);
 }
@@ -429,7 +332,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
        end = atomic_inc_return(&peer->rid);
        qp->rid = end;
-        rc = qp->fragments && (end - start) > max;
+        rc = qp->q.fragments && (end - start) > max;
        if (rc) {
                IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
@@ -442,39 +345,42 @@ static int ip_frag_reinit(struct ipq *qp)
 {
        struct sk_buff *fp;
-        if (!mod_timer(&qp->timer, jiffies + sysctl_ipfrag_time)) {
+        if (!mod_timer(&qp->q.timer, jiffies + ip4_frags_ctl.timeout)) {
-                atomic_inc(&qp->refcnt);
+                atomic_inc(&qp->q.refcnt);
                return -ETIMEDOUT;
        }
-        fp = qp->fragments;
+        fp = qp->q.fragments;
        do {
                struct sk_buff *xp = fp->next;
                frag_kfree_skb(fp, NULL);
                fp = xp;
        } while (fp);
-        qp->last_in = 0;
+        qp->q.last_in = 0;
-        qp->len = 0;
+        qp->q.len = 0;
-        qp->meat = 0;
+        qp->q.meat = 0;
-        qp->fragments = NULL;
+        qp->q.fragments = NULL;
        qp->iif = 0;
        return 0;
 }
 /* Add new segment to existing queue. */
-static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
 {
        struct sk_buff *prev, *next;
+        struct net_device *dev;
        int flags, offset;
        int ihl, end;
+        int err = -ENOENT;
-        if (qp->last_in & COMPLETE)
+        if (qp->q.last_in & COMPLETE)
                goto err;
        if (!(IPCB(skb)->flags & IPSKB_FRAG_COMPLETE) &&
-            unlikely(ip_frag_too_far(qp)) && unlikely(ip_frag_reinit(qp))) {
+            unlikely(ip_frag_too_far(qp)) &&
+            unlikely(err = ip_frag_reinit(qp))) {
                ipq_kill(qp);
                goto err;
        }
@@ -487,36 +393,40 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
        /* Determine the position of this fragment. */
        end = offset + skb->len - ihl;
+        err = -EINVAL;
        /* Is this the final fragment? */
        if ((flags & IP_MF) == 0) {
                /* If we already have some bits beyond end
                 * or have different end, the segment is corrrupted.
                 */
-                if (end < qp->len ||
+                if (end < qp->q.len ||
-                    ((qp->last_in & LAST_IN) && end != qp->len))
+                    ((qp->q.last_in & LAST_IN) && end != qp->q.len))
                        goto err;
-                qp->last_in |= LAST_IN;
+                qp->q.last_in |= LAST_IN;
-                qp->len = end;
+                qp->q.len = end;
        } else {
                if (end&7) {
                        end &= ~7;
                        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
                                skb->ip_summed = CHECKSUM_NONE;
                }
-                if (end > qp->len) {
+                if (end > qp->q.len) {
                        /* Some bits beyond end -> corruption. */
-                        if (qp->last_in & LAST_IN)
+                        if (qp->q.last_in & LAST_IN)
                                goto err;
-                        qp->len = end;
+                        qp->q.len = end;
                }
        }
        if (end == offset)
                goto err;
+        err = -ENOMEM;
        if (pskb_pull(skb, ihl) == NULL)
                goto err;
-        if (pskb_trim_rcsum(skb, end-offset))
+        err = pskb_trim_rcsum(skb, end - offset);
+        if (err)
                goto err;
        /* Find out which fragments are in front and at the back of us
@@ -524,7 +434,7 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         * this fragment, right?
         */
        prev = NULL;
-        for (next = qp->fragments; next != NULL; next = next->next) {
+        for (next = qp->q.fragments; next != NULL; next = next->next) {
                if (FRAG_CB(next)->offset >= offset)
                        break;  /* bingo! */
                prev = next;
@@ -539,8 +449,10 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                if (i > 0) {
                        offset += i;
+                        err = -EINVAL;
                        if (end <= offset)
                                goto err;
+                        err = -ENOMEM;
                        if (!pskb_pull(skb, i))
                                goto err;
                        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -548,6 +460,8 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                }
        }
+        err = -ENOMEM;
        while (next && FRAG_CB(next)->offset < end) {
                int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */
@@ -558,7 +472,7 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                        if (!pskb_pull(next, i))
                                goto err;
                        FRAG_CB(next)->offset += i;
-                        qp->meat -= i;
+                        qp->q.meat -= i;
                        if (next->ip_summed != CHECKSUM_UNNECESSARY)
                                next->ip_summed = CHECKSUM_NONE;
                        break;
@@ -573,9 +487,9 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                        if (prev)
                                prev->next = next;
                        else
-                                qp->fragments = next;
+                                qp->q.fragments = next;
-                        qp->meat -= free_it->len;
+                        qp->q.meat -= free_it->len;
                        frag_kfree_skb(free_it, NULL);
                }
        }
@@ -587,50 +501,77 @@ static void ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
        if (prev)
                prev->next = skb;
        else
-                qp->fragments = skb;
+                qp->q.fragments = skb;
-        if (skb->dev)
+        dev = skb->dev;
-                qp->iif = skb->dev->ifindex;
+        if (dev) {
-        skb->dev = NULL;
+                qp->iif = dev->ifindex;
-        qp->stamp = skb->tstamp;
+                skb->dev = NULL;
-        qp->meat += skb->len;
+        }
-        atomic_add(skb->truesize, &ip_frag_mem);
+        qp->q.stamp = skb->tstamp;
+        qp->q.meat += skb->len;
+        atomic_add(skb->truesize, &ip4_frags.mem);
        if (offset == 0)
-                qp->last_in |= FIRST_IN;
+                qp->q.last_in |= FIRST_IN;
-        write_lock(&ipfrag_lock);
+        if (qp->q.last_in == (FIRST_IN | LAST_IN) && qp->q.meat == qp->q.len)
-        list_move_tail(&qp->lru_list, &ipq_lru_list);
+                return ip_frag_reasm(qp, prev, dev);
-        write_unlock(&ipfrag_lock);
-        return;
+        write_lock(&ip4_frags.lock);
+        list_move_tail(&qp->q.lru_list, &ip4_frags.lru_list);
+        write_unlock(&ip4_frags.lock);
+        return -EINPROGRESS;
 err:
        kfree_skb(skb);
+        return err;
 }
 /* Build a new IP datagram from all its fragments. */
-static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
+static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+                         struct net_device *dev)
 {
        struct iphdr *iph;
-        struct sk_buff *fp, *head = qp->fragments;
+        struct sk_buff *fp, *head = qp->q.fragments;
        int len;
        int ihlen;
+        int err;
        ipq_kill(qp);
+        /* Make the one we just received the head. */
+        if (prev) {
+                head = prev->next;
+                fp = skb_clone(head, GFP_ATOMIC);
+                if (!fp)
+                        goto out_nomem;
+                fp->next = head->next;
+                prev->next = fp;
+                skb_morph(head, qp->q.fragments);
+                head->next = qp->q.fragments->next;
+                kfree_skb(qp->q.fragments);
+                qp->q.fragments = head;
+        }
        BUG_TRAP(head != NULL);
        BUG_TRAP(FRAG_CB(head)->offset == 0);
        /* Allocate a new buffer for the datagram. */
        ihlen = ip_hdrlen(head);
-        len = ihlen + qp->len;
+        len = ihlen + qp->q.len;
+        err = -E2BIG;
        if (len > 65535)
                goto out_oversize;
        /* Head of list must not be cloned. */
+        err = -ENOMEM;
        if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC))
                goto out_nomem;
@@ -654,12 +595,12 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
                head->len -= clone->len;
                clone->csum = 0;
                clone->ip_summed = head->ip_summed;
-                atomic_add(clone->truesize, &ip_frag_mem);
+                atomic_add(clone->truesize, &ip4_frags.mem);
        }
        skb_shinfo(head)->frag_list = head->next;
        skb_push(head, head->data - skb_network_header(head));
-        atomic_sub(head->truesize, &ip_frag_mem);
+        atomic_sub(head->truesize, &ip4_frags.mem);
        for (fp=head->next; fp; fp = fp->next) {
                head->data_len += fp->len;
@@ -669,19 +610,19 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
-                atomic_sub(fp->truesize, &ip_frag_mem);
+                atomic_sub(fp->truesize, &ip4_frags.mem);
        }
        head->next = NULL;
        head->dev = dev;
-        head->tstamp = qp->stamp;
+        head->tstamp = qp->q.stamp;
        iph = ip_hdr(head);
        iph->frag_off = 0;
        iph->tot_len = htons(len);
        IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
-        qp->fragments = NULL;
+        qp->q.fragments = NULL;
-        return head;
+        return 0;
 out_nomem:
        LIMIT_NETDEBUG(KERN_ERR "IP: queue_glue: no memory for gluing "
@@ -694,54 +635,46 @@ out_oversize:
                        NIPQUAD(qp->saddr));
 out_fail:
        IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
-        return NULL;
+        return err;
 }
 /* Process an incoming IP datagram fragment. */
-struct sk_buff *ip_defrag(struct sk_buff *skb, u32 user)
+int ip_defrag(struct sk_buff *skb, u32 user)
 {
        struct ipq *qp;
-        struct net_device *dev;
        IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
        /* Start by cleaning up the memory. */
-        if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
+        if (atomic_read(&ip4_frags.mem) > ip4_frags_ctl.high_thresh)
                ip_evictor();
-        dev = skb->dev;
        /* Lookup (or create) queue header */
        if ((qp = ip_find(ip_hdr(skb), user)) != NULL) {
-                struct sk_buff *ret = NULL;
+                int ret;
-                spin_lock(&qp->lock);
-                ip_frag_queue(qp, skb);
+                spin_lock(&qp->q.lock);
-                if (qp->last_in == (FIRST_IN|LAST_IN) &&
+                ret = ip_frag_queue(qp, skb);
-                    qp->meat == qp->len)
-                        ret = ip_frag_reasm(qp, dev);
-                spin_unlock(&qp->lock);
+                spin_unlock(&qp->q.lock);
-                ipq_put(qp, NULL);
+                ipq_put(qp);
                return ret;
        }
        IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
        kfree_skb(skb);
-        return NULL;
+        return -ENOMEM;
 }
 void __init ipfrag_init(void)
 {
-        ipfrag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
+        ip4_frags.ctl = &ip4_frags_ctl;
-                                 (jiffies ^ (jiffies >> 6)));
+        ip4_frags.hashfn = ip4_hashfn;
+        ip4_frags.destructor = ip4_frag_free;
-        init_timer(&ipfrag_secret_timer);
+        ip4_frags.skb_free = NULL;
-        ipfrag_secret_timer.function = ipfrag_secret_rebuild;
+        ip4_frags.qsize = sizeof(struct ipq);
-        ipfrag_secret_timer.expires = jiffies + sysctl_ipfrag_secret_interval;
+        inet_frags_init(&ip4_frags);
-        add_timer(&ipfrag_secret_timer);
 }
 EXPORT_SYMBOL(ip_defrag);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 41d8964591e7..168c871fcd79 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -172,8 +172,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
                    (!sk->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == skb->dev->ifindex)) {
                        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                                skb = ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN);
+                                if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN)) {
-                                if (skb == NULL) {
                                        read_unlock(&ip_ra_lock);
                                        return 1;
                                }
@@ -196,7 +195,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
        return 0;
 }
-static inline int ip_local_deliver_finish(struct sk_buff *skb)
+static int ip_local_deliver_finish(struct sk_buff *skb)
 {
        __skb_pull(skb, ip_hdrlen(skb));
@@ -265,8 +264,7 @@ int ip_local_deliver(struct sk_buff *skb)
         */
        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                skb = ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER);
+                if (ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER))
-                if (!skb)
                        return 0;
        }
@@ -326,7 +324,7 @@ drop:
        return -1;
 }
-static inline int ip_rcv_finish(struct sk_buff *skb)
+static int ip_rcv_finish(struct sk_buff *skb)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct rtable *rt;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 699f06781fd8..f508835ba713 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -202,7 +202,7 @@ static inline int ip_skb_dst_mtu(struct sk_buff *skb)
               skb->dst->dev->mtu : dst_mtu(skb->dst);
 }
-static inline int ip_finish_output(struct sk_buff *skb)
+static int ip_finish_output(struct sk_buff *skb)
 {
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
        /* Policy lookup after SNAT yielded a new policy */
diff --git a/net/ipv4/ipvs/ip_vs_app.c b/net/ipv4/ipvs/ip_vs_app.c
index 341474eefa55..664cb8e97c1c 100644
--- a/net/ipv4/ipvs/ip_vs_app.c
+++ b/net/ipv4/ipvs/ip_vs_app.c
@@ -25,6 +25,7 @@
 #include <linux/skbuff.h>
 #include <linux/in.h>
 #include <linux/ip.h>
+#include <linux/netfilter.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
@@ -328,18 +329,18 @@ static inline void vs_seq_update(struct ip_vs_conn *cp, struct ip_vs_seq *vseq,
        spin_unlock(&cp->lock);
 }
-static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb,
+static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff *skb,
                                  struct ip_vs_app *app)
 {
        int diff;
-        const unsigned int tcp_offset = ip_hdrlen(*pskb);
+        const unsigned int tcp_offset = ip_hdrlen(skb);
        struct tcphdr *th;
        __u32 seq;
-        if (!ip_vs_make_skb_writable(pskb, tcp_offset + sizeof(*th)))
+        if (!skb_make_writable(skb, tcp_offset + sizeof(*th)))
                return 0;
-        th = (struct tcphdr *)(skb_network_header(*pskb) + tcp_offset);
+        th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
        /*
         *      Remember seq number in case this pkt gets resized
@@ -360,7 +361,7 @@ static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb,
        if (app->pkt_out == NULL)
                return 1;
-        if (!app->pkt_out(app, cp, pskb, &diff))
+        if (!app->pkt_out(app, cp, skb, &diff))
                return 0;
        /*
@@ -378,7 +379,7 @@ static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb,
 *      called by ipvs packet handler, assumes previously checked cp!=NULL
 *      returns false if it can't handle packet (oom)
 */
-int ip_vs_app_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb)
+int ip_vs_app_pkt_out(struct ip_vs_conn *cp, struct sk_buff *skb)
 {
        struct ip_vs_app *app;
@@ -391,7 +392,7 @@ int ip_vs_app_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb)
        /* TCP is complicated */
        if (cp->protocol == IPPROTO_TCP)
-                return app_tcp_pkt_out(cp, pskb, app);
+                return app_tcp_pkt_out(cp, skb, app);
        /*
         *      Call private output hook function
@@ -399,22 +400,22 @@ int ip_vs_app_pkt_out(struct ip_vs_conn *cp, struct sk_buff **pskb)
        if (app->pkt_out == NULL)
                return 1;
-        return app->pkt_out(app, cp, pskb, NULL);
+        return app->pkt_out(app, cp, skb, NULL);
 }
-static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb,
+static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff *skb,
                                 struct ip_vs_app *app)
 {
        int diff;
-        const unsigned int tcp_offset = ip_hdrlen(*pskb);
+        const unsigned int tcp_offset = ip_hdrlen(skb);
        struct tcphdr *th;
        __u32 seq;
-        if (!ip_vs_make_skb_writable(pskb, tcp_offset + sizeof(*th)))
+        if (!skb_make_writable(skb, tcp_offset + sizeof(*th)))
                return 0;
-        th = (struct tcphdr *)(skb_network_header(*pskb) + tcp_offset);
+        th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
        /*
         *      Remember seq number in case this pkt gets resized
@@ -435,7 +436,7 @@ static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb,
        if (app->pkt_in == NULL)
                return 1;
-        if (!app->pkt_in(app, cp, pskb, &diff))
+        if (!app->pkt_in(app, cp, skb, &diff))
                return 0;
        /*
@@ -453,7 +454,7 @@ static inline int app_tcp_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb,
 *      called by ipvs packet handler, assumes previously checked cp!=NULL.
 *      returns false if can't handle packet (oom).
 */
-int ip_vs_app_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb)
+int ip_vs_app_pkt_in(struct ip_vs_conn *cp, struct sk_buff *skb)
 {
        struct ip_vs_app *app;
@@ -466,7 +467,7 @@ int ip_vs_app_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb)
        /* TCP is complicated */
        if (cp->protocol == IPPROTO_TCP)
-                return app_tcp_pkt_in(cp, pskb, app);
+                return app_tcp_pkt_in(cp, skb, app);
        /*
         *      Call private input hook function
@@ -474,7 +475,7 @@ int ip_vs_app_pkt_in(struct ip_vs_conn *cp, struct sk_buff **pskb)
        if (app->pkt_in == NULL)
                return 1;
-        return app->pkt_in(app, cp, pskb, NULL);
+        return app->pkt_in(app, cp, skb, NULL);
 }
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index fbca2a2ff29f..c6ed7654e839 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -58,7 +58,6 @@ EXPORT_SYMBOL(ip_vs_conn_put);
 #ifdef CONFIG_IP_VS_DEBUG
 EXPORT_SYMBOL(ip_vs_get_debug_level);
 #endif
-EXPORT_SYMBOL(ip_vs_make_skb_writable);
 /* ID used in ICMP lookups */
@@ -163,42 +162,6 @@ ip_vs_set_state(struct ip_vs_conn *cp, int direction,
 }
-int ip_vs_make_skb_writable(struct sk_buff **pskb, int writable_len)
-{
-        struct sk_buff *skb = *pskb;
-        /* skb is already used, better copy skb and its payload */
-        if (unlikely(skb_shared(skb) || skb->sk))
-                goto copy_skb;
-        /* skb data is already used, copy it */
-        if (unlikely(skb_cloned(skb)))
-                goto copy_data;
-        return pskb_may_pull(skb, writable_len);
-  copy_data:
-        if (unlikely(writable_len > skb->len))
-                return 0;
-        return !pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-  copy_skb:
-        if (unlikely(writable_len > skb->len))
-                return 0;
-        skb = skb_copy(skb, GFP_ATOMIC);
-        if (!skb)
-                return 0;
-        BUG_ON(skb_is_nonlinear(skb));
-        /* Rest of kernel will get very unhappy if we pass it a
-           suddenly-orphaned skbuff */
-        if ((*pskb)->sk)
-                skb_set_owner_w(skb, (*pskb)->sk);
-        kfree_skb(*pskb);
-        *pskb = skb;
-        return 1;
-}
 /*
 *  IPVS persistent scheduling function
 *  It creates a connection entry according to its template if exists,
@@ -525,12 +488,12 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
 *      for VS/NAT.
 */
 static unsigned int ip_vs_post_routing(unsigned int hooknum,
-                                       struct sk_buff **pskb,
+                                       struct sk_buff *skb,
                                       const struct net_device *in,
                                       const struct net_device *out,
                                       int (*okfn)(struct sk_buff *))
 {
-        if (!((*pskb)->ipvs_property))
+        if (!skb->ipvs_property)
                return NF_ACCEPT;
        /* The packet was sent from IPVS, exit this chain */
        return NF_STOP;
@@ -541,13 +504,14 @@ __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
        return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0));
 }
-static inline struct sk_buff *
+static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
-ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
-        skb = ip_defrag(skb, user);
+        int err = ip_defrag(skb, user);
-        if (skb)
+        if (!err)
                ip_send_check(ip_hdr(skb));
-        return skb;
+        return err;
 }
 /*
@@ -605,9 +569,8 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
 *      Currently handles error types - unreachable, quench, ttl exceeded.
 *      (Only used in VS/NAT)
 */
-static int ip_vs_out_icmp(struct sk_buff **pskb, int *related)
+static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
 {
-        struct sk_buff *skb = *pskb;
        struct iphdr *iph;
        struct icmphdr  _icmph, *ic;
        struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
@@ -619,10 +582,8 @@ static int ip_vs_out_icmp(struct sk_buff **pskb, int *related)
        /* reassemble IP fragments */
        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
+                if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
-                if (!skb)
                        return NF_STOLEN;
-                *pskb = skb;
        }
        iph = ip_hdr(skb);
@@ -690,9 +651,8 @@ static int ip_vs_out_icmp(struct sk_buff **pskb, int *related)
        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
                offset += 2 * sizeof(__u16);
-        if (!ip_vs_make_skb_writable(pskb, offset))
+        if (!skb_make_writable(skb, offset))
                goto out;
-        skb = *pskb;
        ip_vs_nat_icmp(skb, pp, cp, 1);
@@ -724,11 +684,10 @@ static inline int is_tcp_reset(const struct sk_buff *skb)
 *      rewrite addresses of the packet and send it on its way...
 */
 static unsigned int
-ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
+ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
          const struct net_device *in, const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff  *skb = *pskb;
        struct iphdr    *iph;
        struct ip_vs_protocol *pp;
        struct ip_vs_conn *cp;
@@ -741,11 +700,10 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
        iph = ip_hdr(skb);
        if (unlikely(iph->protocol == IPPROTO_ICMP)) {
-                int related, verdict = ip_vs_out_icmp(pskb, &related);
+                int related, verdict = ip_vs_out_icmp(skb, &related);
                if (related)
                        return verdict;
-                skb = *pskb;
                iph = ip_hdr(skb);
        }
@@ -756,11 +714,9 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
        /* reassemble IP fragments */
        if (unlikely(iph->frag_off & htons(IP_MF|IP_OFFSET) &&
                     !pp->dont_defrag)) {
-                skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
+                if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
-                if (!skb)
                        return NF_STOLEN;
                iph = ip_hdr(skb);
-                *pskb = skb;
        }
        ihl = iph->ihl << 2;
@@ -802,13 +758,12 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
        IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
-        if (!ip_vs_make_skb_writable(pskb, ihl))
+        if (!skb_make_writable(skb, ihl))
                goto drop;
        /* mangle the packet */
-        if (pp->snat_handler && !pp->snat_handler(pskb, pp, cp))
+        if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))
                goto drop;
-        skb = *pskb;
        ip_hdr(skb)->saddr = cp->vaddr;
        ip_send_check(ip_hdr(skb));
@@ -818,9 +773,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
         * if it came from this machine itself.  So re-compute
         * the routing information.
         */
-        if (ip_route_me_harder(pskb, RTN_LOCAL) != 0)
+        if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
                goto drop;
-        skb = *pskb;
        IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
@@ -835,7 +789,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
  drop:
        ip_vs_conn_put(cp);
-        kfree_skb(*pskb);
+        kfree_skb(skb);
        return NF_STOLEN;
 }
@@ -847,9 +801,8 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
 *      Currently handles error types - unreachable, quench, ttl exceeded.
 */
 static int
-ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
+ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
 {
-        struct sk_buff *skb = *pskb;
        struct iphdr *iph;
        struct icmphdr  _icmph, *ic;
        struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
@@ -861,12 +814,9 @@ ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
        /* reassemble IP fragments */
        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                skb = ip_vs_gather_frags(skb,
+                if (ip_vs_gather_frags(skb, hooknum == NF_IP_LOCAL_IN ?
-                                         hooknum == NF_IP_LOCAL_IN ?
+                                            IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD))
-                                         IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD);
-                if (!skb)
                        return NF_STOLEN;
-                *pskb = skb;
        }
        iph = ip_hdr(skb);
@@ -945,11 +895,10 @@ ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
 *      and send it on its way...
 */
 static unsigned int
-ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
+ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
         const struct net_device *in, const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff  *skb = *pskb;
        struct iphdr    *iph;
        struct ip_vs_protocol *pp;
        struct ip_vs_conn *cp;
@@ -971,11 +920,10 @@ ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
        iph = ip_hdr(skb);
        if (unlikely(iph->protocol == IPPROTO_ICMP)) {
-                int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum);
+                int related, verdict = ip_vs_in_icmp(skb, &related, hooknum);
                if (related)
                        return verdict;
-                skb = *pskb;
                iph = ip_hdr(skb);
        }
@@ -1056,16 +1004,16 @@ ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
 *      and send them to ip_vs_in_icmp.
 */
 static unsigned int
-ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff **pskb,
+ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
                   const struct net_device *in, const struct net_device *out,
                   int (*okfn)(struct sk_buff *))
 {
        int r;
-        if (ip_hdr(*pskb)->protocol != IPPROTO_ICMP)
+        if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
                return NF_ACCEPT;
-        return ip_vs_in_icmp(pskb, &r, hooknum);
+        return ip_vs_in_icmp(skb, &r, hooknum);
 }
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 344ddbbdc756..59aa166b7678 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -30,6 +30,7 @@
 #include <linux/skbuff.h>
 #include <linux/in.h>
 #include <linux/ip.h>
+#include <linux/netfilter.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
 #include <asm/unaligned.h>
@@ -135,7 +136,7 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit,
 * xxx,xxx,xxx,xxx is the server address, ppp,ppp is the server port number.
 */
 static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
-                         struct sk_buff **pskb, int *diff)
+                         struct sk_buff *skb, int *diff)
 {
        struct iphdr *iph;
        struct tcphdr *th;
@@ -155,14 +156,14 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                return 1;
        /* Linear packets are much easier to deal with. */
-        if (!ip_vs_make_skb_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return 0;
        if (cp->app_data == &ip_vs_ftp_pasv) {
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
                data = (char *)th + (th->doff << 2);
-                data_limit = skb_tail_pointer(*pskb);
+                data_limit = skb_tail_pointer(skb);
                if (ip_vs_ftp_get_addrport(data, data_limit,
                                           SERVER_STRING,
@@ -213,7 +214,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                        memcpy(start, buf, buf_len);
                        ret = 1;
                } else {
-                        ret = !ip_vs_skb_replace(*pskb, GFP_ATOMIC, start,
+                        ret = !ip_vs_skb_replace(skb, GFP_ATOMIC, start,
                                          end-start, buf, buf_len);
                }
@@ -238,7 +239,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
 * the client.
 */
 static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
-                        struct sk_buff **pskb, int *diff)
+                        struct sk_buff *skb, int *diff)
 {
        struct iphdr *iph;
        struct tcphdr *th;
@@ -256,20 +257,20 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                return 1;
        /* Linear packets are much easier to deal with. */
-        if (!ip_vs_make_skb_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return 0;
        /*
         * Detecting whether it is passive
         */
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
        th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
        /* Since there may be OPTIONS in the TCP packet and the HLEN is
           the length of the header in 32-bit multiples, it is accurate
           to calculate data address by th+HLEN*4 */
        data = data_start = (char *)th + (th->doff << 2);
-        data_limit = skb_tail_pointer(*pskb);
+        data_limit = skb_tail_pointer(skb);
        while (data <= data_limit - 6) {
                if (strnicmp(data, "PASV\r\n", 6) == 0) {
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index e65577a77006..12dc0d640b6d 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -20,6 +20,7 @@
 #include <linux/tcp.h>                  /* for tcphdr */
 #include <net/ip.h>
 #include <net/tcp.h>                    /* for csum_tcpudp_magic */
+#include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/ip_vs.h>
@@ -122,27 +123,27 @@ tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
 static int
-tcp_snat_handler(struct sk_buff **pskb,
+tcp_snat_handler(struct sk_buff *skb,
                 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
        struct tcphdr *tcph;
-        const unsigned int tcphoff = ip_hdrlen(*pskb);
+        const unsigned int tcphoff = ip_hdrlen(skb);
        /* csum_check requires unshared skb */
-        if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
+        if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
                return 0;
        if (unlikely(cp->app != NULL)) {
                /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(*pskb, pp))
+                if (pp->csum_check && !pp->csum_check(skb, pp))
                        return 0;
                /* Call application helper if needed */
-                if (!ip_vs_app_pkt_out(cp, pskb))
+                if (!ip_vs_app_pkt_out(cp, skb))
                        return 0;
        }
-        tcph = (void *)ip_hdr(*pskb) + tcphoff;
+        tcph = (void *)ip_hdr(skb) + tcphoff;
        tcph->source = cp->vport;
        /* Adjust TCP checksums */
@@ -150,17 +151,15 @@ tcp_snat_handler(struct sk_buff **pskb,
                /* Only port and addr are changed, do fast csum update */
                tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
                                     cp->dport, cp->vport);
-                if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                        (*pskb)->ip_summed = CHECKSUM_NONE;
+                        skb->ip_summed = CHECKSUM_NONE;
        } else {
                /* full checksum calculation */
                tcph->check = 0;
-                (*pskb)->csum = skb_checksum(*pskb, tcphoff,
+                skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
-                                             (*pskb)->len - tcphoff, 0);
                tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
-                                                (*pskb)->len - tcphoff,
+                                                skb->len - tcphoff,
-                                                cp->protocol,
+                                                cp->protocol, skb->csum);
-                                                (*pskb)->csum);
                IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                          pp->name, tcph->check,
                          (char*)&(tcph->check) - (char*)tcph);
@@ -170,30 +169,30 @@ tcp_snat_handler(struct sk_buff **pskb,
 static int
-tcp_dnat_handler(struct sk_buff **pskb,
+tcp_dnat_handler(struct sk_buff *skb,
                 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
        struct tcphdr *tcph;
-        const unsigned int tcphoff = ip_hdrlen(*pskb);
+        const unsigned int tcphoff = ip_hdrlen(skb);
        /* csum_check requires unshared skb */
-        if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
+        if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
                return 0;
        if (unlikely(cp->app != NULL)) {
                /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(*pskb, pp))
+                if (pp->csum_check && !pp->csum_check(skb, pp))
                        return 0;
                /*
                 *      Attempt ip_vs_app call.
                 *      It will fix ip_vs_conn and iph ack_seq stuff
                 */
-                if (!ip_vs_app_pkt_in(cp, pskb))
+                if (!ip_vs_app_pkt_in(cp, skb))
                        return 0;
        }
-        tcph = (void *)ip_hdr(*pskb) + tcphoff;
+        tcph = (void *)ip_hdr(skb) + tcphoff;
        tcph->dest = cp->dport;
        /*
@@ -203,18 +202,16 @@ tcp_dnat_handler(struct sk_buff **pskb,
                /* Only port and addr are changed, do fast csum update */
                tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
                                     cp->vport, cp->dport);
-                if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                        (*pskb)->ip_summed = CHECKSUM_NONE;
+                        skb->ip_summed = CHECKSUM_NONE;
        } else {
                /* full checksum calculation */
                tcph->check = 0;
-                (*pskb)->csum = skb_checksum(*pskb, tcphoff,
+                skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
-                                             (*pskb)->len - tcphoff, 0);
                tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
-                                                (*pskb)->len - tcphoff,
+                                                skb->len - tcphoff,
-                                                cp->protocol,
+                                                cp->protocol, skb->csum);
-                                                (*pskb)->csum);
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                (*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
        }
        return 1;
 }
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index 8ee5fe6a101d..1fa7b330b9ac 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -18,6 +18,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/kernel.h>
+#include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/udp.h>
@@ -129,29 +130,29 @@ udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
 }
 static int
-udp_snat_handler(struct sk_buff **pskb,
+udp_snat_handler(struct sk_buff *skb,
                 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
        struct udphdr *udph;
-        const unsigned int udphoff = ip_hdrlen(*pskb);
+        const unsigned int udphoff = ip_hdrlen(skb);
        /* csum_check requires unshared skb */
-        if (!ip_vs_make_skb_writable(pskb, udphoff+sizeof(*udph)))
+        if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
                return 0;
        if (unlikely(cp->app != NULL)) {
                /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(*pskb, pp))
+                if (pp->csum_check && !pp->csum_check(skb, pp))
                        return 0;
                /*
                 *      Call application helper if needed
                 */
-                if (!ip_vs_app_pkt_out(cp, pskb))
+                if (!ip_vs_app_pkt_out(cp, skb))
                        return 0;
        }
-        udph = (void *)ip_hdr(*pskb) + udphoff;
+        udph = (void *)ip_hdr(skb) + udphoff;
        udph->source = cp->vport;
        /*
@@ -161,17 +162,15 @@ udp_snat_handler(struct sk_buff **pskb,
                /* Only port and addr are changed, do fast csum update */
                udp_fast_csum_update(udph, cp->daddr, cp->vaddr,
                                     cp->dport, cp->vport);
-                if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                        (*pskb)->ip_summed = CHECKSUM_NONE;
+                        skb->ip_summed = CHECKSUM_NONE;
        } else {
                /* full checksum calculation */
                udph->check = 0;
-                (*pskb)->csum = skb_checksum(*pskb, udphoff,
+                skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
-                                             (*pskb)->len - udphoff, 0);
                udph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
-                                                (*pskb)->len - udphoff,
+                                                skb->len - udphoff,
-                                                cp->protocol,
+                                                cp->protocol, skb->csum);
-                                                (*pskb)->csum);
                if (udph->check == 0)
                        udph->check = CSUM_MANGLED_0;
                IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
@@ -183,30 +182,30 @@ udp_snat_handler(struct sk_buff **pskb,
 static int
-udp_dnat_handler(struct sk_buff **pskb,
+udp_dnat_handler(struct sk_buff *skb,
                 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
 {
        struct udphdr *udph;
-        unsigned int udphoff = ip_hdrlen(*pskb);
+        unsigned int udphoff = ip_hdrlen(skb);
        /* csum_check requires unshared skb */
-        if (!ip_vs_make_skb_writable(pskb, udphoff+sizeof(*udph)))
+        if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
                return 0;
        if (unlikely(cp->app != NULL)) {
                /* Some checks before mangling */
-                if (pp->csum_check && !pp->csum_check(*pskb, pp))
+                if (pp->csum_check && !pp->csum_check(skb, pp))
                        return 0;
                /*
                 *      Attempt ip_vs_app call.
                 *      It will fix ip_vs_conn
                 */
-                if (!ip_vs_app_pkt_in(cp, pskb))
+                if (!ip_vs_app_pkt_in(cp, skb))
                        return 0;
        }
-        udph = (void *)ip_hdr(*pskb) + udphoff;
+        udph = (void *)ip_hdr(skb) + udphoff;
        udph->dest = cp->dport;
        /*
@@ -216,20 +215,18 @@ udp_dnat_handler(struct sk_buff **pskb,
                /* Only port and addr are changed, do fast csum update */
                udp_fast_csum_update(udph, cp->vaddr, cp->daddr,
                                     cp->vport, cp->dport);
-                if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                        (*pskb)->ip_summed = CHECKSUM_NONE;
+                        skb->ip_summed = CHECKSUM_NONE;
        } else {
                /* full checksum calculation */
                udph->check = 0;
-                (*pskb)->csum = skb_checksum(*pskb, udphoff,
+                skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
-                                             (*pskb)->len - udphoff, 0);
                udph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
-                                                (*pskb)->len - udphoff,
+                                                skb->len - udphoff,
-                                                cp->protocol,
+                                                cp->protocol, skb->csum);
-                                                (*pskb)->csum);
                if (udph->check == 0)
                        udph->check = CSUM_MANGLED_0;
-                (*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
        }
        return 1;
 }
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index 666e080a74a3..d0a92dec1050 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -253,7 +253,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        }
        /* copy-on-write the packet before mangling it */
-        if (!ip_vs_make_skb_writable(&skb, sizeof(struct iphdr)))
+        if (!skb_make_writable(skb, sizeof(struct iphdr)))
                goto tx_error_put;
        if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
@@ -264,7 +264,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        skb->dst = &rt->u.dst;
        /* mangle the packet */
-        if (pp->dnat_handler && !pp->dnat_handler(&skb, pp, cp))
+        if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp))
                goto tx_error;
        ip_hdr(skb)->daddr = cp->daddr;
        ip_send_check(ip_hdr(skb));
@@ -529,7 +529,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        }
        /* copy-on-write the packet before mangling it */
-        if (!ip_vs_make_skb_writable(&skb, offset))
+        if (!skb_make_writable(skb, offset))
                goto tx_error_put;
        if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index b44192924f95..5539debf4973 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -3,14 +3,15 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/ip.h>
+#include <linux/skbuff.h>
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
-int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
+int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
 {
-        const struct iphdr *iph = ip_hdr(*pskb);
+        const struct iphdr *iph = ip_hdr(skb);
        struct rtable *rt;
        struct flowi fl = {};
        struct dst_entry *odst;
@@ -29,14 +30,14 @@ int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
                if (type == RTN_LOCAL)
                        fl.nl_u.ip4_u.saddr = iph->saddr;
                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-                fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
+                fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
-                fl.mark = (*pskb)->mark;
+                fl.mark = skb->mark;
                if (ip_route_output_key(&rt, &fl) != 0)
                        return -1;
                /* Drop old route. */
-                dst_release((*pskb)->dst);
+                dst_release(skb->dst);
-                (*pskb)->dst = &rt->u.dst;
+                skb->dst = &rt->u.dst;
        } else {
                /* non-local src, find valid iif to satisfy
                 * rp-filter when calling ip_route_input. */
@@ -44,8 +45,8 @@ int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
                if (ip_route_output_key(&rt, &fl) != 0)
                        return -1;
-                odst = (*pskb)->dst;
+                odst = skb->dst;
-                if (ip_route_input(*pskb, iph->daddr, iph->saddr,
+                if (ip_route_input(skb, iph->daddr, iph->saddr,
                                   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
                        dst_release(&rt->u.dst);
                        return -1;
@@ -54,70 +55,54 @@ int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
                dst_release(odst);
        }
-        if ((*pskb)->dst->error)
+        if (skb->dst->error)
                return -1;
 #ifdef CONFIG_XFRM
-        if (!(IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+        if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
-            xfrm_decode_session(*pskb, &fl, AF_INET) == 0)
+            xfrm_decode_session(skb, &fl, AF_INET) == 0)
-                if (xfrm_lookup(&(*pskb)->dst, &fl, (*pskb)->sk, 0))
+                if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
                        return -1;
 #endif
        /* Change in oif may mean change in hh_len. */
-        hh_len = (*pskb)->dst->dev->hard_header_len;
+        hh_len = skb->dst->dev->hard_header_len;
-        if (skb_headroom(*pskb) < hh_len) {
+        if (skb_headroom(skb) < hh_len &&
-                struct sk_buff *nskb;
+            pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
+                return -1;
-                nskb = skb_realloc_headroom(*pskb, hh_len);
-                if (!nskb)
-                        return -1;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
        return 0;
 }
 EXPORT_SYMBOL(ip_route_me_harder);
 #ifdef CONFIG_XFRM
-int ip_xfrm_me_harder(struct sk_buff **pskb)
+int ip_xfrm_me_harder(struct sk_buff *skb)
 {
        struct flowi fl;
        unsigned int hh_len;
        struct dst_entry *dst;
-        if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
+        if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
                return 0;
-        if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
+        if (xfrm_decode_session(skb, &fl, AF_INET) < 0)
                return -1;
-        dst = (*pskb)->dst;
+        dst = skb->dst;
        if (dst->xfrm)
                dst = ((struct xfrm_dst *)dst)->route;
        dst_hold(dst);
-        if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
+        if (xfrm_lookup(&dst, &fl, skb->sk, 0) < 0)
                return -1;
-        dst_release((*pskb)->dst);
+        dst_release(skb->dst);
-        (*pskb)->dst = dst;
+        skb->dst = dst;
        /* Change in oif may mean change in hh_len. */
-        hh_len = (*pskb)->dst->dev->hard_header_len;
+        hh_len = skb->dst->dev->hard_header_len;
-        if (skb_headroom(*pskb) < hh_len) {
+        if (skb_headroom(skb) < hh_len &&
-                struct sk_buff *nskb;
+            pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
+                return -1;
-                nskb = skb_realloc_headroom(*pskb, hh_len);
-                if (!nskb)
-                        return -1;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
        return 0;
 }
 EXPORT_SYMBOL(ip_xfrm_me_harder);
@@ -150,17 +135,17 @@ static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
        }
 }
-static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
+static int nf_ip_reroute(struct sk_buff *skb, const struct nf_info *info)
 {
        const struct ip_rt_info *rt_info = nf_info_reroute(info);
        if (info->hook == NF_IP_LOCAL_OUT) {
-                const struct iphdr *iph = ip_hdr(*pskb);
+                const struct iphdr *iph = ip_hdr(skb);
                if (!(iph->tos == rt_info->tos
                      && iph->daddr == rt_info->daddr
                      && iph->saddr == rt_info->saddr))
-                        return ip_route_me_harder(pskb, RTN_UNSPEC);
+                        return ip_route_me_harder(skb, RTN_UNSPEC);
        }
        return 0;
 }
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 29114a9ccd1d..2909c92ecd99 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -197,7 +197,7 @@ static inline int arp_checkentry(const struct arpt_arp *arp)
        return 1;
 }
-static unsigned int arpt_error(struct sk_buff **pskb,
+static unsigned int arpt_error(struct sk_buff *skb,
                               const struct net_device *in,
                               const struct net_device *out,
                               unsigned int hooknum,
@@ -215,7 +215,7 @@ static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
        return (struct arpt_entry *)(base + offset);
 }
-unsigned int arpt_do_table(struct sk_buff **pskb,
+unsigned int arpt_do_table(struct sk_buff *skb,
                           unsigned int hook,
                           const struct net_device *in,
                           const struct net_device *out,
@@ -231,9 +231,9 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
        struct xt_table_info *private;
        /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
-        if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +
+        if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
-                                     (2 * (*pskb)->dev->addr_len) +
+                                 (2 * skb->dev->addr_len) +
-                                     (2 * sizeof(u32)))))
+                                 (2 * sizeof(u32)))))
                return NF_DROP;
        indev = in ? in->name : nulldevname;
@@ -245,14 +245,14 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
        e = get_entry(table_base, private->hook_entry[hook]);
        back = get_entry(table_base, private->underflow[hook]);
-        arp = arp_hdr(*pskb);
+        arp = arp_hdr(skb);
        do {
-                if (arp_packet_match(arp, (*pskb)->dev, indev, outdev, &e->arp)) {
+                if (arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
                        struct arpt_entry_target *t;
                        int hdr_len;
                        hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
-                                (2 * (*pskb)->dev->addr_len);
+                                (2 * skb->dev->addr_len);
                        ADD_COUNTER(e->counters, hdr_len, 1);
                        t = arpt_get_target(e);
@@ -290,14 +290,14 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
                                /* Targets which reenter must return
                                 * abs. verdicts
                                 */
-                                verdict = t->u.kernel.target->target(pskb,
+                                verdict = t->u.kernel.target->target(skb,
                                                                     in, out,
                                                                     hook,
                                                                     t->u.kernel.target,
                                                                     t->data);
                                /* Target might have changed stuff. */
-                                arp = arp_hdr(*pskb);
+                                arp = arp_hdr(skb);
                                if (verdict == ARPT_CONTINUE)
                                        e = (void *)e + e->next_offset;
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index c4bdab47597f..45fa4e20094a 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -1,5 +1,6 @@
 /* module that allows mangling of the arp payload */
 #include <linux/module.h>
+#include <linux/netfilter.h>
 #include <linux/netfilter_arp/arpt_mangle.h>
 #include <net/sock.h>
@@ -8,7 +9,7 @@ MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
 MODULE_DESCRIPTION("arptables arp payload mangle target");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in, const struct net_device *out,
       unsigned int hooknum, const struct xt_target *target,
       const void *targinfo)
@@ -18,47 +19,38 @@ target(struct sk_buff **pskb,
        unsigned char *arpptr;
        int pln, hln;
-        if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+        if (skb_make_writable(skb, skb->len))
-                struct sk_buff *nskb;
+                return NF_DROP;
-                nskb = skb_copy(*pskb, GFP_ATOMIC);
+        arp = arp_hdr(skb);
-                if (!nskb)
+        arpptr = skb_network_header(skb) + sizeof(*arp);
-                        return NF_DROP;
-                if ((*pskb)->sk)
-                        skb_set_owner_w(nskb, (*pskb)->sk);
-                kfree_skb(*pskb);
-                *pskb = nskb;
-        }
-        arp = arp_hdr(*pskb);
-        arpptr = skb_network_header(*pskb) + sizeof(*arp);
        pln = arp->ar_pln;
        hln = arp->ar_hln;
        /* We assume that pln and hln were checked in the match */
        if (mangle->flags & ARPT_MANGLE_SDEV) {
                if (ARPT_DEV_ADDR_LEN_MAX < hln ||
-                   (arpptr + hln > skb_tail_pointer(*pskb)))
+                   (arpptr + hln > skb_tail_pointer(skb)))
                        return NF_DROP;
                memcpy(arpptr, mangle->src_devaddr, hln);
        }
        arpptr += hln;
        if (mangle->flags & ARPT_MANGLE_SIP) {
                if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
-                   (arpptr + pln > skb_tail_pointer(*pskb)))
+                   (arpptr + pln > skb_tail_pointer(skb)))
                        return NF_DROP;
                memcpy(arpptr, &mangle->u_s.src_ip, pln);
        }
        arpptr += pln;
        if (mangle->flags & ARPT_MANGLE_TDEV) {
                if (ARPT_DEV_ADDR_LEN_MAX < hln ||
-                   (arpptr + hln > skb_tail_pointer(*pskb)))
+                   (arpptr + hln > skb_tail_pointer(skb)))
                        return NF_DROP;
                memcpy(arpptr, mangle->tgt_devaddr, hln);
        }
        arpptr += hln;
        if (mangle->flags & ARPT_MANGLE_TIP) {
                if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
-                   (arpptr + pln > skb_tail_pointer(*pskb)))
+                   (arpptr + pln > skb_tail_pointer(skb)))
                        return NF_DROP;
                memcpy(arpptr, &mangle->u_t.tgt_ip, pln);
        }
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 75c023062533..302d3da5f696 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -56,12 +56,12 @@ static struct arpt_table packet_filter = {
 /* The work comes in here from netfilter.c */
 static unsigned int arpt_hook(unsigned int hook,
-                              struct sk_buff **pskb,
+                              struct sk_buff *skb,
                              const struct net_device *in,
                              const struct net_device *out,
                              int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(pskb, hook, in, out, &packet_filter);
+        return arpt_do_table(skb, hook, in, out, &packet_filter);
 }
 static struct nf_hook_ops arpt_ops[] = {
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 23cbfc7c80fd..10a2ce09fd8e 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -335,6 +335,7 @@ static int
 ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
 {
        int diff;
+        int err;
        struct iphdr *user_iph = (struct iphdr *)v->payload;
        if (v->data_len < sizeof(*user_iph))
@@ -347,25 +348,18 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        struct sk_buff *newskb;
+                        err = pskb_expand_head(e->skb, 0,
+                                               diff - skb_tailroom(e->skb),
-                        newskb = skb_copy_expand(e->skb,
+                                               GFP_ATOMIC);
-                                                 skb_headroom(e->skb),
+                        if (err) {
-                                                 diff,
+                                printk(KERN_WARNING "ip_queue: error "
-                                                 GFP_ATOMIC);
+                                      "in mangle, dropping packet: %d\n", -err);
-                        if (newskb == NULL) {
+                                return err;
-                                printk(KERN_WARNING "ip_queue: OOM "
-                                      "in mangle, dropping packet\n");
-                                return -ENOMEM;
                        }
-                        if (e->skb->sk)
-                                skb_set_owner_w(newskb, e->skb->sk);
-                        kfree_skb(e->skb);
-                        e->skb = newskb;
                }
                skb_put(e->skb, diff);
        }
-        if (!skb_make_writable(&e->skb, v->data_len))
+        if (!skb_make_writable(e->skb, v->data_len))
                return -ENOMEM;
        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
        e->skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 6486894f450c..4b10b98640ac 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -169,7 +169,7 @@ ip_checkentry(const struct ipt_ip *ip)
 }
 static unsigned int
-ipt_error(struct sk_buff **pskb,
+ipt_error(struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          unsigned int hooknum,
@@ -312,7 +312,7 @@ static void trace_packet(struct sk_buff *skb,
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
-ipt_do_table(struct sk_buff **pskb,
+ipt_do_table(struct sk_buff *skb,
             unsigned int hook,
             const struct net_device *in,
             const struct net_device *out,
@@ -331,8 +331,8 @@ ipt_do_table(struct sk_buff **pskb,
        struct xt_table_info *private;
        /* Initialization */
-        ip = ip_hdr(*pskb);
+        ip = ip_hdr(skb);
-        datalen = (*pskb)->len - ip->ihl * 4;
+        datalen = skb->len - ip->ihl * 4;
        indev = in ? in->name : nulldevname;
        outdev = out ? out->name : nulldevname;
        /* We handle fragments by dealing with the first fragment as
@@ -359,7 +359,7 @@ ipt_do_table(struct sk_buff **pskb,
                        struct ipt_entry_target *t;
                        if (IPT_MATCH_ITERATE(e, do_match,
-                                              *pskb, in, out,
+                                              skb, in, out,
                                              offset, &hotdrop) != 0)
                                goto no_match;
@@ -371,8 +371,8 @@ ipt_do_table(struct sk_buff **pskb,
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
                        /* The packet is traced: log it */
-                        if (unlikely((*pskb)->nf_trace))
+                        if (unlikely(skb->nf_trace))
-                                trace_packet(*pskb, hook, in, out,
+                                trace_packet(skb, hook, in, out,
                                             table->name, private, e);
 #endif
                        /* Standard target? */
@@ -410,7 +410,7 @@ ipt_do_table(struct sk_buff **pskb,
                                ((struct ipt_entry *)table_base)->comefrom
                                        = 0xeeeeeeec;
 #endif
-                                verdict = t->u.kernel.target->target(pskb,
+                                verdict = t->u.kernel.target->target(skb,
                                                                     in, out,
                                                                     hook,
                                                                     t->u.kernel.target,
@@ -428,8 +428,8 @@ ipt_do_table(struct sk_buff **pskb,
                                        = 0x57acc001;
 #endif
                                /* Target might have changed stuff. */
-                                ip = ip_hdr(*pskb);
+                                ip = ip_hdr(skb);
-                                datalen = (*pskb)->len - ip->ihl * 4;
+                                datalen = skb->len - ip->ihl * 4;
                                if (verdict == IPT_CONTINUE)
                                        e = (void *)e + e->next_offset;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 27f14e1ebd8b..2f544dac72df 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -289,7 +289,7 @@ clusterip_responsible(const struct clusterip_config *config, u_int32_t hash)
 ***********************************************************************/
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -305,7 +305,7 @@ target(struct sk_buff **pskb,
         * is only decremented by destroy() - and ip_tables guarantees
         * that the ->target() function isn't called after ->destroy() */
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        if (ct == NULL) {
                printk(KERN_ERR "CLUSTERIP: no conntrack!\n");
                        /* FIXME: need to drop invalid ones, since replies
@@ -316,7 +316,7 @@ target(struct sk_buff **pskb,
        /* special case: ICMP error handling. conntrack distinguishes between
         * error messages (RELATED) and information requests (see below) */
-        if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP
+        if (ip_hdr(skb)->protocol == IPPROTO_ICMP
            && (ctinfo == IP_CT_RELATED
                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
                return XT_CONTINUE;
@@ -325,7 +325,7 @@ target(struct sk_buff **pskb,
         * TIMESTAMP, INFO_REQUEST or ADDRESS type icmp packets from here
         * on, which all have an ID field [relevant for hashing]. */
-        hash = clusterip_hashfn(*pskb, cipinfo->config);
+        hash = clusterip_hashfn(skb, cipinfo->config);
        switch (ctinfo) {
                case IP_CT_NEW:
@@ -355,7 +355,7 @@ target(struct sk_buff **pskb,
        /* despite being received via linklayer multicast, this is
         * actually a unicast IP packet. TCP doesn't like PACKET_MULTICAST */
-        (*pskb)->pkt_type = PACKET_HOST;
+        skb->pkt_type = PACKET_HOST;
        return XT_CONTINUE;
 }
@@ -505,12 +505,12 @@ static void arp_print(struct arp_payload *payload)
 static unsigned int
 arp_mangle(unsigned int hook,
-           struct sk_buff **pskb,
+           struct sk_buff *skb,
           const struct net_device *in,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
-        struct arphdr *arp = arp_hdr(*pskb);
+        struct arphdr *arp = arp_hdr(skb);
        struct arp_payload *payload;
        struct clusterip_config *c;
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index f1253bd3837f..add110060a22 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -26,15 +26,15 @@ MODULE_DESCRIPTION("iptables ECN modification module");
 /* set ECT codepoint from IP header.
 *      return false if there was an error. */
 static inline bool
-set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
+set_ect_ip(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 {
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
        if ((iph->tos & IPT_ECN_IP_MASK) != (einfo->ip_ect & IPT_ECN_IP_MASK)) {
                __u8 oldtos;
-                if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+                if (!skb_make_writable(skb, sizeof(struct iphdr)))
                        return false;
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                oldtos = iph->tos;
                iph->tos &= ~IPT_ECN_IP_MASK;
                iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
@@ -45,14 +45,13 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 /* Return false if there was an error. */
 static inline bool
-set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
+set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 {
        struct tcphdr _tcph, *tcph;
        __be16 oldval;
        /* Not enought header? */
-        tcph = skb_header_pointer(*pskb, ip_hdrlen(*pskb),
+        tcph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
-                                  sizeof(_tcph), &_tcph);
        if (!tcph)
                return false;
@@ -62,9 +61,9 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
             tcph->cwr == einfo->proto.tcp.cwr))
                return true;
-        if (!skb_make_writable(pskb, ip_hdrlen(*pskb) + sizeof(*tcph)))
+        if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
                return false;
-        tcph = (void *)ip_hdr(*pskb) + ip_hdrlen(*pskb);
+        tcph = (void *)ip_hdr(skb) + ip_hdrlen(skb);
        oldval = ((__be16 *)tcph)[6];
        if (einfo->operation & IPT_ECN_OP_SET_ECE)
@@ -72,13 +71,13 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
        if (einfo->operation & IPT_ECN_OP_SET_CWR)
                tcph->cwr = einfo->proto.tcp.cwr;
-        nf_proto_csum_replace2(&tcph->check, *pskb,
+        nf_proto_csum_replace2(&tcph->check, skb,
                                oldval, ((__be16 *)tcph)[6], 0);
        return true;
 }
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -88,12 +87,12 @@ target(struct sk_buff **pskb,
        const struct ipt_ECN_info *einfo = targinfo;
        if (einfo->operation & IPT_ECN_OP_SET_IP)
-                if (!set_ect_ip(pskb, einfo))
+                if (!set_ect_ip(skb, einfo))
                        return NF_DROP;
        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR)
-            && ip_hdr(*pskb)->protocol == IPPROTO_TCP)
+            && ip_hdr(skb)->protocol == IPPROTO_TCP)
-                if (!set_ect_tcp(pskb, einfo))
+                if (!set_ect_tcp(skb, einfo))
                        return NF_DROP;
        return XT_CONTINUE;
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 127a5e89bf14..4b5e8216a4e7 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -418,7 +418,7 @@ ipt_log_packet(unsigned int pf,
 }
 static unsigned int
-ipt_log_target(struct sk_buff **pskb,
+ipt_log_target(struct sk_buff *skb,
               const struct net_device *in,
               const struct net_device *out,
               unsigned int hooknum,
@@ -432,7 +432,7 @@ ipt_log_target(struct sk_buff **pskb,
        li.u.log.level = loginfo->level;
        li.u.log.logflags = loginfo->logflags;
-        ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
+        ipt_log_packet(PF_INET, hooknum, skb, in, out, &li,
                       loginfo->prefix);
        return XT_CONTINUE;
 }
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 3e0b562b2db7..44b516e7cb79 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -52,7 +52,7 @@ masquerade_check(const char *tablename,
 }
 static unsigned int
-masquerade_target(struct sk_buff **pskb,
+masquerade_target(struct sk_buff *skb,
                  const struct net_device *in,
                  const struct net_device *out,
                  unsigned int hooknum,
@@ -69,7 +69,7 @@ masquerade_target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        nat = nfct_nat(ct);
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
@@ -82,7 +82,7 @@ masquerade_target(struct sk_buff **pskb,
                return NF_ACCEPT;
        mr = targinfo;
-        rt = (struct rtable *)(*pskb)->dst;
+        rt = (struct rtable *)skb->dst;
        newsrc = inet_select_addr(out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
        if (!newsrc) {
                printk("MASQUERADE: %s ate my IP address\n", out->name);
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index 41a011d5a065..f8699291e33d 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -43,7 +43,7 @@ check(const char *tablename,
 }
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -59,14 +59,14 @@ target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING
                     || hooknum == NF_IP_POST_ROUTING
                     || hooknum == NF_IP_LOCAL_OUT);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
        if (hooknum == NF_IP_PRE_ROUTING || hooknum == NF_IP_LOCAL_OUT)
-                new_ip = ip_hdr(*pskb)->daddr & ~netmask;
+                new_ip = ip_hdr(skb)->daddr & ~netmask;
        else
-                new_ip = ip_hdr(*pskb)->saddr & ~netmask;
+                new_ip = ip_hdr(skb)->saddr & ~netmask;
        new_ip |= mr->range[0].min_ip & netmask;
        newrange = ((struct nf_nat_range)
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 6ac7a2373316..f7cf7d61a2d4 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -47,7 +47,7 @@ redirect_check(const char *tablename,
 }
 static unsigned int
-redirect_target(struct sk_buff **pskb,
+redirect_target(struct sk_buff *skb,
                const struct net_device *in,
                const struct net_device *out,
                unsigned int hooknum,
@@ -63,7 +63,7 @@ redirect_target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING
                     || hooknum == NF_IP_LOCAL_OUT);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
        /* Local packets: make them go to loopback */
@@ -76,7 +76,7 @@ redirect_target(struct sk_buff **pskb,
                newdst = 0;
                rcu_read_lock();
-                indev = __in_dev_get_rcu((*pskb)->dev);
+                indev = __in_dev_get_rcu(skb->dev);
                if (indev && (ifa = indev->ifa_list))
                        newdst = ifa->ifa_local;
                rcu_read_unlock();
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index cb038c8fbc9d..dcf4d21d5116 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -131,7 +131,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
           )
                addr_type = RTN_LOCAL;
-        if (ip_route_me_harder(&nskb, addr_type))
+        if (ip_route_me_harder(nskb, addr_type))
                goto free_nskb;
        nskb->ip_summed = CHECKSUM_NONE;
@@ -162,7 +162,7 @@ static inline void send_unreach(struct sk_buff *skb_in, int code)
        icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
 }
-static unsigned int reject(struct sk_buff **pskb,
+static unsigned int reject(struct sk_buff *skb,
                           const struct net_device *in,
                           const struct net_device *out,
                           unsigned int hooknum,
@@ -173,7 +173,7 @@ static unsigned int reject(struct sk_buff **pskb,
        /* Our naive response construction doesn't deal with IP
           options, and probably shouldn't try. */
-        if (ip_hdrlen(*pskb) != sizeof(struct iphdr))
+        if (ip_hdrlen(skb) != sizeof(struct iphdr))
                return NF_DROP;
        /* WARNING: This code causes reentry within iptables.
@@ -181,28 +181,28 @@ static unsigned int reject(struct sk_buff **pskb,
           must return an absolute verdict. --RR */
        switch (reject->with) {
        case IPT_ICMP_NET_UNREACHABLE:
-                send_unreach(*pskb, ICMP_NET_UNREACH);
+                send_unreach(skb, ICMP_NET_UNREACH);
                break;
        case IPT_ICMP_HOST_UNREACHABLE:
-                send_unreach(*pskb, ICMP_HOST_UNREACH);
+                send_unreach(skb, ICMP_HOST_UNREACH);
                break;
        case IPT_ICMP_PROT_UNREACHABLE:
-                send_unreach(*pskb, ICMP_PROT_UNREACH);
+                send_unreach(skb, ICMP_PROT_UNREACH);
                break;
        case IPT_ICMP_PORT_UNREACHABLE:
-                send_unreach(*pskb, ICMP_PORT_UNREACH);
+                send_unreach(skb, ICMP_PORT_UNREACH);
                break;
        case IPT_ICMP_NET_PROHIBITED:
-                send_unreach(*pskb, ICMP_NET_ANO);
+                send_unreach(skb, ICMP_NET_ANO);
                break;
        case IPT_ICMP_HOST_PROHIBITED:
-                send_unreach(*pskb, ICMP_HOST_ANO);
+                send_unreach(skb, ICMP_HOST_ANO);
                break;
        case IPT_ICMP_ADMIN_PROHIBITED:
-                send_unreach(*pskb, ICMP_PKT_FILTERED);
+                send_unreach(skb, ICMP_PKT_FILTERED);
                break;
        case IPT_TCP_RESET:
-                send_reset(*pskb, hooknum);
+                send_reset(skb, hooknum);
        case IPT_ICMP_ECHOREPLY:
                /* Doesn't happen. */
                break;
diff --git a/net/ipv4/netfilter/ipt_SAME.c b/net/ipv4/netfilter/ipt_SAME.c
index 97641f1a97f6..8988571436b8 100644
--- a/net/ipv4/netfilter/ipt_SAME.c
+++ b/net/ipv4/netfilter/ipt_SAME.c
@@ -104,7 +104,7 @@ same_destroy(const struct xt_target *target, void *targinfo)
 }
 static unsigned int
-same_target(struct sk_buff **pskb,
+same_target(struct sk_buff *skb,
                const struct net_device *in,
                const struct net_device *out,
                unsigned int hooknum,
@@ -121,7 +121,7 @@ same_target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING ||
                        hooknum == NF_IP_POST_ROUTING);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
diff --git a/net/ipv4/netfilter/ipt_TOS.c b/net/ipv4/netfilter/ipt_TOS.c
index 25f5d0b39065..d4573baa7f27 100644
--- a/net/ipv4/netfilter/ipt_TOS.c
+++ b/net/ipv4/netfilter/ipt_TOS.c
@@ -21,7 +21,7 @@ MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables TOS mangling module");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -29,13 +29,13 @@ target(struct sk_buff **pskb,
       const void *targinfo)
 {
        const struct ipt_tos_target_info *tosinfo = targinfo;
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
        if ((iph->tos & IPTOS_TOS_MASK) != tosinfo->tos) {
                __u8 oldtos;
-                if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+                if (!skb_make_writable(skb, sizeof(struct iphdr)))
                        return NF_DROP;
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                oldtos = iph->tos;
                iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;
                nf_csum_replace2(&iph->check, htons(oldtos), htons(iph->tos));
diff --git a/net/ipv4/netfilter/ipt_TTL.c b/net/ipv4/netfilter/ipt_TTL.c
index 2b54e7b0cfe8..c620a0527666 100644
--- a/net/ipv4/netfilter/ipt_TTL.c
+++ b/net/ipv4/netfilter/ipt_TTL.c
@@ -20,7 +20,7 @@ MODULE_DESCRIPTION("IP tables TTL modification module");
 MODULE_LICENSE("GPL");
 static unsigned int
-ipt_ttl_target(struct sk_buff **pskb,
+ipt_ttl_target(struct sk_buff *skb,
               const struct net_device *in, const struct net_device *out,
               unsigned int hooknum, const struct xt_target *target,
               const void *targinfo)
@@ -29,10 +29,10 @@ ipt_ttl_target(struct sk_buff **pskb,
        const struct ipt_TTL_info *info = targinfo;
        int new_ttl;
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return NF_DROP;
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
        switch (info->mode) {
                case IPT_TTL_SET:
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index c636d6d63574..212b830765a4 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -279,7 +279,7 @@ alloc_failure:
        spin_unlock_bh(&ulog_lock);
 }
-static unsigned int ipt_ulog_target(struct sk_buff **pskb,
+static unsigned int ipt_ulog_target(struct sk_buff *skb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    unsigned int hooknum,
@@ -288,7 +288,7 @@ static unsigned int ipt_ulog_target(struct sk_buff **pskb,
 {
        struct ipt_ulog_info *loginfo = (struct ipt_ulog_info *) targinfo;
-        ipt_ulog_packet(hooknum, *pskb, in, out, loginfo, NULL);
+        ipt_ulog_packet(hooknum, skb, in, out, loginfo, NULL);
        return XT_CONTINUE;
 }
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 4f51c1d7d2d6..ba3262c60437 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -62,31 +62,31 @@ static struct xt_table packet_filter = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ipt_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(pskb, hook, in, out, &packet_filter);
+        return ipt_do_table(skb, hook, in, out, &packet_filter);
 }
 static unsigned int
 ipt_local_out_hook(unsigned int hook,
-                   struct sk_buff **pskb,
+                   struct sk_buff *skb,
                   const struct net_device *in,
                   const struct net_device *out,
                   int (*okfn)(struct sk_buff *))
 {
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr) ||
-            || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("iptable_filter: ignoring short SOCK_RAW "
                               "packet.\n");
                return NF_ACCEPT;
        }
-        return ipt_do_table(pskb, hook, in, out, &packet_filter);
+        return ipt_do_table(skb, hook, in, out, &packet_filter);
 }
 static struct nf_hook_ops ipt_ops[] = {
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 902446f7cbca..b4360a69d5ca 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -75,17 +75,17 @@ static struct xt_table packet_mangler = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ipt_route_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(pskb, hook, in, out, &packet_mangler);
+        return ipt_do_table(skb, hook, in, out, &packet_mangler);
 }
 static unsigned int
 ipt_local_hook(unsigned int hook,
-                   struct sk_buff **pskb,
+                   struct sk_buff *skb,
                   const struct net_device *in,
                   const struct net_device *out,
                   int (*okfn)(struct sk_buff *))
@@ -97,8 +97,8 @@ ipt_local_hook(unsigned int hook,
        u_int32_t mark;
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("iptable_mangle: ignoring short SOCK_RAW "
                               "packet.\n");
@@ -106,22 +106,22 @@ ipt_local_hook(unsigned int hook,
        }
        /* Save things which could affect route */
-        mark = (*pskb)->mark;
+        mark = skb->mark;
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
        saddr = iph->saddr;
        daddr = iph->daddr;
        tos = iph->tos;
-        ret = ipt_do_table(pskb, hook, in, out, &packet_mangler);
+        ret = ipt_do_table(skb, hook, in, out, &packet_mangler);
        /* Reroute for ANY change. */
        if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                if (iph->saddr != saddr ||
                    iph->daddr != daddr ||
-                    (*pskb)->mark != mark ||
+                    skb->mark != mark ||
                    iph->tos != tos)
-                        if (ip_route_me_harder(pskb, RTN_UNSPEC))
+                        if (ip_route_me_harder(skb, RTN_UNSPEC))
                                ret = NF_DROP;
        }
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index d6e503395684..5de6e57ac55c 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -47,30 +47,30 @@ static struct xt_table packet_raw = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ipt_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(pskb, hook, in, out, &packet_raw);
+        return ipt_do_table(skb, hook, in, out, &packet_raw);
 }
 static unsigned int
 ipt_local_hook(unsigned int hook,
-               struct sk_buff **pskb,
+               struct sk_buff *skb,
               const struct net_device *in,
               const struct net_device *out,
               int (*okfn)(struct sk_buff *))
 {
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr) ||
+        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("iptable_raw: ignoring short SOCK_RAW"
                               "packet.\n");
                return NF_ACCEPT;
        }
-        return ipt_do_table(pskb, hook, in, out, &packet_raw);
+        return ipt_do_table(skb, hook, in, out, &packet_raw);
 }
 /* 'raw' is the very first table. */
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 2fcb9249a8da..831e9b29806d 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -63,19 +63,20 @@ static int ipv4_print_conntrack(struct seq_file *s,
 }
 /* Returns new sk_buff, or NULL */
-static struct sk_buff *
+static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
-nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
+        int err;
        skb_orphan(skb);
        local_bh_disable();
-        skb = ip_defrag(skb, user);
+        err = ip_defrag(skb, user);
        local_bh_enable();
-        if (skb)
+        if (!err)
                ip_send_check(ip_hdr(skb));
-        return skb;
+        return err;
 }
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
@@ -99,17 +100,17 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 }
 static unsigned int ipv4_confirm(unsigned int hooknum,
-                                 struct sk_buff **pskb,
+                                 struct sk_buff *skb,
                                 const struct net_device *in,
                                 const struct net_device *out,
                                 int (*okfn)(struct sk_buff *))
 {
        /* We've seen it coming out the other side: confirm it */
-        return nf_conntrack_confirm(pskb);
+        return nf_conntrack_confirm(skb);
 }
 static unsigned int ipv4_conntrack_help(unsigned int hooknum,
-                                      struct sk_buff **pskb,
+                                      struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
@@ -120,7 +121,7 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
        struct nf_conntrack_helper *helper;
        /* This is where we call the helper: as the packet goes out. */
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
                return NF_ACCEPT;
@@ -131,56 +132,55 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
        helper = rcu_dereference(help->helper);
        if (!helper)
                return NF_ACCEPT;
-        return helper->help(pskb, skb_network_offset(*pskb) + ip_hdrlen(*pskb),
+        return helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
                            ct, ctinfo);
 }
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
-                                          struct sk_buff **pskb,
+                                          struct sk_buff *skb,
                                          const struct net_device *in,
                                          const struct net_device *out,
                                          int (*okfn)(struct sk_buff *))
 {
        /* Previously seen (loopback)?  Ignore.  Do this before
           fragment check. */
-        if ((*pskb)->nfct)
+        if (skb->nfct)
                return NF_ACCEPT;
        /* Gather fragments. */
-        if (ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)) {
+        if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                *pskb = nf_ct_ipv4_gather_frags(*pskb,
+                if (nf_ct_ipv4_gather_frags(skb,
-                                                hooknum == NF_IP_PRE_ROUTING ?
+                                            hooknum == NF_IP_PRE_ROUTING ?
-                                                IP_DEFRAG_CONNTRACK_IN :
+                                            IP_DEFRAG_CONNTRACK_IN :
-                                                IP_DEFRAG_CONNTRACK_OUT);
+                                            IP_DEFRAG_CONNTRACK_OUT))
-                if (!*pskb)
                        return NF_STOLEN;
        }
        return NF_ACCEPT;
 }
 static unsigned int ipv4_conntrack_in(unsigned int hooknum,
-                                      struct sk_buff **pskb,
+                                      struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
-        return nf_conntrack_in(PF_INET, hooknum, pskb);
+        return nf_conntrack_in(PF_INET, hooknum, skb);
 }
 static unsigned int ipv4_conntrack_local(unsigned int hooknum,
-                                         struct sk_buff **pskb,
+                                         struct sk_buff *skb,
                                         const struct net_device *in,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr) ||
-            || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ipt_hook: happy cracking.\n");
                return NF_ACCEPT;
        }
-        return nf_conntrack_in(PF_INET, hooknum, pskb);
+        return nf_conntrack_in(PF_INET, hooknum, skb);
 }
 /* Connection tracking may drop packets, but never alters them, so
diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c
index bd93a1d71052..35a5aa69cd92 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/ipv4/netfilter/nf_nat_amanda.c
@@ -24,7 +24,7 @@ MODULE_DESCRIPTION("Amanda NAT helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_nat_amanda");
-static unsigned int help(struct sk_buff **pskb,
+static unsigned int help(struct sk_buff *skb,
                         enum ip_conntrack_info ctinfo,
                         unsigned int matchoff,
                         unsigned int matchlen,
@@ -53,7 +53,7 @@ static unsigned int help(struct sk_buff **pskb,
                return NF_DROP;
        sprintf(buffer, "%u", port);
-        ret = nf_nat_mangle_udp_packet(pskb, exp->master, ctinfo,
+        ret = nf_nat_mangle_udp_packet(skb, exp->master, ctinfo,
                                       matchoff, matchlen,
                                       buffer, strlen(buffer));
        if (ret != NF_ACCEPT)
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 7221aa20e6ff..56e93f692e82 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -349,7 +349,7 @@ EXPORT_SYMBOL(nf_nat_setup_info);
 /* Returns true if succeeded. */
 static int
 manip_pkt(u_int16_t proto,
-          struct sk_buff **pskb,
+          struct sk_buff *skb,
          unsigned int iphdroff,
          const struct nf_conntrack_tuple *target,
          enum nf_nat_manip_type maniptype)
@@ -357,19 +357,19 @@ manip_pkt(u_int16_t proto,
        struct iphdr *iph;
        struct nf_nat_protocol *p;
-        if (!skb_make_writable(pskb, iphdroff + sizeof(*iph)))
+        if (!skb_make_writable(skb, iphdroff + sizeof(*iph)))
                return 0;
-        iph = (void *)(*pskb)->data + iphdroff;
+        iph = (void *)skb->data + iphdroff;
        /* Manipulate protcol part. */
        /* rcu_read_lock()ed by nf_hook_slow */
        p = __nf_nat_proto_find(proto);
-        if (!p->manip_pkt(pskb, iphdroff, target, maniptype))
+        if (!p->manip_pkt(skb, iphdroff, target, maniptype))
                return 0;
-        iph = (void *)(*pskb)->data + iphdroff;
+        iph = (void *)skb->data + iphdroff;
        if (maniptype == IP_NAT_MANIP_SRC) {
                nf_csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
@@ -385,7 +385,7 @@ manip_pkt(u_int16_t proto,
 unsigned int nf_nat_packet(struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
                           unsigned int hooknum,
-                           struct sk_buff **pskb)
+                           struct sk_buff *skb)
 {
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        unsigned long statusbit;
@@ -407,7 +407,7 @@ unsigned int nf_nat_packet(struct nf_conn *ct,
                /* We are aiming to look like inverse of other direction. */
                nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
-                if (!manip_pkt(target.dst.protonum, pskb, 0, &target, mtype))
+                if (!manip_pkt(target.dst.protonum, skb, 0, &target, mtype))
                        return NF_DROP;
        }
        return NF_ACCEPT;
@@ -418,7 +418,7 @@ EXPORT_SYMBOL_GPL(nf_nat_packet);
 int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                                  enum ip_conntrack_info ctinfo,
                                  unsigned int hooknum,
-                                  struct sk_buff **pskb)
+                                  struct sk_buff *skb)
 {
        struct {
                struct icmphdr icmp;
@@ -426,24 +426,24 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
        } *inside;
        struct nf_conntrack_l4proto *l4proto;
        struct nf_conntrack_tuple inner, target;
-        int hdrlen = ip_hdrlen(*pskb);
+        int hdrlen = ip_hdrlen(skb);
        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
        unsigned long statusbit;
        enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
-        if (!skb_make_writable(pskb, hdrlen + sizeof(*inside)))
+        if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
                return 0;
-        inside = (void *)(*pskb)->data + ip_hdrlen(*pskb);
+        inside = (void *)skb->data + ip_hdrlen(skb);
        /* We're actually going to mangle it beyond trivial checksum
           adjustment, so make sure the current checksum is correct. */
-        if (nf_ip_checksum(*pskb, hooknum, hdrlen, 0))
+        if (nf_ip_checksum(skb, hooknum, hdrlen, 0))
                return 0;
        /* Must be RELATED */
-        NF_CT_ASSERT((*pskb)->nfctinfo == IP_CT_RELATED ||
+        NF_CT_ASSERT(skb->nfctinfo == IP_CT_RELATED ||
-                     (*pskb)->nfctinfo == IP_CT_RELATED+IP_CT_IS_REPLY);
+                     skb->nfctinfo == IP_CT_RELATED+IP_CT_IS_REPLY);
        /* Redirects on non-null nats must be dropped, else they'll
           start talking to each other without our translation, and be
@@ -458,15 +458,15 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
        }
        pr_debug("icmp_reply_translation: translating error %p manip %u "
-                 "dir %s\n", *pskb, manip,
+                 "dir %s\n", skb, manip,
                 dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");
        /* rcu_read_lock()ed by nf_hook_slow */
        l4proto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);
-        if (!nf_ct_get_tuple(*pskb,
+        if (!nf_ct_get_tuple(skb,
-                             ip_hdrlen(*pskb) + sizeof(struct icmphdr),
+                             ip_hdrlen(skb) + sizeof(struct icmphdr),
-                             (ip_hdrlen(*pskb) +
+                             (ip_hdrlen(skb) +
                              sizeof(struct icmphdr) + inside->ip.ihl * 4),
                             (u_int16_t)AF_INET,
                             inside->ip.protocol,
@@ -478,19 +478,19 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
           pass all hooks (locally-generated ICMP).  Consider incoming
           packet: PREROUTING (DST manip), routing produces ICMP, goes
           through POSTROUTING (which must correct the DST manip). */
-        if (!manip_pkt(inside->ip.protocol, pskb,
+        if (!manip_pkt(inside->ip.protocol, skb,
-                       ip_hdrlen(*pskb) + sizeof(inside->icmp),
+                       ip_hdrlen(skb) + sizeof(inside->icmp),
                       &ct->tuplehash[!dir].tuple,
                       !manip))
                return 0;
-        if ((*pskb)->ip_summed != CHECKSUM_PARTIAL) {
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
                /* Reloading "inside" here since manip_pkt inner. */
-                inside = (void *)(*pskb)->data + ip_hdrlen(*pskb);
+                inside = (void *)skb->data + ip_hdrlen(skb);
                inside->icmp.checksum = 0;
                inside->icmp.checksum =
-                        csum_fold(skb_checksum(*pskb, hdrlen,
+                        csum_fold(skb_checksum(skb, hdrlen,
-                                               (*pskb)->len - hdrlen, 0));
+                                               skb->len - hdrlen, 0));
        }
        /* Change outer to look the reply to an incoming packet
@@ -506,7 +506,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
        if (ct->status & statusbit) {
                nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
-                if (!manip_pkt(0, pskb, 0, &target, manip))
+                if (!manip_pkt(0, skb, 0, &target, manip))
                        return 0;
        }
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index 3663bd879c39..e1a16d3ea4cb 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -28,7 +28,7 @@ MODULE_ALIAS("ip_nat_ftp");
 /* FIXME: Time out? --RR */
 static int
-mangle_rfc959_packet(struct sk_buff **pskb,
+mangle_rfc959_packet(struct sk_buff *skb,
                     __be32 newip,
                     u_int16_t port,
                     unsigned int matchoff,
@@ -43,13 +43,13 @@ mangle_rfc959_packet(struct sk_buff **pskb,
        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
+        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
 /* |1|132.235.1.2|6275| */
 static int
-mangle_eprt_packet(struct sk_buff **pskb,
+mangle_eprt_packet(struct sk_buff *skb,
                   __be32 newip,
                   u_int16_t port,
                   unsigned int matchoff,
@@ -63,13 +63,13 @@ mangle_eprt_packet(struct sk_buff **pskb,
        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
+        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
 /* |1|132.235.1.2|6275| */
 static int
-mangle_epsv_packet(struct sk_buff **pskb,
+mangle_epsv_packet(struct sk_buff *skb,
                   __be32 newip,
                   u_int16_t port,
                   unsigned int matchoff,
@@ -83,11 +83,11 @@ mangle_epsv_packet(struct sk_buff **pskb,
        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-        return nf_nat_mangle_tcp_packet(pskb, ct, ctinfo, matchoff,
+        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
                                        matchlen, buffer, strlen(buffer));
 }
-static int (*mangle[])(struct sk_buff **, __be32, u_int16_t,
+static int (*mangle[])(struct sk_buff *, __be32, u_int16_t,
                       unsigned int, unsigned int, struct nf_conn *,
                       enum ip_conntrack_info)
 = {
@@ -99,7 +99,7 @@ static int (*mangle[])(struct sk_buff **, __be32, u_int16_t,
 /* So, this packet has hit the connection tracking matching code.
   Mangle it, and change the expectation to match the new version. */
-static unsigned int nf_nat_ftp(struct sk_buff **pskb,
+static unsigned int nf_nat_ftp(struct sk_buff *skb,
                               enum ip_conntrack_info ctinfo,
                               enum nf_ct_ftp_type type,
                               unsigned int matchoff,
@@ -132,7 +132,7 @@ static unsigned int nf_nat_ftp(struct sk_buff **pskb,
        if (port == 0)
                return NF_DROP;
-        if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo)) {
+        if (!mangle[type](skb, newip, port, matchoff, matchlen, ct, ctinfo)) {
                nf_ct_unexpect_related(exp);
                return NF_DROP;
        }
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index c1b059a73708..a868c8c41328 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -22,12 +22,12 @@
 #include <linux/netfilter/nf_conntrack_h323.h>
 /****************************************************************************/
-static int set_addr(struct sk_buff **pskb,
+static int set_addr(struct sk_buff *skb,
                    unsigned char **data, int dataoff,
                    unsigned int addroff, __be32 ip, __be16 port)
 {
        enum ip_conntrack_info ctinfo;
-        struct nf_conn *ct = nf_ct_get(*pskb, &ctinfo);
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
        struct {
                __be32 ip;
                __be16 port;
@@ -38,8 +38,8 @@ static int set_addr(struct sk_buff **pskb,
        buf.port = port;
        addroff += dataoff;
-        if (ip_hdr(*pskb)->protocol == IPPROTO_TCP) {
+        if (ip_hdr(skb)->protocol == IPPROTO_TCP) {
-                if (!nf_nat_mangle_tcp_packet(pskb, ct, ctinfo,
+                if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
                                              addroff, sizeof(buf),
                                              (char *) &buf, sizeof(buf))) {
                        if (net_ratelimit())
@@ -49,14 +49,13 @@ static int set_addr(struct sk_buff **pskb,
                }
                /* Relocate data pointer */
-                th = skb_header_pointer(*pskb, ip_hdrlen(*pskb),
+                th = skb_header_pointer(skb, ip_hdrlen(skb),
                                        sizeof(_tcph), &_tcph);
                if (th == NULL)
                        return -1;
-                *data = (*pskb)->data + ip_hdrlen(*pskb) +
+                *data = skb->data + ip_hdrlen(skb) + th->doff * 4 + dataoff;
-                    th->doff * 4 + dataoff;
        } else {
-                if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
+                if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
                                              addroff, sizeof(buf),
                                              (char *) &buf, sizeof(buf))) {
                        if (net_ratelimit())
@@ -67,36 +66,35 @@ static int set_addr(struct sk_buff **pskb,
                /* nf_nat_mangle_udp_packet uses skb_make_writable() to copy
                 * or pull everything in a linear buffer, so we can safely
                 * use the skb pointers now */
-                *data = ((*pskb)->data + ip_hdrlen(*pskb) +
+                *data = skb->data + ip_hdrlen(skb) + sizeof(struct udphdr);
-                         sizeof(struct udphdr));
        }
        return 0;
 }
 /****************************************************************************/
-static int set_h225_addr(struct sk_buff **pskb,
+static int set_h225_addr(struct sk_buff *skb,
                         unsigned char **data, int dataoff,
                         TransportAddress *taddr,
                         union nf_conntrack_address *addr, __be16 port)
 {
-        return set_addr(pskb, data, dataoff, taddr->ipAddress.ip,
+        return set_addr(skb, data, dataoff, taddr->ipAddress.ip,
                        addr->ip, port);
 }
 /****************************************************************************/
-static int set_h245_addr(struct sk_buff **pskb,
+static int set_h245_addr(struct sk_buff *skb,
                         unsigned char **data, int dataoff,
                         H245_TransportAddress *taddr,
                         union nf_conntrack_address *addr, __be16 port)
 {
-        return set_addr(pskb, data, dataoff,
+        return set_addr(skb, data, dataoff,
                        taddr->unicastAddress.iPAddress.network,
                        addr->ip, port);
 }
 /****************************************************************************/
-static int set_sig_addr(struct sk_buff **pskb, struct nf_conn *ct,
+static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data,
                        TransportAddress *taddr, int count)
@@ -125,7 +123,7 @@ static int set_sig_addr(struct sk_buff **pskb, struct nf_conn *ct,
                                         NIPQUAD(addr.ip), port,
                                         NIPQUAD(ct->tuplehash[!dir].tuple.dst.u3.ip),
                                         info->sig_port[!dir]);
-                                return set_h225_addr(pskb, data, 0, &taddr[i],
+                                return set_h225_addr(skb, data, 0, &taddr[i],
                                                     &ct->tuplehash[!dir].
                                                     tuple.dst.u3,
                                                     info->sig_port[!dir]);
@@ -137,7 +135,7 @@ static int set_sig_addr(struct sk_buff **pskb, struct nf_conn *ct,
                                         NIPQUAD(addr.ip), port,
                                         NIPQUAD(ct->tuplehash[!dir].tuple.src.u3.ip),
                                         info->sig_port[!dir]);
-                                return set_h225_addr(pskb, data, 0, &taddr[i],
+                                return set_h225_addr(skb, data, 0, &taddr[i],
                                                     &ct->tuplehash[!dir].
                                                     tuple.src.u3,
                                                     info->sig_port[!dir]);
@@ -149,7 +147,7 @@ static int set_sig_addr(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int set_ras_addr(struct sk_buff **pskb, struct nf_conn *ct,
+static int set_ras_addr(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data,
                        TransportAddress *taddr, int count)
@@ -168,7 +166,7 @@ static int set_ras_addr(struct sk_buff **pskb, struct nf_conn *ct,
                                 NIPQUAD(addr.ip), ntohs(port),
                                 NIPQUAD(ct->tuplehash[!dir].tuple.dst.u3.ip),
                                 ntohs(ct->tuplehash[!dir].tuple.dst.u.udp.port));
-                        return set_h225_addr(pskb, data, 0, &taddr[i],
+                        return set_h225_addr(skb, data, 0, &taddr[i],
                                             &ct->tuplehash[!dir].tuple.dst.u3,
                                             ct->tuplehash[!dir].tuple.
                                                                dst.u.udp.port);
@@ -179,7 +177,7 @@ static int set_ras_addr(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int nat_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
+static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data, int dataoff,
                        H245_TransportAddress *taddr,
@@ -244,7 +242,7 @@ static int nat_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
        }
        /* Modify signal */
-        if (set_h245_addr(pskb, data, dataoff, taddr,
+        if (set_h245_addr(skb, data, dataoff, taddr,
                          &ct->tuplehash[!dir].tuple.dst.u3,
                          htons((port & htons(1)) ? nated_port + 1 :
                                                    nated_port)) == 0) {
@@ -273,7 +271,7 @@ static int nat_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int nat_t120(struct sk_buff **pskb, struct nf_conn *ct,
+static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
                    enum ip_conntrack_info ctinfo,
                    unsigned char **data, int dataoff,
                    H245_TransportAddress *taddr, __be16 port,
@@ -301,7 +299,7 @@ static int nat_t120(struct sk_buff **pskb, struct nf_conn *ct,
        }
        /* Modify signal */
-        if (set_h245_addr(pskb, data, dataoff, taddr,
+        if (set_h245_addr(skb, data, dataoff, taddr,
                          &ct->tuplehash[!dir].tuple.dst.u3,
                          htons(nated_port)) < 0) {
                nf_ct_unexpect_related(exp);
@@ -318,7 +316,7 @@ static int nat_t120(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int nat_h245(struct sk_buff **pskb, struct nf_conn *ct,
+static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
                    enum ip_conntrack_info ctinfo,
                    unsigned char **data, int dataoff,
                    TransportAddress *taddr, __be16 port,
@@ -351,7 +349,7 @@ static int nat_h245(struct sk_buff **pskb, struct nf_conn *ct,
        }
        /* Modify signal */
-        if (set_h225_addr(pskb, data, dataoff, taddr,
+        if (set_h225_addr(skb, data, dataoff, taddr,
                          &ct->tuplehash[!dir].tuple.dst.u3,
                          htons(nated_port)) == 0) {
                /* Save ports */
@@ -406,7 +404,7 @@ static void ip_nat_q931_expect(struct nf_conn *new,
 }
 /****************************************************************************/
-static int nat_q931(struct sk_buff **pskb, struct nf_conn *ct,
+static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
                    enum ip_conntrack_info ctinfo,
                    unsigned char **data, TransportAddress *taddr, int idx,
                    __be16 port, struct nf_conntrack_expect *exp)
@@ -439,7 +437,7 @@ static int nat_q931(struct sk_buff **pskb, struct nf_conn *ct,
        }
        /* Modify signal */
-        if (set_h225_addr(pskb, data, 0, &taddr[idx],
+        if (set_h225_addr(skb, data, 0, &taddr[idx],
                          &ct->tuplehash[!dir].tuple.dst.u3,
                          htons(nated_port)) == 0) {
                /* Save ports */
@@ -450,7 +448,7 @@ static int nat_q931(struct sk_buff **pskb, struct nf_conn *ct,
                if (idx > 0 &&
                    get_h225_addr(ct, *data, &taddr[0], &addr, &port) &&
                    (ntohl(addr.ip) & 0xff000000) == 0x7f000000) {
-                        set_h225_addr(pskb, data, 0, &taddr[0],
+                        set_h225_addr(skb, data, 0, &taddr[0],
                                      &ct->tuplehash[!dir].tuple.dst.u3,
                                      info->sig_port[!dir]);
                }
@@ -495,7 +493,7 @@ static void ip_nat_callforwarding_expect(struct nf_conn *new,
 }
 /****************************************************************************/
-static int nat_callforwarding(struct sk_buff **pskb, struct nf_conn *ct,
+static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
                              enum ip_conntrack_info ctinfo,
                              unsigned char **data, int dataoff,
                              TransportAddress *taddr, __be16 port,
@@ -525,7 +523,7 @@ static int nat_callforwarding(struct sk_buff **pskb, struct nf_conn *ct,
        }
        /* Modify signal */
-        if (!set_h225_addr(pskb, data, dataoff, taddr,
+        if (!set_h225_addr(skb, data, dataoff, taddr,
                           &ct->tuplehash[!dir].tuple.dst.u3,
                           htons(nated_port)) == 0) {
                nf_ct_unexpect_related(exp);
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 93d8a0a8f035..8718da00ef2a 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -111,22 +111,14 @@ static void mangle_contents(struct sk_buff *skb,
 }
 /* Unusual, but possible case. */
-static int enlarge_skb(struct sk_buff **pskb, unsigned int extra)
+static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
 {
-        struct sk_buff *nskb;
+        if (skb->len + extra > 65535)
-        if ((*pskb)->len + extra > 65535)
                return 0;
-        nskb = skb_copy_expand(*pskb, skb_headroom(*pskb), extra, GFP_ATOMIC);
+        if (pskb_expand_head(skb, 0, extra - skb_tailroom(skb), GFP_ATOMIC))
-        if (!nskb)
                return 0;
-        /* Transfer socket to new skb. */
-        if ((*pskb)->sk)
-                skb_set_owner_w(nskb, (*pskb)->sk);
-        kfree_skb(*pskb);
-        *pskb = nskb;
        return 1;
 }
@@ -139,7 +131,7 @@ static int enlarge_skb(struct sk_buff **pskb, unsigned int extra)
 *
 * */
 int
-nf_nat_mangle_tcp_packet(struct sk_buff **pskb,
+nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                         struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
                         unsigned int match_offset,
@@ -147,37 +139,37 @@ nf_nat_mangle_tcp_packet(struct sk_buff **pskb,
                         const char *rep_buffer,
                         unsigned int rep_len)
 {
-        struct rtable *rt = (struct rtable *)(*pskb)->dst;
+        struct rtable *rt = (struct rtable *)skb->dst;
        struct iphdr *iph;
        struct tcphdr *tcph;
        int oldlen, datalen;
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return 0;
        if (rep_len > match_len &&
-            rep_len - match_len > skb_tailroom(*pskb) &&
+            rep_len - match_len > skb_tailroom(skb) &&
-            !enlarge_skb(pskb, rep_len - match_len))
+            !enlarge_skb(skb, rep_len - match_len))
                return 0;
-        SKB_LINEAR_ASSERT(*pskb);
+        SKB_LINEAR_ASSERT(skb);
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
        tcph = (void *)iph + iph->ihl*4;
-        oldlen = (*pskb)->len - iph->ihl*4;
+        oldlen = skb->len - iph->ihl*4;
-        mangle_contents(*pskb, iph->ihl*4 + tcph->doff*4,
+        mangle_contents(skb, iph->ihl*4 + tcph->doff*4,
                        match_offset, match_len, rep_buffer, rep_len);
-        datalen = (*pskb)->len - iph->ihl*4;
+        datalen = skb->len - iph->ihl*4;
-        if ((*pskb)->ip_summed != CHECKSUM_PARTIAL) {
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
                if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    (*pskb)->dev->features & NETIF_F_V4_CSUM) {
+                    skb->dev->features & NETIF_F_V4_CSUM) {
-                        (*pskb)->ip_summed = CHECKSUM_PARTIAL;
+                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        (*pskb)->csum_start = skb_headroom(*pskb) +
+                        skb->csum_start = skb_headroom(skb) +
-                                              skb_network_offset(*pskb) +
+                                          skb_network_offset(skb) +
-                                              iph->ihl * 4;
+                                          iph->ihl * 4;
-                        (*pskb)->csum_offset = offsetof(struct tcphdr, check);
+                        skb->csum_offset = offsetof(struct tcphdr, check);
                        tcph->check = ~tcp_v4_check(datalen,
                                                    iph->saddr, iph->daddr, 0);
                } else {
@@ -188,7 +180,7 @@ nf_nat_mangle_tcp_packet(struct sk_buff **pskb,
                                                                datalen, 0));
                }
        } else
-                nf_proto_csum_replace2(&tcph->check, *pskb,
+                nf_proto_csum_replace2(&tcph->check, skb,
                                       htons(oldlen), htons(datalen), 1);
        if (rep_len != match_len) {
@@ -197,7 +189,7 @@ nf_nat_mangle_tcp_packet(struct sk_buff **pskb,
                                    (int)rep_len - (int)match_len,
                                    ct, ctinfo);
                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(*pskb, ip_hdrlen(*pskb),
+                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
                                        ct, CTINFO2DIR(ctinfo));
        }
        return 1;
@@ -215,7 +207,7 @@ EXPORT_SYMBOL(nf_nat_mangle_tcp_packet);
 *       should be fairly easy to do.
 */
 int
-nf_nat_mangle_udp_packet(struct sk_buff **pskb,
+nf_nat_mangle_udp_packet(struct sk_buff *skb,
                         struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
                         unsigned int match_offset,
@@ -223,48 +215,48 @@ nf_nat_mangle_udp_packet(struct sk_buff **pskb,
                         const char *rep_buffer,
                         unsigned int rep_len)
 {
-        struct rtable *rt = (struct rtable *)(*pskb)->dst;
+        struct rtable *rt = (struct rtable *)skb->dst;
        struct iphdr *iph;
        struct udphdr *udph;
        int datalen, oldlen;
        /* UDP helpers might accidentally mangle the wrong packet */
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
-        if ((*pskb)->len < iph->ihl*4 + sizeof(*udph) +
+        if (skb->len < iph->ihl*4 + sizeof(*udph) +
                               match_offset + match_len)
                return 0;
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return 0;
        if (rep_len > match_len &&
-            rep_len - match_len > skb_tailroom(*pskb) &&
+            rep_len - match_len > skb_tailroom(skb) &&
-            !enlarge_skb(pskb, rep_len - match_len))
+            !enlarge_skb(skb, rep_len - match_len))
                return 0;
-        iph = ip_hdr(*pskb);
+        iph = ip_hdr(skb);
        udph = (void *)iph + iph->ihl*4;
-        oldlen = (*pskb)->len - iph->ihl*4;
+        oldlen = skb->len - iph->ihl*4;
-        mangle_contents(*pskb, iph->ihl*4 + sizeof(*udph),
+        mangle_contents(skb, iph->ihl*4 + sizeof(*udph),
                        match_offset, match_len, rep_buffer, rep_len);
        /* update the length of the UDP packet */
-        datalen = (*pskb)->len - iph->ihl*4;
+        datalen = skb->len - iph->ihl*4;
        udph->len = htons(datalen);
        /* fix udp checksum if udp checksum was previously calculated */
-        if (!udph->check && (*pskb)->ip_summed != CHECKSUM_PARTIAL)
+        if (!udph->check && skb->ip_summed != CHECKSUM_PARTIAL)
                return 1;
-        if ((*pskb)->ip_summed != CHECKSUM_PARTIAL) {
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
                if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    (*pskb)->dev->features & NETIF_F_V4_CSUM) {
+                    skb->dev->features & NETIF_F_V4_CSUM) {
-                        (*pskb)->ip_summed = CHECKSUM_PARTIAL;
+                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        (*pskb)->csum_start = skb_headroom(*pskb) +
+                        skb->csum_start = skb_headroom(skb) +
-                                              skb_network_offset(*pskb) +
+                                          skb_network_offset(skb) +
-                                              iph->ihl * 4;
+                                          iph->ihl * 4;
-                        (*pskb)->csum_offset = offsetof(struct udphdr, check);
+                        skb->csum_offset = offsetof(struct udphdr, check);
                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
                                                         datalen, IPPROTO_UDP,
                                                         0);
@@ -278,7 +270,7 @@ nf_nat_mangle_udp_packet(struct sk_buff **pskb,
                                udph->check = CSUM_MANGLED_0;
                }
        } else
-                nf_proto_csum_replace2(&udph->check, *pskb,
+                nf_proto_csum_replace2(&udph->check, skb,
                                       htons(oldlen), htons(datalen), 1);
        return 1;
@@ -330,7 +322,7 @@ sack_adjust(struct sk_buff *skb,
 /* TCP SACK sequence number adjustment */
 static inline unsigned int
-nf_nat_sack_adjust(struct sk_buff **pskb,
+nf_nat_sack_adjust(struct sk_buff *skb,
                   struct tcphdr *tcph,
                   struct nf_conn *ct,
                   enum ip_conntrack_info ctinfo)
@@ -338,17 +330,17 @@ nf_nat_sack_adjust(struct sk_buff **pskb,
        unsigned int dir, optoff, optend;
        struct nf_conn_nat *nat = nfct_nat(ct);
-        optoff = ip_hdrlen(*pskb) + sizeof(struct tcphdr);
+        optoff = ip_hdrlen(skb) + sizeof(struct tcphdr);
-        optend = ip_hdrlen(*pskb) + tcph->doff * 4;
+        optend = ip_hdrlen(skb) + tcph->doff * 4;
-        if (!skb_make_writable(pskb, optend))
+        if (!skb_make_writable(skb, optend))
                return 0;
        dir = CTINFO2DIR(ctinfo);
        while (optoff < optend) {
                /* Usually: option, length. */
-                unsigned char *op = (*pskb)->data + optoff;
+                unsigned char *op = skb->data + optoff;
                switch (op[0]) {
                case TCPOPT_EOL:
@@ -365,7 +357,7 @@ nf_nat_sack_adjust(struct sk_buff **pskb,
                        if (op[0] == TCPOPT_SACK &&
                            op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
                            ((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
-                                sack_adjust(*pskb, tcph, optoff+2,
+                                sack_adjust(skb, tcph, optoff+2,
                                            optoff+op[1], &nat->seq[!dir]);
                        optoff += op[1];
                }
@@ -375,7 +367,7 @@ nf_nat_sack_adjust(struct sk_buff **pskb,
 /* TCP sequence number adjustment.  Returns 1 on success, 0 on failure */
 int
-nf_nat_seq_adjust(struct sk_buff **pskb,
+nf_nat_seq_adjust(struct sk_buff *skb,
                  struct nf_conn *ct,
                  enum ip_conntrack_info ctinfo)
 {
@@ -390,10 +382,10 @@ nf_nat_seq_adjust(struct sk_buff **pskb,
        this_way = &nat->seq[dir];
        other_way = &nat->seq[!dir];
-        if (!skb_make_writable(pskb, ip_hdrlen(*pskb) + sizeof(*tcph)))
+        if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
                return 0;
-        tcph = (void *)(*pskb)->data + ip_hdrlen(*pskb);
+        tcph = (void *)skb->data + ip_hdrlen(skb);
        if (after(ntohl(tcph->seq), this_way->correction_pos))
                newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
        else
@@ -405,8 +397,8 @@ nf_nat_seq_adjust(struct sk_buff **pskb,
        else
                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
-        nf_proto_csum_replace4(&tcph->check, *pskb, tcph->seq, newseq, 0);
+        nf_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
-        nf_proto_csum_replace4(&tcph->check, *pskb, tcph->ack_seq, newack, 0);
+        nf_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
        pr_debug("Adjusting sequence number from %u->%u, ack from %u->%u\n",
                 ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
@@ -415,10 +407,10 @@ nf_nat_seq_adjust(struct sk_buff **pskb,
        tcph->seq = newseq;
        tcph->ack_seq = newack;
-        if (!nf_nat_sack_adjust(pskb, tcph, ct, ctinfo))
+        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
                return 0;
-        nf_conntrack_tcp_update(*pskb, ip_hdrlen(*pskb), ct, dir);
+        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir);
        return 1;
 }
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index bcf274bba602..766e2c16c6b9 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -27,7 +27,7 @@ MODULE_DESCRIPTION("IRC (DCC) NAT helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_nat_irc");
-static unsigned int help(struct sk_buff **pskb,
+static unsigned int help(struct sk_buff *skb,
                         enum ip_conntrack_info ctinfo,
                         unsigned int matchoff,
                         unsigned int matchlen,
@@ -58,7 +58,7 @@ static unsigned int help(struct sk_buff **pskb,
        pr_debug("nf_nat_irc: inserting '%s' == %u.%u.%u.%u, port %u\n",
                 buffer, NIPQUAD(ip), port);
-        ret = nf_nat_mangle_tcp_packet(pskb, exp->master, ctinfo,
+        ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo,
                                       matchoff, matchlen, buffer,
                                       strlen(buffer));
        if (ret != NF_ACCEPT)
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 984ec8308b2e..e1385a099079 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -110,7 +110,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
 /* outbound packets == from PNS to PAC */
 static int
-pptp_outbound_pkt(struct sk_buff **pskb,
+pptp_outbound_pkt(struct sk_buff *skb,
                  struct nf_conn *ct,
                  enum ip_conntrack_info ctinfo,
                  struct PptpControlHeader *ctlh,
@@ -175,7 +175,7 @@ pptp_outbound_pkt(struct sk_buff **pskb,
                 ntohs(REQ_CID(pptpReq, cid_off)), ntohs(new_callid));
        /* mangle packet */
-        if (nf_nat_mangle_tcp_packet(pskb, ct, ctinfo,
+        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
                                     cid_off + sizeof(struct pptp_pkt_hdr) +
                                     sizeof(struct PptpControlHeader),
                                     sizeof(new_callid), (char *)&new_callid,
@@ -213,7 +213,7 @@ pptp_exp_gre(struct nf_conntrack_expect *expect_orig,
 /* inbound packets == from PAC to PNS */
 static int
-pptp_inbound_pkt(struct sk_buff **pskb,
+pptp_inbound_pkt(struct sk_buff *skb,
                 struct nf_conn *ct,
                 enum ip_conntrack_info ctinfo,
                 struct PptpControlHeader *ctlh,
@@ -268,7 +268,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
        pr_debug("altering peer call id from 0x%04x to 0x%04x\n",
                 ntohs(REQ_CID(pptpReq, pcid_off)), ntohs(new_pcid));
-        if (nf_nat_mangle_tcp_packet(pskb, ct, ctinfo,
+        if (nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
                                     pcid_off + sizeof(struct pptp_pkt_hdr) +
                                     sizeof(struct PptpControlHeader),
                                     sizeof(new_pcid), (char *)&new_pcid,
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index d562290b1820..b820f9960356 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -98,21 +98,21 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
 /* manipulate a GRE packet according to maniptype */
 static int
-gre_manip_pkt(struct sk_buff **pskb, unsigned int iphdroff,
+gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
              const struct nf_conntrack_tuple *tuple,
              enum nf_nat_manip_type maniptype)
 {
        struct gre_hdr *greh;
        struct gre_hdr_pptp *pgreh;
-        struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
        unsigned int hdroff = iphdroff + iph->ihl * 4;
        /* pgreh includes two optional 32bit fields which are not required
         * to be there.  That's where the magic '8' comes from */
-        if (!skb_make_writable(pskb, hdroff + sizeof(*pgreh) - 8))
+        if (!skb_make_writable(skb, hdroff + sizeof(*pgreh) - 8))
                return 0;
-        greh = (void *)(*pskb)->data + hdroff;
+        greh = (void *)skb->data + hdroff;
        pgreh = (struct gre_hdr_pptp *)greh;
        /* we only have destination manip of a packet, since 'source key'
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index 898d73771155..b9fc724388fc 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -52,20 +52,20 @@ icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
 }
 static int
-icmp_manip_pkt(struct sk_buff **pskb,
+icmp_manip_pkt(struct sk_buff *skb,
               unsigned int iphdroff,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
        struct icmphdr *hdr;
        unsigned int hdroff = iphdroff + iph->ihl*4;
-        if (!skb_make_writable(pskb, hdroff + sizeof(*hdr)))
+        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                return 0;
-        hdr = (struct icmphdr *)((*pskb)->data + hdroff);
+        hdr = (struct icmphdr *)(skb->data + hdroff);
-        nf_proto_csum_replace2(&hdr->checksum, *pskb,
+        nf_proto_csum_replace2(&hdr->checksum, skb,
                               hdr->un.echo.id, tuple->src.u.icmp.id, 0);
        hdr->un.echo.id = tuple->src.u.icmp.id;
        return 1;
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index 5bbbb2acdc70..6bab2e184455 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -88,12 +88,12 @@ tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
 }
 static int
-tcp_manip_pkt(struct sk_buff **pskb,
+tcp_manip_pkt(struct sk_buff *skb,
              unsigned int iphdroff,
              const struct nf_conntrack_tuple *tuple,
              enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
        struct tcphdr *hdr;
        unsigned int hdroff = iphdroff + iph->ihl*4;
        __be32 oldip, newip;
@@ -103,14 +103,14 @@ tcp_manip_pkt(struct sk_buff **pskb,
        /* this could be a inner header returned in icmp packet; in such
           cases we cannot update the checksum field since it is outside of
           the 8 bytes of transport layer headers we are guaranteed */
-        if ((*pskb)->len >= hdroff + sizeof(struct tcphdr))
+        if (skb->len >= hdroff + sizeof(struct tcphdr))
                hdrsize = sizeof(struct tcphdr);
-        if (!skb_make_writable(pskb, hdroff + hdrsize))
+        if (!skb_make_writable(skb, hdroff + hdrsize))
                return 0;
-        iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        iph = (struct iphdr *)(skb->data + iphdroff);
-        hdr = (struct tcphdr *)((*pskb)->data + hdroff);
+        hdr = (struct tcphdr *)(skb->data + hdroff);
        if (maniptype == IP_NAT_MANIP_SRC) {
                /* Get rid of src ip and src pt */
@@ -132,8 +132,8 @@ tcp_manip_pkt(struct sk_buff **pskb,
        if (hdrsize < sizeof(*hdr))
                return 1;
-        nf_proto_csum_replace4(&hdr->check, *pskb, oldip, newip, 1);
+        nf_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
-        nf_proto_csum_replace2(&hdr->check, *pskb, oldport, newport, 0);
+        nf_proto_csum_replace2(&hdr->check, skb, oldport, newport, 0);
        return 1;
 }
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index a0af4fd95584..cbf1a61e2908 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -86,22 +86,22 @@ udp_unique_tuple(struct nf_conntrack_tuple *tuple,
 }
 static int
-udp_manip_pkt(struct sk_buff **pskb,
+udp_manip_pkt(struct sk_buff *skb,
              unsigned int iphdroff,
              const struct nf_conntrack_tuple *tuple,
              enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
        struct udphdr *hdr;
        unsigned int hdroff = iphdroff + iph->ihl*4;
        __be32 oldip, newip;
        __be16 *portptr, newport;
-        if (!skb_make_writable(pskb, hdroff + sizeof(*hdr)))
+        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
                return 0;
-        iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        iph = (struct iphdr *)(skb->data + iphdroff);
-        hdr = (struct udphdr *)((*pskb)->data + hdroff);
+        hdr = (struct udphdr *)(skb->data + hdroff);
        if (maniptype == IP_NAT_MANIP_SRC) {
                /* Get rid of src ip and src pt */
@@ -116,9 +116,9 @@ udp_manip_pkt(struct sk_buff **pskb,
                newport = tuple->dst.u.udp.port;
                portptr = &hdr->dest;
        }
-        if (hdr->check || (*pskb)->ip_summed == CHECKSUM_PARTIAL) {
+        if (hdr->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-                nf_proto_csum_replace4(&hdr->check, *pskb, oldip, newip, 1);
+                nf_proto_csum_replace4(&hdr->check, skb, oldip, newip, 1);
-                nf_proto_csum_replace2(&hdr->check, *pskb, *portptr, newport,
+                nf_proto_csum_replace2(&hdr->check, skb, *portptr, newport,
                                       0);
                if (!hdr->check)
                        hdr->check = CSUM_MANGLED_0;
diff --git a/net/ipv4/netfilter/nf_nat_proto_unknown.c b/net/ipv4/netfilter/nf_nat_proto_unknown.c
index f50d0203f9c0..cfd2742e9706 100644
--- a/net/ipv4/netfilter/nf_nat_proto_unknown.c
+++ b/net/ipv4/netfilter/nf_nat_proto_unknown.c
@@ -37,7 +37,7 @@ static int unknown_unique_tuple(struct nf_conntrack_tuple *tuple,
 }
 static int
-unknown_manip_pkt(struct sk_buff **pskb,
+unknown_manip_pkt(struct sk_buff *skb,
                  unsigned int iphdroff,
                  const struct nf_conntrack_tuple *tuple,
                  enum nf_nat_manip_type maniptype)
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 76ec59ae524d..46b25ab5f78b 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -65,7 +65,7 @@ static struct xt_table nat_table = {
 };
 /* Source NAT */
-static unsigned int ipt_snat_target(struct sk_buff **pskb,
+static unsigned int ipt_snat_target(struct sk_buff *skb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    unsigned int hooknum,
@@ -78,7 +78,7 @@ static unsigned int ipt_snat_target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_POST_ROUTING);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        /* Connection must be valid and new. */
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
@@ -107,7 +107,7 @@ static void warn_if_extra_mangle(__be32 dstip, __be32 srcip)
        ip_rt_put(rt);
 }
-static unsigned int ipt_dnat_target(struct sk_buff **pskb,
+static unsigned int ipt_dnat_target(struct sk_buff *skb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    unsigned int hooknum,
@@ -121,14 +121,14 @@ static unsigned int ipt_dnat_target(struct sk_buff **pskb,
        NF_CT_ASSERT(hooknum == NF_IP_PRE_ROUTING ||
                     hooknum == NF_IP_LOCAL_OUT);
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        /* Connection must be valid and new. */
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
        if (hooknum == NF_IP_LOCAL_OUT &&
            mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)
-                warn_if_extra_mangle(ip_hdr(*pskb)->daddr,
+                warn_if_extra_mangle(ip_hdr(skb)->daddr,
                                     mr->range[0].min_ip);
        return nf_nat_setup_info(ct, &mr->range[0], hooknum);
@@ -204,7 +204,7 @@ alloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum)
        return nf_nat_setup_info(ct, &range, hooknum);
 }
-int nf_nat_rule_find(struct sk_buff **pskb,
+int nf_nat_rule_find(struct sk_buff *skb,
                     unsigned int hooknum,
                     const struct net_device *in,
                     const struct net_device *out,
@@ -212,7 +212,7 @@ int nf_nat_rule_find(struct sk_buff **pskb,
 {
        int ret;
-        ret = ipt_do_table(pskb, hooknum, in, out, &nat_table);
+        ret = ipt_do_table(skb, hooknum, in, out, &nat_table);
        if (ret == NF_ACCEPT) {
                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index e14d41976c27..ce9edbcc01e3 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -60,7 +60,7 @@ static void addr_map_init(struct nf_conn *ct, struct addr_map *map)
        }
 }
-static int map_sip_addr(struct sk_buff **pskb, enum ip_conntrack_info ctinfo,
+static int map_sip_addr(struct sk_buff *skb, enum ip_conntrack_info ctinfo,
                        struct nf_conn *ct, const char **dptr, size_t dlen,
                        enum sip_header_pos pos, struct addr_map *map)
 {
@@ -84,15 +84,15 @@ static int map_sip_addr(struct sk_buff **pskb, enum ip_conntrack_info ctinfo,
        } else
                return 1;
-        if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
+        if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
                                      matchoff, matchlen, addr, addrlen))
                return 0;
-        *dptr = (*pskb)->data + ip_hdrlen(*pskb) + sizeof(struct udphdr);
+        *dptr = skb->data + ip_hdrlen(skb) + sizeof(struct udphdr);
        return 1;
 }
-static unsigned int ip_nat_sip(struct sk_buff **pskb,
+static unsigned int ip_nat_sip(struct sk_buff *skb,
                               enum ip_conntrack_info ctinfo,
                               struct nf_conn *ct,
                               const char **dptr)
@@ -101,8 +101,8 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb,
        struct addr_map map;
        int dataoff, datalen;
-        dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr);
+        dataoff = ip_hdrlen(skb) + sizeof(struct udphdr);
-        datalen = (*pskb)->len - dataoff;
+        datalen = skb->len - dataoff;
        if (datalen < sizeof("SIP/2.0") - 1)
                return NF_ACCEPT;
@@ -121,19 +121,19 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb,
                else
                        pos = POS_REQ_URI;
-                if (!map_sip_addr(pskb, ctinfo, ct, dptr, datalen, pos, &map))
+                if (!map_sip_addr(skb, ctinfo, ct, dptr, datalen, pos, &map))
                        return NF_DROP;
        }
-        if (!map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_FROM, &map) ||
+        if (!map_sip_addr(skb, ctinfo, ct, dptr, datalen, POS_FROM, &map) ||
-            !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_TO, &map) ||
+            !map_sip_addr(skb, ctinfo, ct, dptr, datalen, POS_TO, &map) ||
-            !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_VIA, &map) ||
+            !map_sip_addr(skb, ctinfo, ct, dptr, datalen, POS_VIA, &map) ||
-            !map_sip_addr(pskb, ctinfo, ct, dptr, datalen, POS_CONTACT, &map))
+            !map_sip_addr(skb, ctinfo, ct, dptr, datalen, POS_CONTACT, &map))
                return NF_DROP;
        return NF_ACCEPT;
 }
-static unsigned int mangle_sip_packet(struct sk_buff **pskb,
+static unsigned int mangle_sip_packet(struct sk_buff *skb,
                                      enum ip_conntrack_info ctinfo,
                                      struct nf_conn *ct,
                                      const char **dptr, size_t dlen,
@@ -145,16 +145,16 @@ static unsigned int mangle_sip_packet(struct sk_buff **pskb,
        if (ct_sip_get_info(ct, *dptr, dlen, &matchoff, &matchlen, pos) <= 0)
                return 0;
-        if (!nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
+        if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
                                      matchoff, matchlen, buffer, bufflen))
                return 0;
        /* We need to reload this. Thanks Patrick. */
-        *dptr = (*pskb)->data + ip_hdrlen(*pskb) + sizeof(struct udphdr);
+        *dptr = skb->data + ip_hdrlen(skb) + sizeof(struct udphdr);
        return 1;
 }
-static int mangle_content_len(struct sk_buff **pskb,
+static int mangle_content_len(struct sk_buff *skb,
                              enum ip_conntrack_info ctinfo,
                              struct nf_conn *ct,
                              const char *dptr)
@@ -163,22 +163,22 @@ static int mangle_content_len(struct sk_buff **pskb,
        char buffer[sizeof("65536")];
        int bufflen;
-        dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr);
+        dataoff = ip_hdrlen(skb) + sizeof(struct udphdr);
        /* Get actual SDP lenght */
-        if (ct_sip_get_info(ct, dptr, (*pskb)->len - dataoff, &matchoff,
+        if (ct_sip_get_info(ct, dptr, skb->len - dataoff, &matchoff,
                            &matchlen, POS_SDP_HEADER) > 0) {
                /* since ct_sip_get_info() give us a pointer passing 'v='
                   we need to add 2 bytes in this count. */
-                int c_len = (*pskb)->len - dataoff - matchoff + 2;
+                int c_len = skb->len - dataoff - matchoff + 2;
                /* Now, update SDP length */
-                if (ct_sip_get_info(ct, dptr, (*pskb)->len - dataoff, &matchoff,
+                if (ct_sip_get_info(ct, dptr, skb->len - dataoff, &matchoff,
                                    &matchlen, POS_CONTENT) > 0) {
                        bufflen = sprintf(buffer, "%u", c_len);
-                        return nf_nat_mangle_udp_packet(pskb, ct, ctinfo,
+                        return nf_nat_mangle_udp_packet(skb, ct, ctinfo,
                                                        matchoff, matchlen,
                                                        buffer, bufflen);
                }
@@ -186,7 +186,7 @@ static int mangle_content_len(struct sk_buff **pskb,
        return 0;
 }
-static unsigned int mangle_sdp(struct sk_buff **pskb,
+static unsigned int mangle_sdp(struct sk_buff *skb,
                               enum ip_conntrack_info ctinfo,
                               struct nf_conn *ct,
                               __be32 newip, u_int16_t port,
@@ -195,25 +195,25 @@ static unsigned int mangle_sdp(struct sk_buff **pskb,
        char buffer[sizeof("nnn.nnn.nnn.nnn")];
        unsigned int dataoff, bufflen;
-        dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr);
+        dataoff = ip_hdrlen(skb) + sizeof(struct udphdr);
        /* Mangle owner and contact info. */
        bufflen = sprintf(buffer, "%u.%u.%u.%u", NIPQUAD(newip));
-        if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+        if (!mangle_sip_packet(skb, ctinfo, ct, &dptr, skb->len - dataoff,
                               buffer, bufflen, POS_OWNER_IP4))
                return 0;
-        if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+        if (!mangle_sip_packet(skb, ctinfo, ct, &dptr, skb->len - dataoff,
                               buffer, bufflen, POS_CONNECTION_IP4))
                return 0;
        /* Mangle media port. */
        bufflen = sprintf(buffer, "%u", port);
-        if (!mangle_sip_packet(pskb, ctinfo, ct, &dptr, (*pskb)->len - dataoff,
+        if (!mangle_sip_packet(skb, ctinfo, ct, &dptr, skb->len - dataoff,
                               buffer, bufflen, POS_MEDIA))
                return 0;
-        return mangle_content_len(pskb, ctinfo, ct, dptr);
+        return mangle_content_len(skb, ctinfo, ct, dptr);
 }
 static void ip_nat_sdp_expect(struct nf_conn *ct,
@@ -241,7 +241,7 @@ static void ip_nat_sdp_expect(struct nf_conn *ct,
 /* So, this packet has hit the connection tracking matching code.
   Mangle it, and change the expectation to match the new version. */
-static unsigned int ip_nat_sdp(struct sk_buff **pskb,
+static unsigned int ip_nat_sdp(struct sk_buff *skb,
                               enum ip_conntrack_info ctinfo,
                               struct nf_conntrack_expect *exp,
                               const char *dptr)
@@ -277,7 +277,7 @@ static unsigned int ip_nat_sdp(struct sk_buff **pskb,
        if (port == 0)
                return NF_DROP;
-        if (!mangle_sdp(pskb, ctinfo, ct, newip, port, dptr)) {
+        if (!mangle_sdp(skb, ctinfo, ct, newip, port, dptr)) {
                nf_ct_unexpect_related(exp);
                return NF_DROP;
        }
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 6bfcd3a90f08..03709d6b4b06 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1188,9 +1188,9 @@ static int snmp_parse_mangle(unsigned char *msg,
 */
 static int snmp_translate(struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
-                          struct sk_buff **pskb)
+                          struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
        struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
        u_int16_t udplen = ntohs(udph->len);
        u_int16_t paylen = udplen - sizeof(struct udphdr);
@@ -1225,13 +1225,13 @@ static int snmp_translate(struct nf_conn *ct,
 /* We don't actually set up expectations, just adjust internal IP
 * addresses if this is being NATted */
-static int help(struct sk_buff **pskb, unsigned int protoff,
+static int help(struct sk_buff *skb, unsigned int protoff,
                struct nf_conn *ct,
                enum ip_conntrack_info ctinfo)
 {
        int dir = CTINFO2DIR(ctinfo);
        unsigned int ret;
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
        struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
        /* SNMP replies and originating SNMP traps get mangled */
@@ -1250,7 +1250,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
         * enough room for a UDP header.  Just verify the UDP length field so we
         * can mess around with the payload.
         */
-        if (ntohs(udph->len) != (*pskb)->len - (iph->ihl << 2)) {
+        if (ntohs(udph->len) != skb->len - (iph->ihl << 2)) {
                 if (net_ratelimit())
                         printk(KERN_WARNING "SNMP: dropping malformed packet "
                                "src=%u.%u.%u.%u dst=%u.%u.%u.%u\n",
@@ -1258,11 +1258,11 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
                 return NF_DROP;
        }
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return NF_DROP;
        spin_lock_bh(&snmp_lock);
-        ret = snmp_translate(ct, ctinfo, pskb);
+        ret = snmp_translate(ct, ctinfo, skb);
        spin_unlock_bh(&snmp_lock);
        return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 46cc99def165..7db76ea9af91 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -67,7 +67,7 @@ static void nat_decode_session(struct sk_buff *skb, struct flowi *fl)
 static unsigned int
 nf_nat_fn(unsigned int hooknum,
-          struct sk_buff **pskb,
+          struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
@@ -80,9 +80,9 @@ nf_nat_fn(unsigned int hooknum,
        /* We never see fragments: conntrack defrags on pre-routing
           and local-out, and nf_nat_out protects post-routing. */
-        NF_CT_ASSERT(!(ip_hdr(*pskb)->frag_off & htons(IP_MF | IP_OFFSET)));
+        NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        /* Can't track?  It's not due to stress, or conntrack would
           have dropped it.  Hence it's the user's responsibilty to
           packet filter it out, or implement conntrack/NAT for that
@@ -91,10 +91,10 @@ nf_nat_fn(unsigned int hooknum,
                /* Exception: ICMP redirect to new connection (not in
                   hash table yet).  We must not let this through, in
                   case we're doing NAT to the same network. */
-                if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
+                if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
                        struct icmphdr _hdr, *hp;
-                        hp = skb_header_pointer(*pskb, ip_hdrlen(*pskb),
+                        hp = skb_header_pointer(skb, ip_hdrlen(skb),
                                                sizeof(_hdr), &_hdr);
                        if (hp != NULL &&
                            hp->type == ICMP_REDIRECT)
@@ -119,9 +119,9 @@ nf_nat_fn(unsigned int hooknum,
        switch (ctinfo) {
        case IP_CT_RELATED:
        case IP_CT_RELATED+IP_CT_IS_REPLY:
-                if (ip_hdr(*pskb)->protocol == IPPROTO_ICMP) {
+                if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
                        if (!nf_nat_icmp_reply_translation(ct, ctinfo,
-                                                           hooknum, pskb))
+                                                           hooknum, skb))
                                return NF_DROP;
                        else
                                return NF_ACCEPT;
@@ -141,7 +141,7 @@ nf_nat_fn(unsigned int hooknum,
                                /* LOCAL_IN hook doesn't have a chain!  */
                                ret = alloc_null_binding(ct, hooknum);
                        else
-                                ret = nf_nat_rule_find(pskb, hooknum, in, out,
+                                ret = nf_nat_rule_find(skb, hooknum, in, out,
                                                       ct);
                        if (ret != NF_ACCEPT) {
@@ -159,31 +159,31 @@ nf_nat_fn(unsigned int hooknum,
                             ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));
        }
-        return nf_nat_packet(ct, ctinfo, hooknum, pskb);
+        return nf_nat_packet(ct, ctinfo, hooknum, skb);
 }
 static unsigned int
 nf_nat_in(unsigned int hooknum,
-          struct sk_buff **pskb,
+          struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
        unsigned int ret;
-        __be32 daddr = ip_hdr(*pskb)->daddr;
+        __be32 daddr = ip_hdr(skb)->daddr;
-        ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
+        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
        if (ret != NF_DROP && ret != NF_STOLEN &&
-            daddr != ip_hdr(*pskb)->daddr) {
+            daddr != ip_hdr(skb)->daddr) {
-                dst_release((*pskb)->dst);
+                dst_release(skb->dst);
-                (*pskb)->dst = NULL;
+                skb->dst = NULL;
        }
        return ret;
 }
 static unsigned int
 nf_nat_out(unsigned int hooknum,
-           struct sk_buff **pskb,
+           struct sk_buff *skb,
           const struct net_device *in,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
@@ -195,14 +195,14 @@ nf_nat_out(unsigned int hooknum,
        unsigned int ret;
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr) ||
+        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(*pskb) < sizeof(struct iphdr))
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                return NF_ACCEPT;
-        ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
+        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
 #ifdef CONFIG_XFRM
        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
                if (ct->tuplehash[dir].tuple.src.u3.ip !=
@@ -210,7 +210,7 @@ nf_nat_out(unsigned int hooknum,
                    || ct->tuplehash[dir].tuple.src.u.all !=
                       ct->tuplehash[!dir].tuple.dst.u.all
                    )
-                        return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
+                        return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
        }
 #endif
        return ret;
@@ -218,7 +218,7 @@ nf_nat_out(unsigned int hooknum,
 static unsigned int
 nf_nat_local_fn(unsigned int hooknum,
-                struct sk_buff **pskb,
+                struct sk_buff *skb,
                const struct net_device *in,
                const struct net_device *out,
                int (*okfn)(struct sk_buff *))
@@ -228,24 +228,24 @@ nf_nat_local_fn(unsigned int hooknum,
        unsigned int ret;
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr) ||
+        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(*pskb) < sizeof(struct iphdr))
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                return NF_ACCEPT;
-        ret = nf_nat_fn(hooknum, pskb, in, out, okfn);
+        ret = nf_nat_fn(hooknum, skb, in, out, okfn);
        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(*pskb, &ctinfo)) != NULL) {
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
                if (ct->tuplehash[dir].tuple.dst.u3.ip !=
                    ct->tuplehash[!dir].tuple.src.u3.ip) {
-                        if (ip_route_me_harder(pskb, RTN_UNSPEC))
+                        if (ip_route_me_harder(skb, RTN_UNSPEC))
                                ret = NF_DROP;
                }
 #ifdef CONFIG_XFRM
                else if (ct->tuplehash[dir].tuple.dst.u.all !=
                         ct->tuplehash[!dir].tuple.src.u.all)
-                        if (ip_xfrm_me_harder(pskb))
+                        if (ip_xfrm_me_harder(skb))
                                ret = NF_DROP;
 #endif
        }
@@ -254,7 +254,7 @@ nf_nat_local_fn(unsigned int hooknum,
 static unsigned int
 nf_nat_adjust(unsigned int hooknum,
-              struct sk_buff **pskb,
+              struct sk_buff *skb,
              const struct net_device *in,
              const struct net_device *out,
              int (*okfn)(struct sk_buff *))
@@ -262,10 +262,10 @@ nf_nat_adjust(unsigned int hooknum,
        struct nf_conn *ct;
        enum ip_conntrack_info ctinfo;
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
                pr_debug("nf_nat_standalone: adjusting sequence number\n");
-                if (!nf_nat_seq_adjust(pskb, ct, ctinfo))
+                if (!nf_nat_seq_adjust(skb, ct, ctinfo))
                        return NF_DROP;
        }
        return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index 04dfeaefec02..0ecec701cb44 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -20,7 +20,7 @@ MODULE_DESCRIPTION("TFTP NAT helper");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ip_nat_tftp");
-static unsigned int help(struct sk_buff **pskb,
+static unsigned int help(struct sk_buff *skb,
                         enum ip_conntrack_info ctinfo,
                         struct nf_conntrack_expect *exp)
 {
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index e5b05b039101..fd16cb8f8abe 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -70,8 +70,8 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
        seq_printf(seq, "UDP: inuse %d\n", fold_prot_inuse(&udp_prot));
        seq_printf(seq, "UDPLITE: inuse %d\n", fold_prot_inuse(&udplite_prot));
        seq_printf(seq, "RAW: inuse %d\n", fold_prot_inuse(&raw_prot));
-        seq_printf(seq,  "FRAG: inuse %d memory %d\n", ip_frag_nqueues,
+        seq_printf(seq,  "FRAG: inuse %d memory %d\n",
-                   atomic_read(&ip_frag_mem));
+                        ip_frag_nqueues(), ip_frag_mem());
        return 0;
 }
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index eb286abcf5dc..c98ef16effd2 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -19,6 +19,7 @@
 #include <net/route.h>
 #include <net/tcp.h>
 #include <net/cipso_ipv4.h>
+#include <net/inet_frag.h>
 /* From af_inet.c */
 extern int sysctl_ip_nonlocal_bind;
@@ -357,7 +358,7 @@ ctl_table ipv4_table[] = {
        {
                .ctl_name       = NET_IPV4_IPFRAG_HIGH_THRESH,
                .procname       = "ipfrag_high_thresh",
-                .data           = &sysctl_ipfrag_high_thresh,
+                .data           = &ip4_frags_ctl.high_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
@@ -365,7 +366,7 @@ ctl_table ipv4_table[] = {
        {
                .ctl_name       = NET_IPV4_IPFRAG_LOW_THRESH,
                .procname       = "ipfrag_low_thresh",
-                .data           = &sysctl_ipfrag_low_thresh,
+                .data           = &ip4_frags_ctl.low_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
@@ -381,7 +382,7 @@ ctl_table ipv4_table[] = {
        {
                .ctl_name       = NET_IPV4_IPFRAG_TIME,
                .procname       = "ipfrag_time",
-                .data           = &sysctl_ipfrag_time,
+                .data           = &ip4_frags_ctl.timeout,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec_jiffies,
@@ -732,7 +733,7 @@ ctl_table ipv4_table[] = {
        {
                .ctl_name       = NET_IPV4_IPFRAG_SECRET_INTERVAL,
                .procname       = "ipfrag_secret_interval",
-                .data           = &sysctl_ipfrag_secret_interval,
+                .data           = &ip4_frags_ctl.secret_interval,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec_jiffies,
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0a42e9340346..0f00966b1784 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1995,8 +1995,7 @@ static void tcp_verify_retransmit_hint(struct tcp_sock *tp,
 }
 /* Mark head of queue up as lost. */
-static void tcp_mark_head_lost(struct sock *sk,
+static void tcp_mark_head_lost(struct sock *sk, int packets)
-                               int packets, u32 high_seq)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
@@ -2019,7 +2018,7 @@ static void tcp_mark_head_lost(struct sock *sk,
                tp->lost_skb_hint = skb;
                tp->lost_cnt_hint = cnt;
                cnt += tcp_skb_pcount(skb);
-                if (cnt > packets || after(TCP_SKB_CB(skb)->end_seq, high_seq))
+                if (cnt > packets || after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
                        break;
                if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
                        TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
@@ -2040,9 +2039,9 @@ static void tcp_update_scoreboard(struct sock *sk)
                int lost = tp->fackets_out - tp->reordering;
                if (lost <= 0)
                        lost = 1;
-                tcp_mark_head_lost(sk, lost, tp->high_seq);
+                tcp_mark_head_lost(sk, lost);
        } else {
-                tcp_mark_head_lost(sk, 1, tp->high_seq);
+                tcp_mark_head_lost(sk, 1);
        }
        /* New heuristics: it is possible only after we switched
@@ -2381,7 +2380,7 @@ tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
            before(tp->snd_una, tp->high_seq) &&
            icsk->icsk_ca_state != TCP_CA_Open &&
            tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out-tp->reordering, tp->high_seq);
+                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering);
                NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
        }
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 434ef302ba83..a4edd666318b 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -78,7 +78,7 @@ static int xfrm4_output_finish2(struct sk_buff *skb)
        while (likely((err = xfrm4_output_one(skb)) == 0)) {
                nf_reset(skb);
-                err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, &skb, NULL,
+                err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, skb, NULL,
                              skb->dst->dev, dst_output);
                if (unlikely(err != 1))
                        break;
@@ -86,7 +86,7 @@ static int xfrm4_output_finish2(struct sk_buff *skb)
                if (!skb->dst->xfrm)
                        return dst_output(skb);
-                err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL,
+                err = nf_hook(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
                              skb->dst->dev, xfrm4_output_finish2);
                if (unlikely(err != 1))
                        break;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index c82d4d49f71f..1e89efd38a0c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -102,7 +102,7 @@ EXPORT_SYMBOL_GPL(ipv6_find_tlv);
 struct tlvtype_proc {
        int     type;
-        int     (*func)(struct sk_buff **skbp, int offset);
+        int     (*func)(struct sk_buff *skb, int offset);
 };
 /*********************
@@ -111,10 +111,8 @@ struct tlvtype_proc {
 /* An unknown option is detected, decide what to do */
-static int ip6_tlvopt_unknown(struct sk_buff **skbp, int optoff)
+static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 {
-        struct sk_buff *skb = *skbp;
        switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
        case 0: /* ignore */
                return 1;
@@ -139,9 +137,8 @@ static int ip6_tlvopt_unknown(struct sk_buff **skbp, int optoff)
 /* Parse tlv encoded option header (hop-by-hop or destination) */
-static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
+static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
        struct tlvtype_proc *curr;
        const unsigned char *nh = skb_network_header(skb);
        int off = skb_network_header_len(skb);
@@ -172,13 +169,13 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
                                        /* type specific length/alignment
                                           checks will be performed in the
                                           func(). */
-                                        if (curr->func(skbp, off) == 0)
+                                        if (curr->func(skb, off) == 0)
                                                return 0;
                                        break;
                                }
                        }
                        if (curr->type < 0) {
-                                if (ip6_tlvopt_unknown(skbp, off) == 0)
+                                if (ip6_tlvopt_unknown(skb, off) == 0)
                                        return 0;
                        }
                        break;
@@ -198,9 +195,8 @@ bad:
 *****************************/
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
+static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
 {
-        struct sk_buff *skb = *skbp;
        struct ipv6_destopt_hao *hao;
        struct inet6_skb_parm *opt = IP6CB(skb);
        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
@@ -234,22 +230,13 @@ static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
                goto discard;
        if (skb_cloned(skb)) {
-                struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
+                if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
-                struct inet6_skb_parm *opt2;
-                if (skb2 == NULL)
                        goto discard;
-                opt2 = IP6CB(skb2);
-                memcpy(opt2, opt, sizeof(*opt2));
-                kfree_skb(skb);
                /* update all variable using below by copied skbuff */
-                *skbp = skb = skb2;
+                hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
-                hao = (struct ipv6_destopt_hao *)(skb_network_header(skb2) +
                                                  optoff);
-                ipv6h = ipv6_hdr(skb2);
+                ipv6h = ipv6_hdr(skb);
        }
        if (skb->ip_summed == CHECKSUM_COMPLETE)
@@ -280,9 +267,8 @@ static struct tlvtype_proc tlvprocdestopt_lst[] = {
        {-1,                    NULL}
 };
-static int ipv6_destopt_rcv(struct sk_buff **skbp)
+static int ipv6_destopt_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
        __u16 dstbuf;
@@ -304,9 +290,8 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 #endif
        dst = dst_clone(skb->dst);
-        if (ip6_parse_tlv(tlvprocdestopt_lst, skbp)) {
+        if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
                dst_release(dst);
-                skb = *skbp;
                skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
                opt = IP6CB(skb);
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
@@ -337,10 +322,8 @@ void __init ipv6_destopt_init(void)
  NONE header. No data in packet.
 ********************************/
-static int ipv6_nodata_rcv(struct sk_buff **skbp)
+static int ipv6_nodata_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
        kfree_skb(skb);
        return 0;
 }
@@ -360,9 +343,8 @@ void __init ipv6_nodata_init(void)
  Routing header.
 ********************************/
-static int ipv6_rthdr_rcv(struct sk_buff **skbp)
+static int ipv6_rthdr_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
        struct in6_addr *addr = NULL;
        struct in6_addr daddr;
@@ -464,18 +446,14 @@ looped_back:
           Do not damage packets queued somewhere.
         */
        if (skb_cloned(skb)) {
-                struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
                /* the copy is a forwarded packet */
-                if (skb2 == NULL) {
+                if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                         IPSTATS_MIB_OUTDISCARDS);
                        kfree_skb(skb);
                        return -1;
                }
-                kfree_skb(skb);
+                hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
-                *skbp = skb = skb2;
-                opt = IP6CB(skb2);
-                hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb2);
        }
        if (skb->ip_summed == CHECKSUM_COMPLETE)
@@ -578,9 +556,8 @@ static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 /* Router Alert as of RFC 2711 */
-static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
+static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 {
-        struct sk_buff *skb = *skbp;
        const unsigned char *nh = skb_network_header(skb);
        if (nh[optoff + 1] == 2) {
@@ -595,9 +572,8 @@ static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
 /* Jumbo payload */
-static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
+static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
-        struct sk_buff *skb = *skbp;
        const unsigned char *nh = skb_network_header(skb);
        u32 pkt_len;
@@ -648,9 +624,8 @@ static struct tlvtype_proc tlvprochopopt_lst[] = {
        { -1, }
 };
-int ipv6_parse_hopopts(struct sk_buff **skbp)
+int ipv6_parse_hopopts(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
        /*
@@ -667,8 +642,7 @@ int ipv6_parse_hopopts(struct sk_buff **skbp)
        }
        opt->hop = sizeof(struct ipv6hdr);
-        if (ip6_parse_tlv(tlvprochopopt_lst, skbp)) {
+        if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
-                skb = *skbp;
                skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
                opt = IP6CB(skb);
                opt->nhoff = sizeof(struct ipv6hdr);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 47b8ce232e84..9bb031fa1c2f 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -82,7 +82,7 @@ EXPORT_SYMBOL(icmpv6msg_statistics);
 static DEFINE_PER_CPU(struct socket *, __icmpv6_socket) = NULL;
 #define icmpv6_socket   __get_cpu_var(__icmpv6_socket)
-static int icmpv6_rcv(struct sk_buff **pskb);
+static int icmpv6_rcv(struct sk_buff *skb);
 static struct inet6_protocol icmpv6_protocol = {
        .handler        =       icmpv6_rcv,
@@ -614,9 +614,8 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
 *      Handle icmp messages
 */
-static int icmpv6_rcv(struct sk_buff **pskb)
+static int icmpv6_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *pskb;
        struct net_device *dev = skb->dev;
        struct inet6_dev *idev = __in6_dev_get(dev);
        struct in6_addr *saddr, *daddr;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 25b931709749..78de42ada844 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -146,7 +146,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
        __ip6_dst_store(sk, dst, daddr, saddr);
 #ifdef CONFIG_XFRM
-        if (dst) {
+        {
                struct rt6_info *rt = (struct rt6_info  *)dst;
                rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
        }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 9149fc239759..fac6f7f9dd73 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -125,7 +125,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        }
        if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(&skb) < 0) {
+                if (ipv6_parse_hopopts(skb) < 0) {
                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                        rcu_read_unlock();
                        return 0;
@@ -149,7 +149,7 @@ out:
 */
-static inline int ip6_input_finish(struct sk_buff *skb)
+static int ip6_input_finish(struct sk_buff *skb)
 {
        struct inet6_protocol *ipprot;
        struct sock *raw_sk;
@@ -199,7 +199,7 @@ resubmit:
                    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                        goto discard;
-                ret = ipprot->handler(&skb);
+                ret = ipprot->handler(skb);
                if (ret > 0)
                        goto resubmit;
                else if (ret == 0)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 011082ed921a..13565dfb1b45 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -70,7 +70,7 @@ static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *f
        spin_unlock_bh(&ip6_id_lock);
 }
-static inline int ip6_output_finish(struct sk_buff *skb)
+static int ip6_output_finish(struct sk_buff *skb)
 {
        struct dst_entry *dst = skb->dst;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 38b149613915..b1326c2bf8aa 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -68,15 +68,15 @@ static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info)
        }
 }
-static int nf_ip6_reroute(struct sk_buff **pskb, const struct nf_info *info)
+static int nf_ip6_reroute(struct sk_buff *skb, const struct nf_info *info)
 {
        struct ip6_rt_info *rt_info = nf_info_reroute(info);
        if (info->hook == NF_IP6_LOCAL_OUT) {
-                struct ipv6hdr *iph = ipv6_hdr(*pskb);
+                struct ipv6hdr *iph = ipv6_hdr(skb);
                if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
                    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr))
-                        return ip6_route_me_harder(*pskb);
+                        return ip6_route_me_harder(skb);
        }
        return 0;
 }
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 0473145ac534..6413a30d9f68 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -332,6 +332,7 @@ static int
 ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
 {
        int diff;
+        int err;
        struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
        if (v->data_len < sizeof(*user_iph))
@@ -344,25 +345,18 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
                if (v->data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        struct sk_buff *newskb;
+                        err = pskb_expand_head(e->skb, 0,
+                                               diff - skb_tailroom(e->skb),
-                        newskb = skb_copy_expand(e->skb,
+                                               GFP_ATOMIC);
-                                                 skb_headroom(e->skb),
+                        if (err) {
-                                                 diff,
-                                                 GFP_ATOMIC);
-                        if (newskb == NULL) {
                                printk(KERN_WARNING "ip6_queue: OOM "
                                      "in mangle, dropping packet\n");
-                                return -ENOMEM;
+                                return err;
                        }
-                        if (e->skb->sk)
-                                skb_set_owner_w(newskb, e->skb->sk);
-                        kfree_skb(e->skb);
-                        e->skb = newskb;
                }
                skb_put(e->skb, diff);
        }
-        if (!skb_make_writable(&e->skb, v->data_len))
+        if (!skb_make_writable(e->skb, v->data_len))
                return -ENOMEM;
        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
        e->skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index cd9df02bb85c..acaba1537931 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -205,7 +205,7 @@ ip6_checkentry(const struct ip6t_ip6 *ipv6)
 }
 static unsigned int
-ip6t_error(struct sk_buff **pskb,
+ip6t_error(struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          unsigned int hooknum,
@@ -350,7 +350,7 @@ static void trace_packet(struct sk_buff *skb,
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
-ip6t_do_table(struct sk_buff **pskb,
+ip6t_do_table(struct sk_buff *skb,
              unsigned int hook,
              const struct net_device *in,
              const struct net_device *out,
@@ -389,17 +389,17 @@ ip6t_do_table(struct sk_buff **pskb,
        do {
                IP_NF_ASSERT(e);
                IP_NF_ASSERT(back);
-                if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
+                if (ip6_packet_match(skb, indev, outdev, &e->ipv6,
                        &protoff, &offset, &hotdrop)) {
                        struct ip6t_entry_target *t;
                        if (IP6T_MATCH_ITERATE(e, do_match,
-                                               *pskb, in, out,
+                                               skb, in, out,
                                               offset, protoff, &hotdrop) != 0)
                                goto no_match;
                        ADD_COUNTER(e->counters,
-                                    ntohs(ipv6_hdr(*pskb)->payload_len)
+                                    ntohs(ipv6_hdr(skb)->payload_len)
                                    + IPV6_HDR_LEN,
                                    1);
@@ -409,8 +409,8 @@ ip6t_do_table(struct sk_buff **pskb,
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
                        /* The packet is traced: log it */
-                        if (unlikely((*pskb)->nf_trace))
+                        if (unlikely(skb->nf_trace))
-                                trace_packet(*pskb, hook, in, out,
+                                trace_packet(skb, hook, in, out,
                                             table->name, private, e);
 #endif
                        /* Standard target? */
@@ -448,7 +448,7 @@ ip6t_do_table(struct sk_buff **pskb,
                                ((struct ip6t_entry *)table_base)->comefrom
                                        = 0xeeeeeeec;
 #endif
-                                verdict = t->u.kernel.target->target(pskb,
+                                verdict = t->u.kernel.target->target(skb,
                                                                     in, out,
                                                                     hook,
                                                                     t->u.kernel.target,
diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index ad4d94310b87..9afc836fd454 100644
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -18,7 +18,7 @@ MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
 MODULE_DESCRIPTION("IP6 tables Hop Limit modification module");
 MODULE_LICENSE("GPL");
-static unsigned int ip6t_hl_target(struct sk_buff **pskb,
+static unsigned int ip6t_hl_target(struct sk_buff *skb,
                                   const struct net_device *in,
                                   const struct net_device *out,
                                   unsigned int hooknum,
@@ -29,10 +29,10 @@ static unsigned int ip6t_hl_target(struct sk_buff **pskb,
        const struct ip6t_HL_info *info = targinfo;
        int new_hl;
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return NF_DROP;
-        ip6h = ipv6_hdr(*pskb);
+        ip6h = ipv6_hdr(skb);
        switch (info->mode) {
                case IP6T_HL_SET:
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 6ab99001dccc..7a48c342df46 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -431,7 +431,7 @@ ip6t_log_packet(unsigned int pf,
 }
 static unsigned int
-ip6t_log_target(struct sk_buff **pskb,
+ip6t_log_target(struct sk_buff *skb,
                const struct net_device *in,
                const struct net_device *out,
                unsigned int hooknum,
@@ -445,8 +445,7 @@ ip6t_log_target(struct sk_buff **pskb,
        li.u.log.level = loginfo->level;
        li.u.log.logflags = loginfo->logflags;
-        ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
+        ip6t_log_packet(PF_INET6, hooknum, skb, in, out, &li, loginfo->prefix);
-                        loginfo->prefix);
        return XT_CONTINUE;
 }
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 3fd08d5567a6..1a7d2917545d 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -172,7 +172,7 @@ send_unreach(struct sk_buff *skb_in, unsigned char code, unsigned int hooknum)
        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
 }
-static unsigned int reject6_target(struct sk_buff **pskb,
+static unsigned int reject6_target(struct sk_buff *skb,
                           const struct net_device *in,
                           const struct net_device *out,
                           unsigned int hooknum,
@@ -187,25 +187,25 @@ static unsigned int reject6_target(struct sk_buff **pskb,
           must return an absolute verdict. --RR */
        switch (reject->with) {
        case IP6T_ICMP6_NO_ROUTE:
-                send_unreach(*pskb, ICMPV6_NOROUTE, hooknum);
+                send_unreach(skb, ICMPV6_NOROUTE, hooknum);
                break;
        case IP6T_ICMP6_ADM_PROHIBITED:
-                send_unreach(*pskb, ICMPV6_ADM_PROHIBITED, hooknum);
+                send_unreach(skb, ICMPV6_ADM_PROHIBITED, hooknum);
                break;
        case IP6T_ICMP6_NOT_NEIGHBOUR:
-                send_unreach(*pskb, ICMPV6_NOT_NEIGHBOUR, hooknum);
+                send_unreach(skb, ICMPV6_NOT_NEIGHBOUR, hooknum);
                break;
        case IP6T_ICMP6_ADDR_UNREACH:
-                send_unreach(*pskb, ICMPV6_ADDR_UNREACH, hooknum);
+                send_unreach(skb, ICMPV6_ADDR_UNREACH, hooknum);
                break;
        case IP6T_ICMP6_PORT_UNREACH:
-                send_unreach(*pskb, ICMPV6_PORT_UNREACH, hooknum);
+                send_unreach(skb, ICMPV6_PORT_UNREACH, hooknum);
                break;
        case IP6T_ICMP6_ECHOREPLY:
                /* Do nothing */
                break;
        case IP6T_TCP_RESET:
-                send_reset(*pskb);
+                send_reset(skb);
                break;
        default:
                if (net_ratelimit())
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 7e32e2aaf7f7..1d26b202bf30 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -60,32 +60,32 @@ static struct xt_table packet_filter = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6t_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_filter);
+        return ip6t_do_table(skb, hook, in, out, &packet_filter);
 }
 static unsigned int
 ip6t_local_out_hook(unsigned int hook,
-                   struct sk_buff **pskb,
+                   struct sk_buff *skb,
                   const struct net_device *in,
                   const struct net_device *out,
                   int (*okfn)(struct sk_buff *))
 {
 #if 0
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ip6t_hook: happy cracking.\n");
                return NF_ACCEPT;
        }
 #endif
-        return ip6t_do_table(pskb, hook, in, out, &packet_filter);
+        return ip6t_do_table(skb, hook, in, out, &packet_filter);
 }
 static struct nf_hook_ops ip6t_ops[] = {
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index f0a9efa67fb5..a0b6381f1e8c 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -68,17 +68,17 @@ static struct xt_table packet_mangler = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6t_route_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_mangler);
+        return ip6t_do_table(skb, hook, in, out, &packet_mangler);
 }
 static unsigned int
 ip6t_local_hook(unsigned int hook,
-                   struct sk_buff **pskb,
+                   struct sk_buff *skb,
                   const struct net_device *in,
                   const struct net_device *out,
                   int (*okfn)(struct sk_buff *))
@@ -91,8 +91,8 @@ ip6t_local_hook(unsigned int hook,
 #if 0
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(*pskb) < sizeof(struct iphdr)) {
+            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ip6t_hook: happy cracking.\n");
                return NF_ACCEPT;
@@ -100,22 +100,22 @@ ip6t_local_hook(unsigned int hook,
 #endif
        /* save source/dest address, mark, hoplimit, flowlabel, priority,  */
-        memcpy(&saddr, &ipv6_hdr(*pskb)->saddr, sizeof(saddr));
+        memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
-        memcpy(&daddr, &ipv6_hdr(*pskb)->daddr, sizeof(daddr));
+        memcpy(&daddr, &ipv6_hdr(skb)->daddr, sizeof(daddr));
-        mark = (*pskb)->mark;
+        mark = skb->mark;
-        hop_limit = ipv6_hdr(*pskb)->hop_limit;
+        hop_limit = ipv6_hdr(skb)->hop_limit;
        /* flowlabel and prio (includes version, which shouldn't change either */
-        flowlabel = *((u_int32_t *)ipv6_hdr(*pskb));
+        flowlabel = *((u_int32_t *)ipv6_hdr(skb));
-        ret = ip6t_do_table(pskb, hook, in, out, &packet_mangler);
+        ret = ip6t_do_table(skb, hook, in, out, &packet_mangler);
        if (ret != NF_DROP && ret != NF_STOLEN
-                && (memcmp(&ipv6_hdr(*pskb)->saddr, &saddr, sizeof(saddr))
+                && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
-                    || memcmp(&ipv6_hdr(*pskb)->daddr, &daddr, sizeof(daddr))
+                    || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr))
-                    || (*pskb)->mark != mark
+                    || skb->mark != mark
-                    || ipv6_hdr(*pskb)->hop_limit != hop_limit))
+                    || ipv6_hdr(skb)->hop_limit != hop_limit))
-                return ip6_route_me_harder(*pskb) == 0 ? ret : NF_DROP;
+                return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
        return ret;
 }
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index ec290e4ebdd8..8f7109f991e6 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -46,12 +46,12 @@ static struct xt_table packet_raw = {
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6t_hook(unsigned int hook,
-         struct sk_buff **pskb,
+         struct sk_buff *skb,
         const struct net_device *in,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_raw);
+        return ip6t_do_table(skb, hook, in, out, &packet_raw);
 }
 static struct nf_hook_ops ip6t_ops[] = {
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 37a3db926953..0e40948f4fc6 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -18,6 +18,7 @@
 #include <linux/icmp.h>
 #include <linux/sysctl.h>
 #include <net/ipv6.h>
+#include <net/inet_frag.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
@@ -145,7 +146,7 @@ static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 }
 static unsigned int ipv6_confirm(unsigned int hooknum,
-                                 struct sk_buff **pskb,
+                                 struct sk_buff *skb,
                                 const struct net_device *in,
                                 const struct net_device *out,
                                 int (*okfn)(struct sk_buff *))
@@ -155,12 +156,12 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
        struct nf_conntrack_helper *helper;
        enum ip_conntrack_info ctinfo;
        unsigned int ret, protoff;
-        unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data;
+        unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
-        unsigned char pnum = ipv6_hdr(*pskb)->nexthdr;
+        unsigned char pnum = ipv6_hdr(skb)->nexthdr;
        /* This is where we call the helper: as the packet goes out. */
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
                goto out;
@@ -172,23 +173,23 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
        if (!helper)
                goto out;
-        protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
+        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum,
-                                         (*pskb)->len - extoff);
+                                         skb->len - extoff);
-        if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
+        if (protoff > skb->len || pnum == NEXTHDR_FRAGMENT) {
                pr_debug("proto header not found\n");
                return NF_ACCEPT;
        }
-        ret = helper->help(pskb, protoff, ct, ctinfo);
+        ret = helper->help(skb, protoff, ct, ctinfo);
        if (ret != NF_ACCEPT)
                return ret;
 out:
        /* We've seen it coming out the other side: confirm it */
-        return nf_conntrack_confirm(pskb);
+        return nf_conntrack_confirm(skb);
 }
 static unsigned int ipv6_defrag(unsigned int hooknum,
-                                struct sk_buff **pskb,
+                                struct sk_buff *skb,
                                const struct net_device *in,
                                const struct net_device *out,
                                int (*okfn)(struct sk_buff *))
@@ -196,17 +197,17 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
        struct sk_buff *reasm;
        /* Previously seen (loopback)?  */
-        if ((*pskb)->nfct)
+        if (skb->nfct)
                return NF_ACCEPT;
-        reasm = nf_ct_frag6_gather(*pskb);
+        reasm = nf_ct_frag6_gather(skb);
        /* queued */
        if (reasm == NULL)
                return NF_STOLEN;
        /* error occured or not fragmented */
-        if (reasm == *pskb)
+        if (reasm == skb)
                return NF_ACCEPT;
        nf_ct_frag6_output(hooknum, reasm, (struct net_device *)in,
@@ -216,12 +217,12 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
 }
 static unsigned int ipv6_conntrack_in(unsigned int hooknum,
-                                      struct sk_buff **pskb,
+                                      struct sk_buff *skb,
                                      const struct net_device *in,
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
-        struct sk_buff *reasm = (*pskb)->nfct_reasm;
+        struct sk_buff *reasm = skb->nfct_reasm;
        /* This packet is fragmented and has reassembled packet. */
        if (reasm) {
@@ -229,32 +230,32 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                if (!reasm->nfct) {
                        unsigned int ret;
-                        ret = nf_conntrack_in(PF_INET6, hooknum, &reasm);
+                        ret = nf_conntrack_in(PF_INET6, hooknum, reasm);
                        if (ret != NF_ACCEPT)
                                return ret;
                }
                nf_conntrack_get(reasm->nfct);
-                (*pskb)->nfct = reasm->nfct;
+                skb->nfct = reasm->nfct;
-                (*pskb)->nfctinfo = reasm->nfctinfo;
+                skb->nfctinfo = reasm->nfctinfo;
                return NF_ACCEPT;
        }
-        return nf_conntrack_in(PF_INET6, hooknum, pskb);
+        return nf_conntrack_in(PF_INET6, hooknum, skb);
 }
 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
-                                         struct sk_buff **pskb,
+                                         struct sk_buff *skb,
                                         const struct net_device *in,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
        /* root is playing with raw sockets. */
-        if ((*pskb)->len < sizeof(struct ipv6hdr)) {
+        if (skb->len < sizeof(struct ipv6hdr)) {
                if (net_ratelimit())
                        printk("ipv6_conntrack_local: packet too short\n");
                return NF_ACCEPT;
        }
-        return ipv6_conntrack_in(hooknum, pskb, in, out, okfn);
+        return ipv6_conntrack_in(hooknum, skb, in, out, okfn);
 }
 static struct nf_hook_ops ipv6_conntrack_ops[] = {
@@ -307,7 +308,7 @@ static ctl_table nf_ct_ipv6_sysctl_table[] = {
        {
                .ctl_name       = NET_NF_CONNTRACK_FRAG6_TIMEOUT,
                .procname       = "nf_conntrack_frag6_timeout",
-                .data           = &nf_ct_frag6_timeout,
+                .data           = &nf_frags_ctl.timeout,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec_jiffies,
@@ -315,7 +316,7 @@ static ctl_table nf_ct_ipv6_sysctl_table[] = {
        {
                .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
                .procname       = "nf_conntrack_frag6_low_thresh",
-                .data           = &nf_ct_frag6_low_thresh,
+                .data           = &nf_frags_ctl.low_thresh,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
@@ -323,7 +324,7 @@ static ctl_table nf_ct_ipv6_sysctl_table[] = {
        {
                .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
                .procname       = "nf_conntrack_frag6_high_thresh",
-                .data           = &nf_ct_frag6_high_thresh,
+                .data           = &nf_frags_ctl.high_thresh,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 25442a8c1ba8..726fafd41961 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -31,6 +31,7 @@
 #include <net/sock.h>
 #include <net/snmp.h>
+#include <net/inet_frag.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
@@ -48,10 +49,6 @@
 #define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
 #define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
-unsigned int nf_ct_frag6_high_thresh __read_mostly = 256*1024;
-unsigned int nf_ct_frag6_low_thresh __read_mostly = 192*1024;
-unsigned long nf_ct_frag6_timeout __read_mostly = IPV6_FRAG_TIMEOUT;
 struct nf_ct_frag6_skb_cb
 {
        struct inet6_skb_parm   h;
@@ -63,51 +60,24 @@ struct nf_ct_frag6_skb_cb
 struct nf_ct_frag6_queue
 {
-        struct hlist_node       list;
+        struct inet_frag_queue  q;
-        struct list_head        lru_list;       /* lru list member      */
        __be32                  id;             /* fragment id          */
        struct in6_addr         saddr;
        struct in6_addr         daddr;
-        spinlock_t              lock;
-        atomic_t                refcnt;
-        struct timer_list       timer;          /* expire timer         */
-        struct sk_buff          *fragments;
-        int                     len;
-        int                     meat;
-        ktime_t                 stamp;
        unsigned int            csum;
-        __u8                    last_in;        /* has first/last segment arrived? */
-#define COMPLETE                4
-#define FIRST_IN                2
-#define LAST_IN                 1
        __u16                   nhoffset;
 };
-/* Hash table. */
+struct inet_frags_ctl nf_frags_ctl __read_mostly = {
+        .high_thresh     = 256 * 1024,
-#define FRAG6Q_HASHSZ   64
+        .low_thresh      = 192 * 1024,
+        .timeout         = IPV6_FRAG_TIMEOUT,
-static struct hlist_head nf_ct_frag6_hash[FRAG6Q_HASHSZ];
+        .secret_interval = 10 * 60 * HZ,
-static DEFINE_RWLOCK(nf_ct_frag6_lock);
+};
-static u32 nf_ct_frag6_hash_rnd;
-static LIST_HEAD(nf_ct_frag6_lru_list);
-int nf_ct_frag6_nqueues = 0;
-static __inline__ void __fq_unlink(struct nf_ct_frag6_queue *fq)
-{
-        hlist_del(&fq->list);
-        list_del(&fq->lru_list);
-        nf_ct_frag6_nqueues--;
-}
-static __inline__ void fq_unlink(struct nf_ct_frag6_queue *fq)
+static struct inet_frags nf_frags;
-{
-        write_lock(&nf_ct_frag6_lock);
-        __fq_unlink(fq);
-        write_unlock(&nf_ct_frag6_lock);
-}
 static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
                               struct in6_addr *daddr)
@@ -120,7 +90,7 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
        a += JHASH_GOLDEN_RATIO;
        b += JHASH_GOLDEN_RATIO;
-        c += nf_ct_frag6_hash_rnd;
+        c += nf_frags.rnd;
        __jhash_mix(a, b, c);
        a += (__force u32)saddr->s6_addr32[3];
@@ -133,100 +103,54 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
        c += (__force u32)id;
        __jhash_mix(a, b, c);
-        return c & (FRAG6Q_HASHSZ - 1);
+        return c & (INETFRAGS_HASHSZ - 1);
 }
-static struct timer_list nf_ct_frag6_secret_timer;
+static unsigned int nf_hashfn(struct inet_frag_queue *q)
-int nf_ct_frag6_secret_interval = 10 * 60 * HZ;
-static void nf_ct_frag6_secret_rebuild(unsigned long dummy)
 {
-        unsigned long now = jiffies;
+        struct nf_ct_frag6_queue *nq;
-        int i;
-        write_lock(&nf_ct_frag6_lock);
-        get_random_bytes(&nf_ct_frag6_hash_rnd, sizeof(u32));
-        for (i = 0; i < FRAG6Q_HASHSZ; i++) {
-                struct nf_ct_frag6_queue *q;
-                struct hlist_node *p, *n;
-                hlist_for_each_entry_safe(q, p, n, &nf_ct_frag6_hash[i], list) {
-                        unsigned int hval = ip6qhashfn(q->id,
-                                                       &q->saddr,
-                                                       &q->daddr);
-                        if (hval != i) {
-                                hlist_del(&q->list);
-                                /* Relink to new hash chain. */
-                                hlist_add_head(&q->list,
-                                               &nf_ct_frag6_hash[hval]);
-                        }
-                }
-        }
-        write_unlock(&nf_ct_frag6_lock);
-        mod_timer(&nf_ct_frag6_secret_timer, now + nf_ct_frag6_secret_interval);
+        nq = container_of(q, struct nf_ct_frag6_queue, q);
+        return ip6qhashfn(nq->id, &nq->saddr, &nq->daddr);
 }
-atomic_t nf_ct_frag6_mem = ATOMIC_INIT(0);
+static void nf_skb_free(struct sk_buff *skb)
+{
+        if (NFCT_FRAG6_CB(skb)->orig)
+                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
+}
 /* Memory Tracking Functions. */
 static inline void frag_kfree_skb(struct sk_buff *skb, unsigned int *work)
 {
        if (work)
                *work -= skb->truesize;
-        atomic_sub(skb->truesize, &nf_ct_frag6_mem);
+        atomic_sub(skb->truesize, &nf_frags.mem);
-        if (NFCT_FRAG6_CB(skb)->orig)
+        nf_skb_free(skb);
-                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
        kfree_skb(skb);
 }
-static inline void frag_free_queue(struct nf_ct_frag6_queue *fq,
+static void nf_frag_free(struct inet_frag_queue *q)
-                                   unsigned int *work)
 {
-        if (work)
+        kfree(container_of(q, struct nf_ct_frag6_queue, q));
-                *work -= sizeof(struct nf_ct_frag6_queue);
-        atomic_sub(sizeof(struct nf_ct_frag6_queue), &nf_ct_frag6_mem);
-        kfree(fq);
 }
 static inline struct nf_ct_frag6_queue *frag_alloc_queue(void)
 {
-        struct nf_ct_frag6_queue *fq = kmalloc(sizeof(struct nf_ct_frag6_queue), GFP_ATOMIC);
+        struct nf_ct_frag6_queue *fq;
-        if (!fq)
+        fq = kzalloc(sizeof(struct nf_ct_frag6_queue), GFP_ATOMIC);
+        if (fq == NULL)
                return NULL;
-        atomic_add(sizeof(struct nf_ct_frag6_queue), &nf_ct_frag6_mem);
+        atomic_add(sizeof(struct nf_ct_frag6_queue), &nf_frags.mem);
        return fq;
 }
 /* Destruction primitives. */
-/* Complete destruction of fq. */
+static __inline__ void fq_put(struct nf_ct_frag6_queue *fq)
-static void nf_ct_frag6_destroy(struct nf_ct_frag6_queue *fq,
-                                unsigned int *work)
 {
-        struct sk_buff *fp;
+        inet_frag_put(&fq->q, &nf_frags);
-        BUG_TRAP(fq->last_in&COMPLETE);
-        BUG_TRAP(del_timer(&fq->timer) == 0);
-        /* Release all fragment data. */
-        fp = fq->fragments;
-        while (fp) {
-                struct sk_buff *xp = fp->next;
-                frag_kfree_skb(fp, work);
-                fp = xp;
-        }
-        frag_free_queue(fq, work);
-}
-static __inline__ void fq_put(struct nf_ct_frag6_queue *fq, unsigned int *work)
-{
-        if (atomic_dec_and_test(&fq->refcnt))
-                nf_ct_frag6_destroy(fq, work);
 }
 /* Kill fq entry. It is not destroyed immediately,
@@ -234,62 +158,28 @@ static __inline__ void fq_put(struct nf_ct_frag6_queue *fq, unsigned int *work)
 */
 static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 {
-        if (del_timer(&fq->timer))
+        inet_frag_kill(&fq->q, &nf_frags);
-                atomic_dec(&fq->refcnt);
-        if (!(fq->last_in & COMPLETE)) {
-                fq_unlink(fq);
-                atomic_dec(&fq->refcnt);
-                fq->last_in |= COMPLETE;
-        }
 }
 static void nf_ct_frag6_evictor(void)
 {
-        struct nf_ct_frag6_queue *fq;
+        inet_frag_evictor(&nf_frags);
-        struct list_head *tmp;
-        unsigned int work;
-        work = atomic_read(&nf_ct_frag6_mem);
-        if (work <= nf_ct_frag6_low_thresh)
-                return;
-        work -= nf_ct_frag6_low_thresh;
-        while (work > 0) {
-                read_lock(&nf_ct_frag6_lock);
-                if (list_empty(&nf_ct_frag6_lru_list)) {
-                        read_unlock(&nf_ct_frag6_lock);
-                        return;
-                }
-                tmp = nf_ct_frag6_lru_list.next;
-                BUG_ON(tmp == NULL);
-                fq = list_entry(tmp, struct nf_ct_frag6_queue, lru_list);
-                atomic_inc(&fq->refcnt);
-                read_unlock(&nf_ct_frag6_lock);
-                spin_lock(&fq->lock);
-                if (!(fq->last_in&COMPLETE))
-                        fq_kill(fq);
-                spin_unlock(&fq->lock);
-                fq_put(fq, &work);
-        }
 }
 static void nf_ct_frag6_expire(unsigned long data)
 {
        struct nf_ct_frag6_queue *fq = (struct nf_ct_frag6_queue *) data;
-        spin_lock(&fq->lock);
+        spin_lock(&fq->q.lock);
-        if (fq->last_in & COMPLETE)
+        if (fq->q.last_in & COMPLETE)
                goto out;
        fq_kill(fq);
 out:
-        spin_unlock(&fq->lock);
+        spin_unlock(&fq->q.lock);
-        fq_put(fq, NULL);
+        fq_put(fq);
 }
 /* Creation primitives. */
@@ -302,31 +192,31 @@ static struct nf_ct_frag6_queue *nf_ct_frag6_intern(unsigned int hash,
        struct hlist_node *n;
 #endif
-        write_lock(&nf_ct_frag6_lock);
+        write_lock(&nf_frags.lock);
 #ifdef CONFIG_SMP
-        hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
+        hlist_for_each_entry(fq, n, &nf_frags.hash[hash], q.list) {
                if (fq->id == fq_in->id &&
                    ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
                    ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
-                        atomic_inc(&fq->refcnt);
+                        atomic_inc(&fq->q.refcnt);
-                        write_unlock(&nf_ct_frag6_lock);
+                        write_unlock(&nf_frags.lock);
-                        fq_in->last_in |= COMPLETE;
+                        fq_in->q.last_in |= COMPLETE;
-                        fq_put(fq_in, NULL);
+                        fq_put(fq_in);
                        return fq;
                }
        }
 #endif
        fq = fq_in;
-        if (!mod_timer(&fq->timer, jiffies + nf_ct_frag6_timeout))
+        if (!mod_timer(&fq->q.timer, jiffies + nf_frags_ctl.timeout))
-                atomic_inc(&fq->refcnt);
+                atomic_inc(&fq->q.refcnt);
-        atomic_inc(&fq->refcnt);
+        atomic_inc(&fq->q.refcnt);
-        hlist_add_head(&fq->list, &nf_ct_frag6_hash[hash]);
+        hlist_add_head(&fq->q.list, &nf_frags.hash[hash]);
-        INIT_LIST_HEAD(&fq->lru_list);
+        INIT_LIST_HEAD(&fq->q.lru_list);
-        list_add_tail(&fq->lru_list, &nf_ct_frag6_lru_list);
+        list_add_tail(&fq->q.lru_list, &nf_frags.lru_list);
-        nf_ct_frag6_nqueues++;
+        nf_frags.nqueues++;
-        write_unlock(&nf_ct_frag6_lock);
+        write_unlock(&nf_frags.lock);
        return fq;
 }
@@ -341,15 +231,13 @@ nf_ct_frag6_create(unsigned int hash, __be32 id, struct in6_addr *src,				   str
                goto oom;
        }
-        memset(fq, 0, sizeof(struct nf_ct_frag6_queue));
        fq->id = id;
        ipv6_addr_copy(&fq->saddr, src);
        ipv6_addr_copy(&fq->daddr, dst);
-        setup_timer(&fq->timer, nf_ct_frag6_expire, (unsigned long)fq);
+        setup_timer(&fq->q.timer, nf_ct_frag6_expire, (unsigned long)fq);
-        spin_lock_init(&fq->lock);
+        spin_lock_init(&fq->q.lock);
-        atomic_set(&fq->refcnt, 1);
+        atomic_set(&fq->q.refcnt, 1);
        return nf_ct_frag6_intern(hash, fq);
@@ -364,17 +252,17 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        struct hlist_node *n;
        unsigned int hash = ip6qhashfn(id, src, dst);
-        read_lock(&nf_ct_frag6_lock);
+        read_lock(&nf_frags.lock);
-        hlist_for_each_entry(fq, n, &nf_ct_frag6_hash[hash], list) {
+        hlist_for_each_entry(fq, n, &nf_frags.hash[hash], q.list) {
                if (fq->id == id &&
                    ipv6_addr_equal(src, &fq->saddr) &&
                    ipv6_addr_equal(dst, &fq->daddr)) {
-                        atomic_inc(&fq->refcnt);
+                        atomic_inc(&fq->q.refcnt);
-                        read_unlock(&nf_ct_frag6_lock);
+                        read_unlock(&nf_frags.lock);
                        return fq;
                }
        }
-        read_unlock(&nf_ct_frag6_lock);
+        read_unlock(&nf_frags.lock);
        return nf_ct_frag6_create(hash, id, src, dst);
 }
@@ -386,7 +274,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
        struct sk_buff *prev, *next;
        int offset, end;
-        if (fq->last_in & COMPLETE) {
+        if (fq->q.last_in & COMPLETE) {
                pr_debug("Allready completed\n");
                goto err;
        }
@@ -412,13 +300,13 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                /* If we already have some bits beyond end
                 * or have different end, the segment is corrupted.
                 */
-                if (end < fq->len ||
+                if (end < fq->q.len ||
-                    ((fq->last_in & LAST_IN) && end != fq->len)) {
+                    ((fq->q.last_in & LAST_IN) && end != fq->q.len)) {
                        pr_debug("already received last fragment\n");
                        goto err;
                }
-                fq->last_in |= LAST_IN;
+                fq->q.last_in |= LAST_IN;
-                fq->len = end;
+                fq->q.len = end;
        } else {
                /* Check if the fragment is rounded to 8 bytes.
                 * Required by the RFC.
@@ -430,13 +318,13 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                        pr_debug("end of fragment not rounded to 8 bytes.\n");
                        return -1;
                }
-                if (end > fq->len) {
+                if (end > fq->q.len) {
                        /* Some bits beyond end -> corruption. */
-                        if (fq->last_in & LAST_IN) {
+                        if (fq->q.last_in & LAST_IN) {
                                pr_debug("last packet already reached.\n");
                                goto err;
                        }
-                        fq->len = end;
+                        fq->q.len = end;
                }
        }
@@ -458,7 +346,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
         * this fragment, right?
         */
        prev = NULL;
-        for (next = fq->fragments; next != NULL; next = next->next) {
+        for (next = fq->q.fragments; next != NULL; next = next->next) {
                if (NFCT_FRAG6_CB(next)->offset >= offset)
                        break;  /* bingo! */
                prev = next;
@@ -503,7 +391,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                        /* next fragment */
                        NFCT_FRAG6_CB(next)->offset += i;
-                        fq->meat -= i;
+                        fq->q.meat -= i;
                        if (next->ip_summed != CHECKSUM_UNNECESSARY)
                                next->ip_summed = CHECKSUM_NONE;
                        break;
@@ -518,9 +406,9 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                        if (prev)
                                prev->next = next;
                        else
-                                fq->fragments = next;
+                                fq->q.fragments = next;
-                        fq->meat -= free_it->len;
+                        fq->q.meat -= free_it->len;
                        frag_kfree_skb(free_it, NULL);
                }
        }
@@ -532,23 +420,23 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
        if (prev)
                prev->next = skb;
        else
-                fq->fragments = skb;
+                fq->q.fragments = skb;
        skb->dev = NULL;
-        fq->stamp = skb->tstamp;
+        fq->q.stamp = skb->tstamp;
-        fq->meat += skb->len;
+        fq->q.meat += skb->len;
-        atomic_add(skb->truesize, &nf_ct_frag6_mem);
+        atomic_add(skb->truesize, &nf_frags.mem);
        /* The first fragment.
         * nhoffset is obtained from the first fragment, of course.
         */
        if (offset == 0) {
                fq->nhoffset = nhoff;
-                fq->last_in |= FIRST_IN;
+                fq->q.last_in |= FIRST_IN;
        }
-        write_lock(&nf_ct_frag6_lock);
+        write_lock(&nf_frags.lock);
-        list_move_tail(&fq->lru_list, &nf_ct_frag6_lru_list);
+        list_move_tail(&fq->q.lru_list, &nf_frags.lru_list);
-        write_unlock(&nf_ct_frag6_lock);
+        write_unlock(&nf_frags.lock);
        return 0;
 err:
@@ -567,7 +455,7 @@ err:
 static struct sk_buff *
 nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 {
-        struct sk_buff *fp, *op, *head = fq->fragments;
+        struct sk_buff *fp, *op, *head = fq->q.fragments;
        int    payload_len;
        fq_kill(fq);
@@ -577,7 +465,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        /* Unfragmented part is taken from the first segment. */
        payload_len = ((head->data - skb_network_header(head)) -
-                       sizeof(struct ipv6hdr) + fq->len -
+                       sizeof(struct ipv6hdr) + fq->q.len -
                       sizeof(struct frag_hdr));
        if (payload_len > IPV6_MAXPLEN) {
                pr_debug("payload len is too large.\n");
@@ -614,7 +502,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                clone->ip_summed = head->ip_summed;
                NFCT_FRAG6_CB(clone)->orig = NULL;
-                atomic_add(clone->truesize, &nf_ct_frag6_mem);
+                atomic_add(clone->truesize, &nf_frags.mem);
        }
        /* We have to remove fragment header from datagram and to relocate
@@ -628,7 +516,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        skb_shinfo(head)->frag_list = head->next;
        skb_reset_transport_header(head);
        skb_push(head, head->data - skb_network_header(head));
-        atomic_sub(head->truesize, &nf_ct_frag6_mem);
+        atomic_sub(head->truesize, &nf_frags.mem);
        for (fp=head->next; fp; fp = fp->next) {
                head->data_len += fp->len;
@@ -638,12 +526,12 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
-                atomic_sub(fp->truesize, &nf_ct_frag6_mem);
+                atomic_sub(fp->truesize, &nf_frags.mem);
        }
        head->next = NULL;
        head->dev = dev;
-        head->tstamp = fq->stamp;
+        head->tstamp = fq->q.stamp;
        ipv6_hdr(head)->payload_len = htons(payload_len);
        /* Yes, and fold redundant checksum back. 8) */
@@ -652,7 +540,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                                          skb_network_header_len(head),
                                          head->csum);
-        fq->fragments = NULL;
+        fq->q.fragments = NULL;
        /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
        fp = skb_shinfo(head)->frag_list;
@@ -788,7 +676,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
-        if (atomic_read(&nf_ct_frag6_mem) > nf_ct_frag6_high_thresh)
+        if (atomic_read(&nf_frags.mem) > nf_frags_ctl.high_thresh)
                nf_ct_frag6_evictor();
        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
@@ -797,23 +685,23 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
-        spin_lock(&fq->lock);
+        spin_lock(&fq->q.lock);
        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
-                spin_unlock(&fq->lock);
+                spin_unlock(&fq->q.lock);
                pr_debug("Can't insert skb to queue\n");
-                fq_put(fq, NULL);
+                fq_put(fq);
                goto ret_orig;
        }
-        if (fq->last_in == (FIRST_IN|LAST_IN) && fq->meat == fq->len) {
+        if (fq->q.last_in == (FIRST_IN|LAST_IN) && fq->q.meat == fq->q.len) {
                ret_skb = nf_ct_frag6_reasm(fq, dev);
                if (ret_skb == NULL)
                        pr_debug("Can't reassemble fragmented packets\n");
        }
-        spin_unlock(&fq->lock);
+        spin_unlock(&fq->q.lock);
-        fq_put(fq, NULL);
+        fq_put(fq);
        return ret_skb;
 ret_orig:
@@ -859,20 +747,20 @@ int nf_ct_frag6_kfree_frags(struct sk_buff *skb)
 int nf_ct_frag6_init(void)
 {
-        nf_ct_frag6_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
+        nf_frags.ctl = &nf_frags_ctl;
-                                   (jiffies ^ (jiffies >> 6)));
+        nf_frags.hashfn = nf_hashfn;
+        nf_frags.destructor = nf_frag_free;
-        setup_timer(&nf_ct_frag6_secret_timer, nf_ct_frag6_secret_rebuild, 0);
+        nf_frags.skb_free = nf_skb_free;
-        nf_ct_frag6_secret_timer.expires = jiffies
+        nf_frags.qsize = sizeof(struct nf_ct_frag6_queue);
-                                           + nf_ct_frag6_secret_interval;
+        inet_frags_init(&nf_frags);
-        add_timer(&nf_ct_frag6_secret_timer);
        return 0;
 }
 void nf_ct_frag6_cleanup(void)
 {
-        del_timer(&nf_ct_frag6_secret_timer);
+        inet_frags_fini(&nf_frags);
-        nf_ct_frag6_low_thresh = 0;
+        nf_frags_ctl.low_thresh = 0;
        nf_ct_frag6_evictor();
 }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index db945018579e..be526ad92543 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -54,7 +54,7 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v)
        seq_printf(seq, "RAW6: inuse %d\n",
                       fold_prot_inuse(&rawv6_prot));
        seq_printf(seq, "FRAG6: inuse %d memory %d\n",
-                       ip6_frag_nqueues, atomic_read(&ip6_frag_mem));
+                       ip6_frag_nqueues(), ip6_frag_mem());
        return 0;
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 31601c993541..6ad19cfc2025 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -42,6 +42,7 @@
 #include <linux/icmpv6.h>
 #include <linux/random.h>
 #include <linux/jhash.h>
+#include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -53,11 +54,7 @@
 #include <net/rawv6.h>
 #include <net/ndisc.h>
 #include <net/addrconf.h>
+#include <net/inet_frag.h>
-int sysctl_ip6frag_high_thresh __read_mostly = 256*1024;
-int sysctl_ip6frag_low_thresh __read_mostly = 192*1024;
-int sysctl_ip6frag_time __read_mostly = IPV6_FRAG_TIMEOUT;
 struct ip6frag_skb_cb
 {
@@ -74,53 +71,39 @@ struct ip6frag_skb_cb
 struct frag_queue
 {
-        struct hlist_node       list;
+        struct inet_frag_queue  q;
-        struct list_head lru_list;              /* lru list member      */
        __be32                  id;             /* fragment id          */
        struct in6_addr         saddr;
        struct in6_addr         daddr;
-        spinlock_t              lock;
-        atomic_t                refcnt;
-        struct timer_list       timer;          /* expire timer         */
-        struct sk_buff          *fragments;
-        int                     len;
-        int                     meat;
        int                     iif;
-        ktime_t                 stamp;
        unsigned int            csum;
-        __u8                    last_in;        /* has first/last segment arrived? */
-#define COMPLETE                4
-#define FIRST_IN                2
-#define LAST_IN                 1
        __u16                   nhoffset;
 };
-/* Hash table. */
+struct inet_frags_ctl ip6_frags_ctl __read_mostly = {
+        .high_thresh     = 256 * 1024,
-#define IP6Q_HASHSZ     64
+        .low_thresh      = 192 * 1024,
+        .timeout         = IPV6_FRAG_TIMEOUT,
+        .secret_interval = 10 * 60 * HZ,
+};
-static struct hlist_head ip6_frag_hash[IP6Q_HASHSZ];
+static struct inet_frags ip6_frags;
-static DEFINE_RWLOCK(ip6_frag_lock);
-static u32 ip6_frag_hash_rnd;
-static LIST_HEAD(ip6_frag_lru_list);
-int ip6_frag_nqueues = 0;
-static __inline__ void __fq_unlink(struct frag_queue *fq)
+int ip6_frag_nqueues(void)
 {
-        hlist_del(&fq->list);
+        return ip6_frags.nqueues;
-        list_del(&fq->lru_list);
-        ip6_frag_nqueues--;
 }
-static __inline__ void fq_unlink(struct frag_queue *fq)
+int ip6_frag_mem(void)
 {
-        write_lock(&ip6_frag_lock);
+        return atomic_read(&ip6_frags.mem);
-        __fq_unlink(fq);
-        write_unlock(&ip6_frag_lock);
 }
+static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+                          struct net_device *dev);
 /*
 * callers should be careful not to use the hash value outside the ipfrag_lock
 * as doing so could race with ipfrag_hash_rnd being recalculated.
@@ -136,7 +119,7 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
        a += JHASH_GOLDEN_RATIO;
        b += JHASH_GOLDEN_RATIO;
-        c += ip6_frag_hash_rnd;
+        c += ip6_frags.rnd;
        __jhash_mix(a, b, c);
        a += (__force u32)saddr->s6_addr32[3];
@@ -149,60 +132,29 @@ static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
        c += (__force u32)id;
        __jhash_mix(a, b, c);
-        return c & (IP6Q_HASHSZ - 1);
+        return c & (INETFRAGS_HASHSZ - 1);
 }
-static struct timer_list ip6_frag_secret_timer;
+static unsigned int ip6_hashfn(struct inet_frag_queue *q)
-int sysctl_ip6frag_secret_interval __read_mostly = 10 * 60 * HZ;
-static void ip6_frag_secret_rebuild(unsigned long dummy)
 {
-        unsigned long now = jiffies;
+        struct frag_queue *fq;
-        int i;
-        write_lock(&ip6_frag_lock);
-        get_random_bytes(&ip6_frag_hash_rnd, sizeof(u32));
-        for (i = 0; i < IP6Q_HASHSZ; i++) {
-                struct frag_queue *q;
-                struct hlist_node *p, *n;
-                hlist_for_each_entry_safe(q, p, n, &ip6_frag_hash[i], list) {
-                        unsigned int hval = ip6qhashfn(q->id,
-                                                       &q->saddr,
-                                                       &q->daddr);
-                        if (hval != i) {
-                                hlist_del(&q->list);
-                                /* Relink to new hash chain. */
-                                hlist_add_head(&q->list,
-                                               &ip6_frag_hash[hval]);
-                        }
-                }
-        }
-        write_unlock(&ip6_frag_lock);
-        mod_timer(&ip6_frag_secret_timer, now + sysctl_ip6frag_secret_interval);
+        fq = container_of(q, struct frag_queue, q);
+        return ip6qhashfn(fq->id, &fq->saddr, &fq->daddr);
 }
-atomic_t ip6_frag_mem = ATOMIC_INIT(0);
 /* Memory Tracking Functions. */
 static inline void frag_kfree_skb(struct sk_buff *skb, int *work)
 {
        if (work)
                *work -= skb->truesize;
-        atomic_sub(skb->truesize, &ip6_frag_mem);
+        atomic_sub(skb->truesize, &ip6_frags.mem);
        kfree_skb(skb);
 }
-static inline void frag_free_queue(struct frag_queue *fq, int *work)
+static void ip6_frag_free(struct inet_frag_queue *fq)
 {
-        if (work)
+        kfree(container_of(fq, struct frag_queue, q));
-                *work -= sizeof(struct frag_queue);
-        atomic_sub(sizeof(struct frag_queue), &ip6_frag_mem);
-        kfree(fq);
 }
 static inline struct frag_queue *frag_alloc_queue(void)
@@ -211,36 +163,15 @@ static inline struct frag_queue *frag_alloc_queue(void)
        if(!fq)
                return NULL;
-        atomic_add(sizeof(struct frag_queue), &ip6_frag_mem);
+        atomic_add(sizeof(struct frag_queue), &ip6_frags.mem);
        return fq;
 }
 /* Destruction primitives. */
-/* Complete destruction of fq. */
+static __inline__ void fq_put(struct frag_queue *fq)
-static void ip6_frag_destroy(struct frag_queue *fq, int *work)
-{
-        struct sk_buff *fp;
-        BUG_TRAP(fq->last_in&COMPLETE);
-        BUG_TRAP(del_timer(&fq->timer) == 0);
-        /* Release all fragment data. */
-        fp = fq->fragments;
-        while (fp) {
-                struct sk_buff *xp = fp->next;
-                frag_kfree_skb(fp, work);
-                fp = xp;
-        }
-        frag_free_queue(fq, work);
-}
-static __inline__ void fq_put(struct frag_queue *fq, int *work)
 {
-        if (atomic_dec_and_test(&fq->refcnt))
+        inet_frag_put(&fq->q, &ip6_frags);
-                ip6_frag_destroy(fq, work);
 }
 /* Kill fq entry. It is not destroyed immediately,
@@ -248,45 +179,16 @@ static __inline__ void fq_put(struct frag_queue *fq, int *work)
 */
 static __inline__ void fq_kill(struct frag_queue *fq)
 {
-        if (del_timer(&fq->timer))
+        inet_frag_kill(&fq->q, &ip6_frags);
-                atomic_dec(&fq->refcnt);
-        if (!(fq->last_in & COMPLETE)) {
-                fq_unlink(fq);
-                atomic_dec(&fq->refcnt);
-                fq->last_in |= COMPLETE;
-        }
 }
 static void ip6_evictor(struct inet6_dev *idev)
 {
-        struct frag_queue *fq;
+        int evicted;
-        struct list_head *tmp;
-        int work;
+        evicted = inet_frag_evictor(&ip6_frags);
+        if (evicted)
-        work = atomic_read(&ip6_frag_mem) - sysctl_ip6frag_low_thresh;
+                IP6_ADD_STATS_BH(idev, IPSTATS_MIB_REASMFAILS, evicted);
-        if (work <= 0)
-                return;
-        while(work > 0) {
-                read_lock(&ip6_frag_lock);
-                if (list_empty(&ip6_frag_lru_list)) {
-                        read_unlock(&ip6_frag_lock);
-                        return;
-                }
-                tmp = ip6_frag_lru_list.next;
-                fq = list_entry(tmp, struct frag_queue, lru_list);
-                atomic_inc(&fq->refcnt);
-                read_unlock(&ip6_frag_lock);
-                spin_lock(&fq->lock);
-                if (!(fq->last_in&COMPLETE))
-                        fq_kill(fq);
-                spin_unlock(&fq->lock);
-                fq_put(fq, &work);
-                IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
-        }
 }
 static void ip6_frag_expire(unsigned long data)
@@ -294,9 +196,9 @@ static void ip6_frag_expire(unsigned long data)
        struct frag_queue *fq = (struct frag_queue *) data;
        struct net_device *dev = NULL;
-        spin_lock(&fq->lock);
+        spin_lock(&fq->q.lock);
-        if (fq->last_in & COMPLETE)
+        if (fq->q.last_in & COMPLETE)
                goto out;
        fq_kill(fq);
@@ -311,7 +213,7 @@ static void ip6_frag_expire(unsigned long data)
        rcu_read_unlock();
        /* Don't send error if the first segment did not arrive. */
-        if (!(fq->last_in&FIRST_IN) || !fq->fragments)
+        if (!(fq->q.last_in&FIRST_IN) || !fq->q.fragments)
                goto out;
        /*
@@ -319,13 +221,13 @@ static void ip6_frag_expire(unsigned long data)
           segment was received. And do not use fq->dev
           pointer directly, device might already disappeared.
         */
-        fq->fragments->dev = dev;
+        fq->q.fragments->dev = dev;
-        icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
+        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
 out:
        if (dev)
                dev_put(dev);
-        spin_unlock(&fq->lock);
+        spin_unlock(&fq->q.lock);
-        fq_put(fq, NULL);
+        fq_put(fq);
 }
 /* Creation primitives. */
@@ -339,32 +241,32 @@ static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
        struct hlist_node *n;
 #endif
-        write_lock(&ip6_frag_lock);
+        write_lock(&ip6_frags.lock);
        hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
 #ifdef CONFIG_SMP
-        hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
+        hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
                if (fq->id == fq_in->id &&
                    ipv6_addr_equal(&fq_in->saddr, &fq->saddr) &&
                    ipv6_addr_equal(&fq_in->daddr, &fq->daddr)) {
-                        atomic_inc(&fq->refcnt);
+                        atomic_inc(&fq->q.refcnt);
-                        write_unlock(&ip6_frag_lock);
+                        write_unlock(&ip6_frags.lock);
-                        fq_in->last_in |= COMPLETE;
+                        fq_in->q.last_in |= COMPLETE;
-                        fq_put(fq_in, NULL);
+                        fq_put(fq_in);
                        return fq;
                }
        }
 #endif
        fq = fq_in;
-        if (!mod_timer(&fq->timer, jiffies + sysctl_ip6frag_time))
+        if (!mod_timer(&fq->q.timer, jiffies + ip6_frags_ctl.timeout))
-                atomic_inc(&fq->refcnt);
+                atomic_inc(&fq->q.refcnt);
-        atomic_inc(&fq->refcnt);
+        atomic_inc(&fq->q.refcnt);
-        hlist_add_head(&fq->list, &ip6_frag_hash[hash]);
+        hlist_add_head(&fq->q.list, &ip6_frags.hash[hash]);
-        INIT_LIST_HEAD(&fq->lru_list);
+        INIT_LIST_HEAD(&fq->q.lru_list);
-        list_add_tail(&fq->lru_list, &ip6_frag_lru_list);
+        list_add_tail(&fq->q.lru_list, &ip6_frags.lru_list);
-        ip6_frag_nqueues++;
+        ip6_frags.nqueues++;
-        write_unlock(&ip6_frag_lock);
+        write_unlock(&ip6_frags.lock);
        return fq;
 }
@@ -382,11 +284,11 @@ ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst,
        ipv6_addr_copy(&fq->saddr, src);
        ipv6_addr_copy(&fq->daddr, dst);
-        init_timer(&fq->timer);
+        init_timer(&fq->q.timer);
-        fq->timer.function = ip6_frag_expire;
+        fq->q.timer.function = ip6_frag_expire;
-        fq->timer.data = (long) fq;
+        fq->q.timer.data = (long) fq;
-        spin_lock_init(&fq->lock);
+        spin_lock_init(&fq->q.lock);
-        atomic_set(&fq->refcnt, 1);
+        atomic_set(&fq->q.refcnt, 1);
        return ip6_frag_intern(fq);
@@ -403,30 +305,31 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
        struct hlist_node *n;
        unsigned int hash;
-        read_lock(&ip6_frag_lock);
+        read_lock(&ip6_frags.lock);
        hash = ip6qhashfn(id, src, dst);
-        hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
+        hlist_for_each_entry(fq, n, &ip6_frags.hash[hash], q.list) {
                if (fq->id == id &&
                    ipv6_addr_equal(src, &fq->saddr) &&
                    ipv6_addr_equal(dst, &fq->daddr)) {
-                        atomic_inc(&fq->refcnt);
+                        atomic_inc(&fq->q.refcnt);
-                        read_unlock(&ip6_frag_lock);
+                        read_unlock(&ip6_frags.lock);
                        return fq;
                }
        }
-        read_unlock(&ip6_frag_lock);
+        read_unlock(&ip6_frags.lock);
        return ip6_frag_create(id, src, dst, idev);
 }
-static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                           struct frag_hdr *fhdr, int nhoff)
 {
        struct sk_buff *prev, *next;
+        struct net_device *dev;
        int offset, end;
-        if (fq->last_in & COMPLETE)
+        if (fq->q.last_in & COMPLETE)
                goto err;
        offset = ntohs(fhdr->frag_off) & ~0x7;
@@ -439,7 +342,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                  ((u8 *)&fhdr->frag_off -
                                   skb_network_header(skb)));
-                return;
+                return -1;
        }
        if (skb->ip_summed == CHECKSUM_COMPLETE) {
@@ -454,11 +357,11 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                /* If we already have some bits beyond end
                 * or have different end, the segment is corrupted.
                 */
-                if (end < fq->len ||
+                if (end < fq->q.len ||
-                    ((fq->last_in & LAST_IN) && end != fq->len))
+                    ((fq->q.last_in & LAST_IN) && end != fq->q.len))
                        goto err;
-                fq->last_in |= LAST_IN;
+                fq->q.last_in |= LAST_IN;
-                fq->len = end;
+                fq->q.len = end;
        } else {
                /* Check if the fragment is rounded to 8 bytes.
                 * Required by the RFC.
@@ -471,13 +374,13 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                                         IPSTATS_MIB_INHDRERRORS);
                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                          offsetof(struct ipv6hdr, payload_len));
-                        return;
+                        return -1;
                }
-                if (end > fq->len) {
+                if (end > fq->q.len) {
                        /* Some bits beyond end -> corruption. */
-                        if (fq->last_in & LAST_IN)
+                        if (fq->q.last_in & LAST_IN)
                                goto err;
-                        fq->len = end;
+                        fq->q.len = end;
                }
        }
@@ -496,7 +399,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         * this fragment, right?
         */
        prev = NULL;
-        for(next = fq->fragments; next != NULL; next = next->next) {
+        for(next = fq->q.fragments; next != NULL; next = next->next) {
                if (FRAG6_CB(next)->offset >= offset)
                        break;  /* bingo! */
                prev = next;
@@ -533,7 +436,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                        if (!pskb_pull(next, i))
                                goto err;
                        FRAG6_CB(next)->offset += i;    /* next fragment */
-                        fq->meat -= i;
+                        fq->q.meat -= i;
                        if (next->ip_summed != CHECKSUM_UNNECESSARY)
                                next->ip_summed = CHECKSUM_NONE;
                        break;
@@ -548,9 +451,9 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                        if (prev)
                                prev->next = next;
                        else
-                                fq->fragments = next;
+                                fq->q.fragments = next;
-                        fq->meat -= free_it->len;
+                        fq->q.meat -= free_it->len;
                        frag_kfree_skb(free_it, NULL);
                }
        }
@@ -562,30 +465,37 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
        if (prev)
                prev->next = skb;
        else
-                fq->fragments = skb;
+                fq->q.fragments = skb;
-        if (skb->dev)
+        dev = skb->dev;
-                fq->iif = skb->dev->ifindex;
+        if (dev) {
-        skb->dev = NULL;
+                fq->iif = dev->ifindex;
-        fq->stamp = skb->tstamp;
+                skb->dev = NULL;
-        fq->meat += skb->len;
+        }
-        atomic_add(skb->truesize, &ip6_frag_mem);
+        fq->q.stamp = skb->tstamp;
+        fq->q.meat += skb->len;
+        atomic_add(skb->truesize, &ip6_frags.mem);
        /* The first fragment.
         * nhoffset is obtained from the first fragment, of course.
         */
        if (offset == 0) {
                fq->nhoffset = nhoff;
-                fq->last_in |= FIRST_IN;
+                fq->q.last_in |= FIRST_IN;
        }
-        write_lock(&ip6_frag_lock);
-        list_move_tail(&fq->lru_list, &ip6_frag_lru_list);
+        if (fq->q.last_in == (FIRST_IN | LAST_IN) && fq->q.meat == fq->q.len)
-        write_unlock(&ip6_frag_lock);
+                return ip6_frag_reasm(fq, prev, dev);
-        return;
+        write_lock(&ip6_frags.lock);
+        list_move_tail(&fq->q.lru_list, &ip6_frags.lru_list);
+        write_unlock(&ip6_frags.lock);
+        return -1;
 err:
        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
        kfree_skb(skb);
+        return -1;
 }
 /*
@@ -597,21 +507,39 @@ err:
 *      queue is eligible for reassembly i.e. it is not COMPLETE,
 *      the last and the first frames arrived and all the bits are here.
 */
-static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
+static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                          struct net_device *dev)
 {
-        struct sk_buff *fp, *head = fq->fragments;
+        struct sk_buff *fp, *head = fq->q.fragments;
        int    payload_len;
        unsigned int nhoff;
        fq_kill(fq);
+        /* Make the one we just received the head. */
+        if (prev) {
+                head = prev->next;
+                fp = skb_clone(head, GFP_ATOMIC);
+                if (!fp)
+                        goto out_oom;
+                fp->next = head->next;
+                prev->next = fp;
+                skb_morph(head, fq->q.fragments);
+                head->next = fq->q.fragments->next;
+                kfree_skb(fq->q.fragments);
+                fq->q.fragments = head;
+        }
        BUG_TRAP(head != NULL);
        BUG_TRAP(FRAG6_CB(head)->offset == 0);
        /* Unfragmented part is taken from the first segment. */
        payload_len = ((head->data - skb_network_header(head)) -
-                       sizeof(struct ipv6hdr) + fq->len -
+                       sizeof(struct ipv6hdr) + fq->q.len -
                       sizeof(struct frag_hdr));
        if (payload_len > IPV6_MAXPLEN)
                goto out_oversize;
@@ -640,7 +568,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
                head->len -= clone->len;
                clone->csum = 0;
                clone->ip_summed = head->ip_summed;
-                atomic_add(clone->truesize, &ip6_frag_mem);
+                atomic_add(clone->truesize, &ip6_frags.mem);
        }
        /* We have to remove fragment header from datagram and to relocate
@@ -655,7 +583,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
        skb_shinfo(head)->frag_list = head->next;
        skb_reset_transport_header(head);
        skb_push(head, head->data - skb_network_header(head));
-        atomic_sub(head->truesize, &ip6_frag_mem);
+        atomic_sub(head->truesize, &ip6_frags.mem);
        for (fp=head->next; fp; fp = fp->next) {
                head->data_len += fp->len;
@@ -665,17 +593,15 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
-                atomic_sub(fp->truesize, &ip6_frag_mem);
+                atomic_sub(fp->truesize, &ip6_frags.mem);
        }
        head->next = NULL;
        head->dev = dev;
-        head->tstamp = fq->stamp;
+        head->tstamp = fq->q.stamp;
        ipv6_hdr(head)->payload_len = htons(payload_len);
        IP6CB(head)->nhoff = nhoff;
-        *skb_in = head;
        /* Yes, and fold redundant checksum back. 8) */
        if (head->ip_summed == CHECKSUM_COMPLETE)
                head->csum = csum_partial(skb_network_header(head),
@@ -685,7 +611,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
        rcu_read_lock();
        IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
        rcu_read_unlock();
-        fq->fragments = NULL;
+        fq->q.fragments = NULL;
        return 1;
 out_oversize:
@@ -702,10 +628,8 @@ out_fail:
        return -1;
 }
-static int ipv6_frag_rcv(struct sk_buff **skbp)
+static int ipv6_frag_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *skbp;
-        struct net_device *dev = skb->dev;
        struct frag_hdr *fhdr;
        struct frag_queue *fq;
        struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -739,23 +663,19 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
                return 1;
        }
-        if (atomic_read(&ip6_frag_mem) > sysctl_ip6frag_high_thresh)
+        if (atomic_read(&ip6_frags.mem) > ip6_frags_ctl.high_thresh)
                ip6_evictor(ip6_dst_idev(skb->dst));
        if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr,
                          ip6_dst_idev(skb->dst))) != NULL) {
-                int ret = -1;
+                int ret;
-                spin_lock(&fq->lock);
+                spin_lock(&fq->q.lock);
-                ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
+                ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
-                if (fq->last_in == (FIRST_IN|LAST_IN) &&
+                spin_unlock(&fq->q.lock);
-                    fq->meat == fq->len)
+                fq_put(fq);
-                        ret = ip6_frag_reasm(fq, skbp, dev);
-                spin_unlock(&fq->lock);
-                fq_put(fq, NULL);
                return ret;
        }
@@ -775,11 +695,10 @@ void __init ipv6_frag_init(void)
        if (inet6_add_protocol(&frag_protocol, IPPROTO_FRAGMENT) < 0)
                printk(KERN_ERR "ipv6_frag_init: Could not register protocol\n");
-        ip6_frag_hash_rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^
+        ip6_frags.ctl = &ip6_frags_ctl;
-                                   (jiffies ^ (jiffies >> 6)));
+        ip6_frags.hashfn = ip6_hashfn;
+        ip6_frags.destructor = ip6_frag_free;
-        init_timer(&ip6_frag_secret_timer);
+        ip6_frags.skb_free = NULL;
-        ip6_frag_secret_timer.function = ip6_frag_secret_rebuild;
+        ip6_frags.qsize = sizeof(struct frag_queue);
-        ip6_frag_secret_timer.expires = jiffies + sysctl_ip6frag_secret_interval;
+        inet_frags_init(&ip6_frags);
-        add_timer(&ip6_frag_secret_timer);
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6ff19f9eb9ee..cce9941c11c6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -663,7 +663,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
        return rt;
 }
-static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
+static struct rt6_info *ip6_pol_route(struct fib6_table *table, int oif,
                                            struct flowi *fl, int flags)
 {
        struct fib6_node *fn;
@@ -682,7 +682,7 @@ restart_2:
        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
-        rt = rt6_select(fn, fl->iif, strict | reachable);
+        rt = rt6_select(fn, oif, strict | reachable);
        BACKTRACK(&fl->fl6_src);
        if (rt == &ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
@@ -735,6 +735,12 @@ out2:
        return rt;
 }
+static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
+                                            struct flowi *fl, int flags)
+{
+        return ip6_pol_route(table, fl->iif, fl, flags);
+}
 void ip6_route_input(struct sk_buff *skb)
 {
        struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -761,72 +767,7 @@ void ip6_route_input(struct sk_buff *skb)
 static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
                                             struct flowi *fl, int flags)
 {
-        struct fib6_node *fn;
+        return ip6_pol_route(table, fl->oif, fl, flags);
-        struct rt6_info *rt, *nrt;
-        int strict = 0;
-        int attempts = 3;
-        int err;
-        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
-        strict |= flags & RT6_LOOKUP_F_IFACE;
-relookup:
-        read_lock_bh(&table->tb6_lock);
-restart_2:
-        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
-restart:
-        rt = rt6_select(fn, fl->oif, strict | reachable);
-        BACKTRACK(&fl->fl6_src);
-        if (rt == &ip6_null_entry ||
-            rt->rt6i_flags & RTF_CACHE)
-                goto out;
-        dst_hold(&rt->u.dst);
-        read_unlock_bh(&table->tb6_lock);
-        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
-                nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
-#if CLONE_OFFLINK_ROUTE
-                nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
-        dst_release(&rt->u.dst);
-        rt = nrt ? : &ip6_null_entry;
-        dst_hold(&rt->u.dst);
-        if (nrt) {
-                err = ip6_ins_rt(nrt);
-                if (!err)
-                        goto out2;
-        }
-        if (--attempts <= 0)
-                goto out2;
-        /*
-         * Race condition! In the gap, when table->tb6_lock was
-         * released someone could insert this route.  Relookup.
-         */
-        dst_release(&rt->u.dst);
-        goto relookup;
-out:
-        if (reachable) {
-                reachable = 0;
-                goto restart_2;
-        }
-        dst_hold(&rt->u.dst);
-        read_unlock_bh(&table->tb6_lock);
-out2:
-        rt->u.dst.lastuse = jiffies;
-        rt->u.dst.__use++;
-        return rt;
 }
 struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 3fb44277207b..68bb2548e469 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -12,6 +12,7 @@
 #include <net/ndisc.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
+#include <net/inet_frag.h>
 #ifdef CONFIG_SYSCTL
@@ -41,7 +42,7 @@ static ctl_table ipv6_table[] = {
        {
                .ctl_name       = NET_IPV6_IP6FRAG_HIGH_THRESH,
                .procname       = "ip6frag_high_thresh",
-                .data           = &sysctl_ip6frag_high_thresh,
+                .data           = &ip6_frags_ctl.high_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
@@ -49,7 +50,7 @@ static ctl_table ipv6_table[] = {
        {
                .ctl_name       = NET_IPV6_IP6FRAG_LOW_THRESH,
                .procname       = "ip6frag_low_thresh",
-                .data           = &sysctl_ip6frag_low_thresh,
+                .data           = &ip6_frags_ctl.low_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec
@@ -57,7 +58,7 @@ static ctl_table ipv6_table[] = {
        {
                .ctl_name       = NET_IPV6_IP6FRAG_TIME,
                .procname       = "ip6frag_time",
-                .data           = &sysctl_ip6frag_time,
+                .data           = &ip6_frags_ctl.timeout,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec_jiffies,
@@ -66,7 +67,7 @@ static ctl_table ipv6_table[] = {
        {
                .ctl_name       = NET_IPV6_IP6FRAG_SECRET_INTERVAL,
                .procname       = "ip6frag_secret_interval",
-                .data           = &sysctl_ip6frag_secret_interval,
+                .data           = &ip6_frags_ctl.secret_interval,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = &proc_dointvec_jiffies,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index a07b59c528f3..737b755342bd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1668,9 +1668,8 @@ ipv6_pktoptions:
        return 0;
 }
-static int tcp_v6_rcv(struct sk_buff **pskb)
+static int tcp_v6_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *pskb;
        struct tcphdr *th;
        struct sock *sk;
        int ret;
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 23e2809878ae..6323921b40be 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -87,9 +87,8 @@ int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 EXPORT_SYMBOL(xfrm6_tunnel_deregister);
-static int tunnel6_rcv(struct sk_buff **pskb)
+static int tunnel6_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *pskb;
        struct xfrm6_tunnel *handler;
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
@@ -106,9 +105,8 @@ drop:
        return 0;
 }
-static int tunnel46_rcv(struct sk_buff **pskb)
+static int tunnel46_rcv(struct sk_buff *skb)
 {
-        struct sk_buff *skb = *pskb;
        struct xfrm6_tunnel *handler;
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 82ff26dd4470..caebad6ee510 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -405,10 +405,9 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
        return 0;
 }
-int __udp6_lib_rcv(struct sk_buff **pskb, struct hlist_head udptable[],
+int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                   int proto)
 {
-        struct sk_buff *skb = *pskb;
        struct sock *sk;
        struct udphdr *uh;
        struct net_device *dev = skb->dev;
@@ -494,9 +493,9 @@ discard:
        return 0;
 }
-static __inline__ int udpv6_rcv(struct sk_buff **pskb)
+static __inline__ int udpv6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(pskb, udp_hash, IPPROTO_UDP);
+        return __udp6_lib_rcv(skb, udp_hash, IPPROTO_UDP);
 }
 /*
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 6e252f318f7c..2d3fda601232 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -6,7 +6,7 @@
 #include <net/addrconf.h>
 #include <net/inet_common.h>
-extern int      __udp6_lib_rcv(struct sk_buff **, struct hlist_head [], int );
+extern int      __udp6_lib_rcv(struct sk_buff *, struct hlist_head [], int );
 extern void     __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
                               int , int , int , __be32 , struct hlist_head []);
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index f54016a55004..766566f7de47 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -17,9 +17,9 @@
 DEFINE_SNMP_STAT(struct udp_mib, udplite_stats_in6) __read_mostly;
-static int udplitev6_rcv(struct sk_buff **pskb)
+static int udplitev6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(pskb, udplite_hash, IPPROTO_UDPLITE);
+        return __udp6_lib_rcv(skb, udplite_hash, IPPROTO_UDPLITE);
 }
 static void udplitev6_err(struct sk_buff *skb,
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index c858537cec4b..02f69e544f6f 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -133,9 +133,9 @@ drop:
 EXPORT_SYMBOL(xfrm6_rcv_spi);
-int xfrm6_rcv(struct sk_buff **pskb)
+int xfrm6_rcv(struct sk_buff *skb)
 {
-        return xfrm6_rcv_spi(*pskb, 0);
+        return xfrm6_rcv_spi(skb, 0);
 }
 EXPORT_SYMBOL(xfrm6_rcv);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 4618c18e611d..a5a32c17249d 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -80,7 +80,7 @@ static int xfrm6_output_finish2(struct sk_buff *skb)
        while (likely((err = xfrm6_output_one(skb)) == 0)) {
                nf_reset(skb);
-                err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL,
+                err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL,
                              skb->dst->dev, dst_output);
                if (unlikely(err != 1))
                        break;
@@ -88,7 +88,7 @@ static int xfrm6_output_finish2(struct sk_buff *skb)
                if (!skb->dst->xfrm)
                        return dst_output(skb);
-                err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL,
+                err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL,
                              skb->dst->dev, xfrm6_output_finish2);
                if (unlikely(err != 1))
                        break;
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index a523fa4136ed..bed9ba01e8ec 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -117,7 +117,7 @@ void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
 EXPORT_SYMBOL(nf_unregister_hooks);
 unsigned int nf_iterate(struct list_head *head,
-                        struct sk_buff **skb,
+                        struct sk_buff *skb,
                        int hook,
                        const struct net_device *indev,
                        const struct net_device *outdev,
@@ -160,7 +160,7 @@ unsigned int nf_iterate(struct list_head *head,
 /* Returns 1 if okfn() needs to be executed by the caller,
 * -EPERM for NF_DROP, 0 otherwise. */
-int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
+int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
                 struct net_device *indev,
                 struct net_device *outdev,
                 int (*okfn)(struct sk_buff *),
@@ -175,17 +175,17 @@ int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
        elem = &nf_hooks[pf][hook];
 next_hook:
-        verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
+        verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
                             outdev, &elem, okfn, hook_thresh);
        if (verdict == NF_ACCEPT || verdict == NF_STOP) {
                ret = 1;
                goto unlock;
        } else if (verdict == NF_DROP) {
-                kfree_skb(*pskb);
+                kfree_skb(skb);
                ret = -EPERM;
        } else if ((verdict & NF_VERDICT_MASK)  == NF_QUEUE) {
                NFDEBUG("nf_hook: Verdict = QUEUE.\n");
-                if (!nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn,
+                if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
                              verdict >> NF_VERDICT_BITS))
                        goto next_hook;
        }
@@ -196,34 +196,24 @@ unlock:
 EXPORT_SYMBOL(nf_hook_slow);
-int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len)
+int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
 {
-        struct sk_buff *nskb;
+        if (writable_len > skb->len)
-        if (writable_len > (*pskb)->len)
                return 0;
        /* Not exclusive use of packet?  Must copy. */
-        if (skb_cloned(*pskb) && !skb_clone_writable(*pskb, writable_len))
+        if (!skb_cloned(skb)) {
-                goto copy_skb;
+                if (writable_len <= skb_headlen(skb))
-        if (skb_shared(*pskb))
+                        return 1;
-                goto copy_skb;
+        } else if (skb_clone_writable(skb, writable_len))
+                return 1;
-        return pskb_may_pull(*pskb, writable_len);
+        if (writable_len <= skb_headlen(skb))
-copy_skb:
+                writable_len = 0;
-        nskb = skb_copy(*pskb, GFP_ATOMIC);
+        else
-        if (!nskb)
+                writable_len -= skb_headlen(skb);
-                return 0;
-        BUG_ON(skb_is_nonlinear(nskb));
+        return !!__pskb_pull_tail(skb, writable_len);
-        /* Rest of kernel will get very unhappy if we pass it a
-           suddenly-orphaned skbuff */
-        if ((*pskb)->sk)
-                skb_set_owner_w(nskb, (*pskb)->sk);
-        kfree_skb(*pskb);
-        *pskb = nskb;
-        return 1;
 }
 EXPORT_SYMBOL(skb_make_writable);
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index e42ab230ad88..7b8239c0cd5e 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -36,7 +36,7 @@ MODULE_PARM_DESC(master_timeout, "timeout for the master connection");
 module_param(ts_algo, charp, 0400);
 MODULE_PARM_DESC(ts_algo, "textsearch algorithm to use (default kmp)");
-unsigned int (*nf_nat_amanda_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_amanda_hook)(struct sk_buff *skb,
                                   enum ip_conntrack_info ctinfo,
                                   unsigned int matchoff,
                                   unsigned int matchlen,
@@ -79,7 +79,7 @@ static struct {
        },
 };
-static int amanda_help(struct sk_buff **pskb,
+static int amanda_help(struct sk_buff *skb,
                       unsigned int protoff,
                       struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo)
@@ -101,25 +101,25 @@ static int amanda_help(struct sk_buff **pskb,
        /* increase the UDP timeout of the master connection as replies from
         * Amanda clients to the server can be quite delayed */
-        nf_ct_refresh(ct, *pskb, master_timeout * HZ);
+        nf_ct_refresh(ct, skb, master_timeout * HZ);
        /* No data? */
        dataoff = protoff + sizeof(struct udphdr);
-        if (dataoff >= (*pskb)->len) {
+        if (dataoff >= skb->len) {
                if (net_ratelimit())
-                        printk("amanda_help: skblen = %u\n", (*pskb)->len);
+                        printk("amanda_help: skblen = %u\n", skb->len);
                return NF_ACCEPT;
        }
        memset(&ts, 0, sizeof(ts));
-        start = skb_find_text(*pskb, dataoff, (*pskb)->len,
+        start = skb_find_text(skb, dataoff, skb->len,
                              search[SEARCH_CONNECT].ts, &ts);
        if (start == UINT_MAX)
                goto out;
        start += dataoff + search[SEARCH_CONNECT].len;
        memset(&ts, 0, sizeof(ts));
-        stop = skb_find_text(*pskb, start, (*pskb)->len,
+        stop = skb_find_text(skb, start, skb->len,
                             search[SEARCH_NEWLINE].ts, &ts);
        if (stop == UINT_MAX)
                goto out;
@@ -127,13 +127,13 @@ static int amanda_help(struct sk_buff **pskb,
        for (i = SEARCH_DATA; i <= SEARCH_INDEX; i++) {
                memset(&ts, 0, sizeof(ts));
-                off = skb_find_text(*pskb, start, stop, search[i].ts, &ts);
+                off = skb_find_text(skb, start, stop, search[i].ts, &ts);
                if (off == UINT_MAX)
                        continue;
                off += start + search[i].len;
                len = min_t(unsigned int, sizeof(pbuf) - 1, stop - off);
-                if (skb_copy_bits(*pskb, off, pbuf, len))
+                if (skb_copy_bits(skb, off, pbuf, len))
                        break;
                pbuf[len] = '\0';
@@ -153,7 +153,7 @@ static int amanda_help(struct sk_buff **pskb,
                nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
                if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
-                        ret = nf_nat_amanda(pskb, ctinfo, off - dataoff,
+                        ret = nf_nat_amanda(skb, ctinfo, off - dataoff,
                                            len, exp);
                else if (nf_ct_expect_related(exp) != 0)
                        ret = NF_DROP;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 83c30b45d170..4d6171bc0829 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -307,7 +307,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 /* Confirm a connection given skb; places it in hash table */
 int
-__nf_conntrack_confirm(struct sk_buff **pskb)
+__nf_conntrack_confirm(struct sk_buff *skb)
 {
        unsigned int hash, repl_hash;
        struct nf_conntrack_tuple_hash *h;
@@ -316,7 +316,7 @@ __nf_conntrack_confirm(struct sk_buff **pskb)
        struct hlist_node *n;
        enum ip_conntrack_info ctinfo;
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        /* ipt_REJECT uses nf_conntrack_attach to attach related
           ICMP/TCP RST packets in other direction.  Actual packet
@@ -367,14 +367,14 @@ __nf_conntrack_confirm(struct sk_buff **pskb)
        write_unlock_bh(&nf_conntrack_lock);
        help = nfct_help(ct);
        if (help && help->helper)
-                nf_conntrack_event_cache(IPCT_HELPER, *pskb);
+                nf_conntrack_event_cache(IPCT_HELPER, skb);
 #ifdef CONFIG_NF_NAT_NEEDED
        if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
            test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_NATINFO, *pskb);
+                nf_conntrack_event_cache(IPCT_NATINFO, skb);
 #endif
        nf_conntrack_event_cache(master_ct(ct) ?
-                                 IPCT_RELATED : IPCT_NEW, *pskb);
+                                 IPCT_RELATED : IPCT_NEW, skb);
        return NF_ACCEPT;
 out:
@@ -632,7 +632,7 @@ resolve_normal_ct(struct sk_buff *skb,
 }
 unsigned int
-nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
+nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff *skb)
 {
        struct nf_conn *ct;
        enum ip_conntrack_info ctinfo;
@@ -644,14 +644,14 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
        int ret;
        /* Previously seen (loopback or untracked)?  Ignore. */
-        if ((*pskb)->nfct) {
+        if (skb->nfct) {
                NF_CT_STAT_INC_ATOMIC(ignore);
                return NF_ACCEPT;
        }
        /* rcu_read_lock()ed by nf_hook_slow */
        l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
-        ret = l3proto->get_l4proto(*pskb, skb_network_offset(*pskb),
+        ret = l3proto->get_l4proto(skb, skb_network_offset(skb),
                                   &dataoff, &protonum);
        if (ret <= 0) {
                pr_debug("not prepared to track yet or error occured\n");
@@ -666,13 +666,13 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
         * inverse of the return code tells to the netfilter
         * core what to do with the packet. */
        if (l4proto->error != NULL &&
-            (ret = l4proto->error(*pskb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
+            (ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
                NF_CT_STAT_INC_ATOMIC(error);
                NF_CT_STAT_INC_ATOMIC(invalid);
                return -ret;
        }
-        ct = resolve_normal_ct(*pskb, dataoff, pf, protonum, l3proto, l4proto,
+        ct = resolve_normal_ct(skb, dataoff, pf, protonum, l3proto, l4proto,
                               &set_reply, &ctinfo);
        if (!ct) {
                /* Not valid part of a connection */
@@ -686,21 +686,21 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
                return NF_DROP;
        }
-        NF_CT_ASSERT((*pskb)->nfct);
+        NF_CT_ASSERT(skb->nfct);
-        ret = l4proto->packet(ct, *pskb, dataoff, ctinfo, pf, hooknum);
+        ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
        if (ret < 0) {
                /* Invalid: inverse of the return code tells
                 * the netfilter core what to do */
                pr_debug("nf_conntrack_in: Can't track with proto module\n");
-                nf_conntrack_put((*pskb)->nfct);
+                nf_conntrack_put(skb->nfct);
-                (*pskb)->nfct = NULL;
+                skb->nfct = NULL;
                NF_CT_STAT_INC_ATOMIC(invalid);
                return -ret;
        }
        if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_STATUS, *pskb);
+                nf_conntrack_event_cache(IPCT_STATUS, skb);
        return ret;
 }
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index c763ee74ea02..6df259067f7e 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -43,7 +43,7 @@ module_param_array(ports, ushort, &ports_c, 0400);
 static int loose;
 module_param(loose, bool, 0600);
-unsigned int (*nf_nat_ftp_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,
                                enum nf_ct_ftp_type type,
                                unsigned int matchoff,
@@ -344,7 +344,7 @@ static void update_nl_seq(u32 nl_seq, struct nf_ct_ftp_master *info, int dir,
        }
 }
-static int help(struct sk_buff **pskb,
+static int help(struct sk_buff *skb,
                unsigned int protoff,
                struct nf_conn *ct,
                enum ip_conntrack_info ctinfo)
@@ -371,21 +371,21 @@ static int help(struct sk_buff **pskb,
                return NF_ACCEPT;
        }
-        th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
        if (th == NULL)
                return NF_ACCEPT;
        dataoff = protoff + th->doff * 4;
        /* No data? */
-        if (dataoff >= (*pskb)->len) {
+        if (dataoff >= skb->len) {
                pr_debug("ftp: dataoff(%u) >= skblen(%u)\n", dataoff,
-                         (*pskb)->len);
+                         skb->len);
                return NF_ACCEPT;
        }
-        datalen = (*pskb)->len - dataoff;
+        datalen = skb->len - dataoff;
        spin_lock_bh(&nf_ftp_lock);
-        fb_ptr = skb_header_pointer(*pskb, dataoff, datalen, ftp_buffer);
+        fb_ptr = skb_header_pointer(skb, dataoff, datalen, ftp_buffer);
        BUG_ON(fb_ptr == NULL);
        ends_in_nl = (fb_ptr[datalen - 1] == '\n');
@@ -491,7 +491,7 @@ static int help(struct sk_buff **pskb,
         * (possibly changed) expectation itself. */
        nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
        if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_ftp(pskb, ctinfo, search[dir][i].ftptype,
+                ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
                                 matchoff, matchlen, exp);
        else {
                /* Can't expect this?  Best to drop packet now. */
@@ -508,7 +508,7 @@ out_update_nl:
        /* Now if this ends in \n, update ftp info.  Seq may have been
         * adjusted by NAT code. */
        if (ends_in_nl)
-                update_nl_seq(seq, ct_ftp_info, dir, *pskb);
+                update_nl_seq(seq, ct_ftp_info, dir, skb);
 out:
        spin_unlock_bh(&nf_ftp_lock);
        return ret;
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index a8a9dfbe7a67..f23fd9598e19 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -47,27 +47,27 @@ MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
                                     "(determined by routing information)");
 /* Hooks for NAT */
-int (*set_h245_addr_hook) (struct sk_buff **pskb,
+int (*set_h245_addr_hook) (struct sk_buff *skb,
                           unsigned char **data, int dataoff,
                           H245_TransportAddress *taddr,
                           union nf_conntrack_address *addr, __be16 port)
                           __read_mostly;
-int (*set_h225_addr_hook) (struct sk_buff **pskb,
+int (*set_h225_addr_hook) (struct sk_buff *skb,
                           unsigned char **data, int dataoff,
                           TransportAddress *taddr,
                           union nf_conntrack_address *addr, __be16 port)
                           __read_mostly;
-int (*set_sig_addr_hook) (struct sk_buff **pskb,
+int (*set_sig_addr_hook) (struct sk_buff *skb,
                          struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
                          unsigned char **data,
                          TransportAddress *taddr, int count) __read_mostly;
-int (*set_ras_addr_hook) (struct sk_buff **pskb,
+int (*set_ras_addr_hook) (struct sk_buff *skb,
                          struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
                          unsigned char **data,
                          TransportAddress *taddr, int count) __read_mostly;
-int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
+int (*nat_rtp_rtcp_hook) (struct sk_buff *skb,
                          struct nf_conn *ct,
                          enum ip_conntrack_info ctinfo,
                          unsigned char **data, int dataoff,
@@ -75,25 +75,25 @@ int (*nat_rtp_rtcp_hook) (struct sk_buff **pskb,
                          __be16 port, __be16 rtp_port,
                          struct nf_conntrack_expect *rtp_exp,
                          struct nf_conntrack_expect *rtcp_exp) __read_mostly;
-int (*nat_t120_hook) (struct sk_buff **pskb,
+int (*nat_t120_hook) (struct sk_buff *skb,
                      struct nf_conn *ct,
                      enum ip_conntrack_info ctinfo,
                      unsigned char **data, int dataoff,
                      H245_TransportAddress *taddr, __be16 port,
                      struct nf_conntrack_expect *exp) __read_mostly;
-int (*nat_h245_hook) (struct sk_buff **pskb,
+int (*nat_h245_hook) (struct sk_buff *skb,
                      struct nf_conn *ct,
                      enum ip_conntrack_info ctinfo,
                      unsigned char **data, int dataoff,
                      TransportAddress *taddr, __be16 port,
                      struct nf_conntrack_expect *exp) __read_mostly;
-int (*nat_callforwarding_hook) (struct sk_buff **pskb,
+int (*nat_callforwarding_hook) (struct sk_buff *skb,
                                struct nf_conn *ct,
                                enum ip_conntrack_info ctinfo,
                                unsigned char **data, int dataoff,
                                TransportAddress *taddr, __be16 port,
                                struct nf_conntrack_expect *exp) __read_mostly;
-int (*nat_q931_hook) (struct sk_buff **pskb,
+int (*nat_q931_hook) (struct sk_buff *skb,
                      struct nf_conn *ct,
                      enum ip_conntrack_info ctinfo,
                      unsigned char **data, TransportAddress *taddr, int idx,
@@ -108,7 +108,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[];
 static struct nf_conntrack_helper nf_conntrack_helper_ras[];
 /****************************************************************************/
-static int get_tpkt_data(struct sk_buff **pskb, unsigned int protoff,
+static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
                         struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                         unsigned char **data, int *datalen, int *dataoff)
 {
@@ -122,7 +122,7 @@ static int get_tpkt_data(struct sk_buff **pskb, unsigned int protoff,
        int tpktoff;
        /* Get TCP header */
-        th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
        if (th == NULL)
                return 0;
@@ -130,13 +130,13 @@ static int get_tpkt_data(struct sk_buff **pskb, unsigned int protoff,
        tcpdataoff = protoff + th->doff * 4;
        /* Get TCP data length */
-        tcpdatalen = (*pskb)->len - tcpdataoff;
+        tcpdatalen = skb->len - tcpdataoff;
        if (tcpdatalen <= 0)    /* No TCP data */
                goto clear_out;
        if (*data == NULL) {    /* first TPKT */
                /* Get first TPKT pointer */
-                tpkt = skb_header_pointer(*pskb, tcpdataoff, tcpdatalen,
+                tpkt = skb_header_pointer(skb, tcpdataoff, tcpdatalen,
                                          h323_buffer);
                BUG_ON(tpkt == NULL);
@@ -248,7 +248,7 @@ static int get_h245_addr(struct nf_conn *ct, unsigned char *data,
 }
 /****************************************************************************/
-static int expect_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
+static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
                           unsigned char **data, int dataoff,
                           H245_TransportAddress *taddr)
@@ -297,7 +297,7 @@ static int expect_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
                   (nat_rtp_rtcp = rcu_dereference(nat_rtp_rtcp_hook)) &&
                   ct->status & IPS_NAT_MASK) {
                /* NAT needed */
-                ret = nat_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                ret = nat_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
                                   taddr, port, rtp_port, rtp_exp, rtcp_exp);
        } else {                /* Conntrack only */
                if (nf_ct_expect_related(rtp_exp) == 0) {
@@ -321,7 +321,7 @@ static int expect_rtp_rtcp(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int expect_t120(struct sk_buff **pskb,
+static int expect_t120(struct sk_buff *skb,
                       struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, int dataoff,
@@ -355,7 +355,7 @@ static int expect_t120(struct sk_buff **pskb,
            (nat_t120 = rcu_dereference(nat_t120_hook)) &&
            ct->status & IPS_NAT_MASK) {
                /* NAT needed */
-                ret = nat_t120(pskb, ct, ctinfo, data, dataoff, taddr,
+                ret = nat_t120(skb, ct, ctinfo, data, dataoff, taddr,
                               port, exp);
        } else {                /* Conntrack only */
                if (nf_ct_expect_related(exp) == 0) {
@@ -371,7 +371,7 @@ static int expect_t120(struct sk_buff **pskb,
 }
 /****************************************************************************/
-static int process_h245_channel(struct sk_buff **pskb,
+static int process_h245_channel(struct sk_buff *skb,
                                struct nf_conn *ct,
                                enum ip_conntrack_info ctinfo,
                                unsigned char **data, int dataoff,
@@ -381,7 +381,7 @@ static int process_h245_channel(struct sk_buff **pskb,
        if (channel->options & eH2250LogicalChannelParameters_mediaChannel) {
                /* RTP */
-                ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
                                      &channel->mediaChannel);
                if (ret < 0)
                        return -1;
@@ -390,7 +390,7 @@ static int process_h245_channel(struct sk_buff **pskb,
        if (channel->
            options & eH2250LogicalChannelParameters_mediaControlChannel) {
                /* RTCP */
-                ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
                                      &channel->mediaControlChannel);
                if (ret < 0)
                        return -1;
@@ -400,7 +400,7 @@ static int process_h245_channel(struct sk_buff **pskb,
 }
 /****************************************************************************/
-static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_olc(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, int dataoff,
                       OpenLogicalChannel *olc)
@@ -412,7 +412,7 @@ static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
        if (olc->forwardLogicalChannelParameters.multiplexParameters.choice ==
            eOpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters)
        {
-                ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                ret = process_h245_channel(skb, ct, ctinfo, data, dataoff,
                                           &olc->
                                           forwardLogicalChannelParameters.
                                           multiplexParameters.
@@ -430,7 +430,7 @@ static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
                eOpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
        {
                ret =
-                    process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                    process_h245_channel(skb, ct, ctinfo, data, dataoff,
                                         &olc->
                                         reverseLogicalChannelParameters.
                                         multiplexParameters.
@@ -448,7 +448,7 @@ static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
            t120.choice == eDataProtocolCapability_separateLANStack &&
            olc->separateStack.networkAddress.choice ==
            eNetworkAccessParameters_networkAddress_localAreaAddress) {
-                ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_t120(skb, ct, ctinfo, data, dataoff,
                                  &olc->separateStack.networkAddress.
                                  localAreaAddress);
                if (ret < 0)
@@ -459,7 +459,7 @@ static int process_olc(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_olca(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data, int dataoff,
                        OpenLogicalChannelAck *olca)
@@ -477,7 +477,7 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
                choice ==
                eOpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters_h2250LogicalChannelParameters))
        {
-                ret = process_h245_channel(pskb, ct, ctinfo, data, dataoff,
+                ret = process_h245_channel(skb, ct, ctinfo, data, dataoff,
                                           &olca->
                                           reverseLogicalChannelParameters.
                                           multiplexParameters.
@@ -496,7 +496,7 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
                if (ack->options &
                    eH2250LogicalChannelAckParameters_mediaChannel) {
                        /* RTP */
-                        ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                        ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
                                              &ack->mediaChannel);
                        if (ret < 0)
                                return -1;
@@ -505,7 +505,7 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
                if (ack->options &
                    eH2250LogicalChannelAckParameters_mediaControlChannel) {
                        /* RTCP */
-                        ret = expect_rtp_rtcp(pskb, ct, ctinfo, data, dataoff,
+                        ret = expect_rtp_rtcp(skb, ct, ctinfo, data, dataoff,
                                              &ack->mediaControlChannel);
                        if (ret < 0)
                                return -1;
@@ -515,7 +515,7 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
        if ((olca->options & eOpenLogicalChannelAck_separateStack) &&
                olca->separateStack.networkAddress.choice ==
                eNetworkAccessParameters_networkAddress_localAreaAddress) {
-                ret = expect_t120(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_t120(skb, ct, ctinfo, data, dataoff,
                                  &olca->separateStack.networkAddress.
                                  localAreaAddress);
                if (ret < 0)
@@ -526,7 +526,7 @@ static int process_olca(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_h245(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_h245(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data, int dataoff,
                        MultimediaSystemControlMessage *mscm)
@@ -535,7 +535,7 @@ static int process_h245(struct sk_buff **pskb, struct nf_conn *ct,
        case eMultimediaSystemControlMessage_request:
                if (mscm->request.choice ==
                    eRequestMessage_openLogicalChannel) {
-                        return process_olc(pskb, ct, ctinfo, data, dataoff,
+                        return process_olc(skb, ct, ctinfo, data, dataoff,
                                           &mscm->request.openLogicalChannel);
                }
                pr_debug("nf_ct_h323: H.245 Request %d\n",
@@ -544,7 +544,7 @@ static int process_h245(struct sk_buff **pskb, struct nf_conn *ct,
        case eMultimediaSystemControlMessage_response:
                if (mscm->response.choice ==
                    eResponseMessage_openLogicalChannelAck) {
-                        return process_olca(pskb, ct, ctinfo, data, dataoff,
+                        return process_olca(skb, ct, ctinfo, data, dataoff,
                                            &mscm->response.
                                            openLogicalChannelAck);
                }
@@ -560,7 +560,7 @@ static int process_h245(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int h245_help(struct sk_buff **pskb, unsigned int protoff,
+static int h245_help(struct sk_buff *skb, unsigned int protoff,
                     struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
        static MultimediaSystemControlMessage mscm;
@@ -574,12 +574,12 @@ static int h245_help(struct sk_buff **pskb, unsigned int protoff,
            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
                return NF_ACCEPT;
        }
-        pr_debug("nf_ct_h245: skblen = %u\n", (*pskb)->len);
+        pr_debug("nf_ct_h245: skblen = %u\n", skb->len);
        spin_lock_bh(&nf_h323_lock);
        /* Process each TPKT */
-        while (get_tpkt_data(pskb, protoff, ct, ctinfo,
+        while (get_tpkt_data(skb, protoff, ct, ctinfo,
                             &data, &datalen, &dataoff)) {
                pr_debug("nf_ct_h245: TPKT len=%d ", datalen);
                NF_CT_DUMP_TUPLE(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
@@ -596,7 +596,7 @@ static int h245_help(struct sk_buff **pskb, unsigned int protoff,
                }
                /* Process H.245 signal */
-                if (process_h245(pskb, ct, ctinfo, &data, dataoff, &mscm) < 0)
+                if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0)
                        goto drop;
        }
@@ -654,7 +654,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data,
 }
 /****************************************************************************/
-static int expect_h245(struct sk_buff **pskb, struct nf_conn *ct,
+static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, int dataoff,
                       TransportAddress *taddr)
@@ -687,7 +687,7 @@ static int expect_h245(struct sk_buff **pskb, struct nf_conn *ct,
            (nat_h245 = rcu_dereference(nat_h245_hook)) &&
            ct->status & IPS_NAT_MASK) {
                /* NAT needed */
-                ret = nat_h245(pskb, ct, ctinfo, data, dataoff, taddr,
+                ret = nat_h245(skb, ct, ctinfo, data, dataoff, taddr,
                               port, exp);
        } else {                /* Conntrack only */
                if (nf_ct_expect_related(exp) == 0) {
@@ -758,7 +758,7 @@ static int callforward_do_filter(union nf_conntrack_address *src,
 }
 /****************************************************************************/
-static int expect_callforwarding(struct sk_buff **pskb,
+static int expect_callforwarding(struct sk_buff *skb,
                                 struct nf_conn *ct,
                                 enum ip_conntrack_info ctinfo,
                                 unsigned char **data, int dataoff,
@@ -798,7 +798,7 @@ static int expect_callforwarding(struct sk_buff **pskb,
            (nat_callforwarding = rcu_dereference(nat_callforwarding_hook)) &&
            ct->status & IPS_NAT_MASK) {
                /* Need NAT */
-                ret = nat_callforwarding(pskb, ct, ctinfo, data, dataoff,
+                ret = nat_callforwarding(skb, ct, ctinfo, data, dataoff,
                                         taddr, port, exp);
        } else {                /* Conntrack only */
                if (nf_ct_expect_related(exp) == 0) {
@@ -814,7 +814,7 @@ static int expect_callforwarding(struct sk_buff **pskb,
 }
 /****************************************************************************/
-static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_setup(struct sk_buff *skb, struct nf_conn *ct,
                         enum ip_conntrack_info ctinfo,
                         unsigned char **data, int dataoff,
                         Setup_UUIE *setup)
@@ -829,7 +829,7 @@ static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
        pr_debug("nf_ct_q931: Setup\n");
        if (setup->options & eSetup_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &setup->h245Address);
                if (ret < 0)
                        return -1;
@@ -846,7 +846,7 @@ static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
                         NIP6(*(struct in6_addr *)&addr), ntohs(port),
                         NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.src.u3),
                         ntohs(ct->tuplehash[!dir].tuple.src.u.tcp.port));
-                ret = set_h225_addr(pskb, data, dataoff,
+                ret = set_h225_addr(skb, data, dataoff,
                                    &setup->destCallSignalAddress,
                                    &ct->tuplehash[!dir].tuple.src.u3,
                                    ct->tuplehash[!dir].tuple.src.u.tcp.port);
@@ -864,7 +864,7 @@ static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
                         NIP6(*(struct in6_addr *)&addr), ntohs(port),
                         NIP6(*(struct in6_addr *)&ct->tuplehash[!dir].tuple.dst.u3),
                         ntohs(ct->tuplehash[!dir].tuple.dst.u.tcp.port));
-                ret = set_h225_addr(pskb, data, dataoff,
+                ret = set_h225_addr(skb, data, dataoff,
                                    &setup->sourceCallSignalAddress,
                                    &ct->tuplehash[!dir].tuple.dst.u3,
                                    ct->tuplehash[!dir].tuple.dst.u.tcp.port);
@@ -874,7 +874,7 @@ static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
        if (setup->options & eSetup_UUIE_fastStart) {
                for (i = 0; i < setup->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &setup->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -885,7 +885,7 @@ static int process_setup(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_callproceeding(struct sk_buff **pskb,
+static int process_callproceeding(struct sk_buff *skb,
                                  struct nf_conn *ct,
                                  enum ip_conntrack_info ctinfo,
                                  unsigned char **data, int dataoff,
@@ -897,7 +897,7 @@ static int process_callproceeding(struct sk_buff **pskb,
        pr_debug("nf_ct_q931: CallProceeding\n");
        if (callproc->options & eCallProceeding_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &callproc->h245Address);
                if (ret < 0)
                        return -1;
@@ -905,7 +905,7 @@ static int process_callproceeding(struct sk_buff **pskb,
        if (callproc->options & eCallProceeding_UUIE_fastStart) {
                for (i = 0; i < callproc->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &callproc->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -916,7 +916,7 @@ static int process_callproceeding(struct sk_buff **pskb,
 }
 /****************************************************************************/
-static int process_connect(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_connect(struct sk_buff *skb, struct nf_conn *ct,
                           enum ip_conntrack_info ctinfo,
                           unsigned char **data, int dataoff,
                           Connect_UUIE *connect)
@@ -927,7 +927,7 @@ static int process_connect(struct sk_buff **pskb, struct nf_conn *ct,
        pr_debug("nf_ct_q931: Connect\n");
        if (connect->options & eConnect_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &connect->h245Address);
                if (ret < 0)
                        return -1;
@@ -935,7 +935,7 @@ static int process_connect(struct sk_buff **pskb, struct nf_conn *ct,
        if (connect->options & eConnect_UUIE_fastStart) {
                for (i = 0; i < connect->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &connect->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -946,7 +946,7 @@ static int process_connect(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_alerting(struct sk_buff *skb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            unsigned char **data, int dataoff,
                            Alerting_UUIE *alert)
@@ -957,7 +957,7 @@ static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
        pr_debug("nf_ct_q931: Alerting\n");
        if (alert->options & eAlerting_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &alert->h245Address);
                if (ret < 0)
                        return -1;
@@ -965,7 +965,7 @@ static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
        if (alert->options & eAlerting_UUIE_fastStart) {
                for (i = 0; i < alert->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &alert->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -976,7 +976,7 @@ static int process_alerting(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_facility(struct sk_buff *skb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            unsigned char **data, int dataoff,
                            Facility_UUIE *facility)
@@ -988,7 +988,7 @@ static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
        if (facility->reason.choice == eFacilityReason_callForwarded) {
                if (facility->options & eFacility_UUIE_alternativeAddress)
-                        return expect_callforwarding(pskb, ct, ctinfo, data,
+                        return expect_callforwarding(skb, ct, ctinfo, data,
                                                     dataoff,
                                                     &facility->
                                                     alternativeAddress);
@@ -996,7 +996,7 @@ static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
        }
        if (facility->options & eFacility_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &facility->h245Address);
                if (ret < 0)
                        return -1;
@@ -1004,7 +1004,7 @@ static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
        if (facility->options & eFacility_UUIE_fastStart) {
                for (i = 0; i < facility->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &facility->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -1015,7 +1015,7 @@ static int process_facility(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_progress(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_progress(struct sk_buff *skb, struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            unsigned char **data, int dataoff,
                            Progress_UUIE *progress)
@@ -1026,7 +1026,7 @@ static int process_progress(struct sk_buff **pskb, struct nf_conn *ct,
        pr_debug("nf_ct_q931: Progress\n");
        if (progress->options & eProgress_UUIE_h245Address) {
-                ret = expect_h245(pskb, ct, ctinfo, data, dataoff,
+                ret = expect_h245(skb, ct, ctinfo, data, dataoff,
                                  &progress->h245Address);
                if (ret < 0)
                        return -1;
@@ -1034,7 +1034,7 @@ static int process_progress(struct sk_buff **pskb, struct nf_conn *ct,
        if (progress->options & eProgress_UUIE_fastStart) {
                for (i = 0; i < progress->fastStart.count; i++) {
-                        ret = process_olc(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_olc(skb, ct, ctinfo, data, dataoff,
                                          &progress->fastStart.item[i]);
                        if (ret < 0)
                                return -1;
@@ -1045,7 +1045,7 @@ static int process_progress(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_q931(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data, int dataoff, Q931 *q931)
 {
@@ -1055,28 +1055,28 @@ static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
        switch (pdu->h323_message_body.choice) {
        case eH323_UU_PDU_h323_message_body_setup:
-                ret = process_setup(pskb, ct, ctinfo, data, dataoff,
+                ret = process_setup(skb, ct, ctinfo, data, dataoff,
                                    &pdu->h323_message_body.setup);
                break;
        case eH323_UU_PDU_h323_message_body_callProceeding:
-                ret = process_callproceeding(pskb, ct, ctinfo, data, dataoff,
+                ret = process_callproceeding(skb, ct, ctinfo, data, dataoff,
                                             &pdu->h323_message_body.
                                             callProceeding);
                break;
        case eH323_UU_PDU_h323_message_body_connect:
-                ret = process_connect(pskb, ct, ctinfo, data, dataoff,
+                ret = process_connect(skb, ct, ctinfo, data, dataoff,
                                      &pdu->h323_message_body.connect);
                break;
        case eH323_UU_PDU_h323_message_body_alerting:
-                ret = process_alerting(pskb, ct, ctinfo, data, dataoff,
+                ret = process_alerting(skb, ct, ctinfo, data, dataoff,
                                       &pdu->h323_message_body.alerting);
                break;
        case eH323_UU_PDU_h323_message_body_facility:
-                ret = process_facility(pskb, ct, ctinfo, data, dataoff,
+                ret = process_facility(skb, ct, ctinfo, data, dataoff,
                                       &pdu->h323_message_body.facility);
                break;
        case eH323_UU_PDU_h323_message_body_progress:
-                ret = process_progress(pskb, ct, ctinfo, data, dataoff,
+                ret = process_progress(skb, ct, ctinfo, data, dataoff,
                                       &pdu->h323_message_body.progress);
                break;
        default:
@@ -1090,7 +1090,7 @@ static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
        if (pdu->options & eH323_UU_PDU_h245Control) {
                for (i = 0; i < pdu->h245Control.count; i++) {
-                        ret = process_h245(pskb, ct, ctinfo, data, dataoff,
+                        ret = process_h245(skb, ct, ctinfo, data, dataoff,
                                           &pdu->h245Control.item[i]);
                        if (ret < 0)
                                return -1;
@@ -1101,7 +1101,7 @@ static int process_q931(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int q931_help(struct sk_buff **pskb, unsigned int protoff,
+static int q931_help(struct sk_buff *skb, unsigned int protoff,
                     struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
        static Q931 q931;
@@ -1115,12 +1115,12 @@ static int q931_help(struct sk_buff **pskb, unsigned int protoff,
            ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
                return NF_ACCEPT;
        }
-        pr_debug("nf_ct_q931: skblen = %u\n", (*pskb)->len);
+        pr_debug("nf_ct_q931: skblen = %u\n", skb->len);
        spin_lock_bh(&nf_h323_lock);
        /* Process each TPKT */
-        while (get_tpkt_data(pskb, protoff, ct, ctinfo,
+        while (get_tpkt_data(skb, protoff, ct, ctinfo,
                             &data, &datalen, &dataoff)) {
                pr_debug("nf_ct_q931: TPKT len=%d ", datalen);
                NF_CT_DUMP_TUPLE(&ct->tuplehash[CTINFO2DIR(ctinfo)].tuple);
@@ -1136,7 +1136,7 @@ static int q931_help(struct sk_buff **pskb, unsigned int protoff,
                }
                /* Process Q.931 signal */
-                if (process_q931(pskb, ct, ctinfo, &data, dataoff, &q931) < 0)
+                if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0)
                        goto drop;
        }
@@ -1177,20 +1177,20 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
 };
 /****************************************************************************/
-static unsigned char *get_udp_data(struct sk_buff **pskb, unsigned int protoff,
+static unsigned char *get_udp_data(struct sk_buff *skb, unsigned int protoff,
                                   int *datalen)
 {
        struct udphdr _uh, *uh;
        int dataoff;
-        uh = skb_header_pointer(*pskb, protoff, sizeof(_uh), &_uh);
+        uh = skb_header_pointer(skb, protoff, sizeof(_uh), &_uh);
        if (uh == NULL)
                return NULL;
        dataoff = protoff + sizeof(_uh);
-        if (dataoff >= (*pskb)->len)
+        if (dataoff >= skb->len)
                return NULL;
-        *datalen = (*pskb)->len - dataoff;
+        *datalen = skb->len - dataoff;
-        return skb_header_pointer(*pskb, dataoff, *datalen, h323_buffer);
+        return skb_header_pointer(skb, dataoff, *datalen, h323_buffer);
 }
 /****************************************************************************/
@@ -1227,7 +1227,7 @@ static int set_expect_timeout(struct nf_conntrack_expect *exp,
 }
 /****************************************************************************/
-static int expect_q931(struct sk_buff **pskb, struct nf_conn *ct,
+static int expect_q931(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data,
                       TransportAddress *taddr, int count)
@@ -1265,7 +1265,7 @@ static int expect_q931(struct sk_buff **pskb, struct nf_conn *ct,
        nat_q931 = rcu_dereference(nat_q931_hook);
        if (nat_q931 && ct->status & IPS_NAT_MASK) {    /* Need NAT */
-                ret = nat_q931(pskb, ct, ctinfo, data, taddr, i, port, exp);
+                ret = nat_q931(skb, ct, ctinfo, data, taddr, i, port, exp);
        } else {                /* Conntrack only */
                if (nf_ct_expect_related(exp) == 0) {
                        pr_debug("nf_ct_ras: expect Q.931 ");
@@ -1283,7 +1283,7 @@ static int expect_q931(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_grq(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_grq(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, GatekeeperRequest *grq)
 {
@@ -1293,13 +1293,13 @@ static int process_grq(struct sk_buff **pskb, struct nf_conn *ct,
        set_ras_addr = rcu_dereference(set_ras_addr_hook);
        if (set_ras_addr && ct->status & IPS_NAT_MASK)  /* NATed */
-                return set_ras_addr(pskb, ct, ctinfo, data,
+                return set_ras_addr(skb, ct, ctinfo, data,
                                    &grq->rasAddress, 1);
        return 0;
 }
 /****************************************************************************/
-static int process_gcf(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_gcf(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, GatekeeperConfirm *gcf)
 {
@@ -1343,7 +1343,7 @@ static int process_gcf(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_rrq(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_rrq(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, RegistrationRequest *rrq)
 {
@@ -1353,7 +1353,7 @@ static int process_rrq(struct sk_buff **pskb, struct nf_conn *ct,
        pr_debug("nf_ct_ras: RRQ\n");
-        ret = expect_q931(pskb, ct, ctinfo, data,
+        ret = expect_q931(skb, ct, ctinfo, data,
                          rrq->callSignalAddress.item,
                          rrq->callSignalAddress.count);
        if (ret < 0)
@@ -1361,7 +1361,7 @@ static int process_rrq(struct sk_buff **pskb, struct nf_conn *ct,
        set_ras_addr = rcu_dereference(set_ras_addr_hook);
        if (set_ras_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_ras_addr(pskb, ct, ctinfo, data,
+                ret = set_ras_addr(skb, ct, ctinfo, data,
                                   rrq->rasAddress.item,
                                   rrq->rasAddress.count);
                if (ret < 0)
@@ -1378,7 +1378,7 @@ static int process_rrq(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_rcf(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, RegistrationConfirm *rcf)
 {
@@ -1392,7 +1392,7 @@ static int process_rcf(struct sk_buff **pskb, struct nf_conn *ct,
        set_sig_addr = rcu_dereference(set_sig_addr_hook);
        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(pskb, ct, ctinfo, data,
+                ret = set_sig_addr(skb, ct, ctinfo, data,
                                        rcf->callSignalAddress.item,
                                        rcf->callSignalAddress.count);
                if (ret < 0)
@@ -1407,7 +1407,7 @@ static int process_rcf(struct sk_buff **pskb, struct nf_conn *ct,
        if (info->timeout > 0) {
                pr_debug("nf_ct_ras: set RAS connection timeout to "
                         "%u seconds\n", info->timeout);
-                nf_ct_refresh(ct, *pskb, info->timeout * HZ);
+                nf_ct_refresh(ct, skb, info->timeout * HZ);
                /* Set expect timeout */
                read_lock_bh(&nf_conntrack_lock);
@@ -1427,7 +1427,7 @@ static int process_rcf(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_urq(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_urq(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, UnregistrationRequest *urq)
 {
@@ -1440,7 +1440,7 @@ static int process_urq(struct sk_buff **pskb, struct nf_conn *ct,
        set_sig_addr = rcu_dereference(set_sig_addr_hook);
        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(pskb, ct, ctinfo, data,
+                ret = set_sig_addr(skb, ct, ctinfo, data,
                                   urq->callSignalAddress.item,
                                   urq->callSignalAddress.count);
                if (ret < 0)
@@ -1453,13 +1453,13 @@ static int process_urq(struct sk_buff **pskb, struct nf_conn *ct,
        info->sig_port[!dir] = 0;
        /* Give it 30 seconds for UCF or URJ */
-        nf_ct_refresh(ct, *pskb, 30 * HZ);
+        nf_ct_refresh(ct, skb, 30 * HZ);
        return 0;
 }
 /****************************************************************************/
-static int process_arq(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, AdmissionRequest *arq)
 {
@@ -1479,7 +1479,7 @@ static int process_arq(struct sk_buff **pskb, struct nf_conn *ct,
            port == info->sig_port[dir] &&
            set_h225_addr && ct->status & IPS_NAT_MASK) {
                /* Answering ARQ */
-                return set_h225_addr(pskb, data, 0,
+                return set_h225_addr(skb, data, 0,
                                     &arq->destCallSignalAddress,
                                     &ct->tuplehash[!dir].tuple.dst.u3,
                                     info->sig_port[!dir]);
@@ -1491,7 +1491,7 @@ static int process_arq(struct sk_buff **pskb, struct nf_conn *ct,
            !memcmp(&addr, &ct->tuplehash[dir].tuple.src.u3, sizeof(addr)) &&
            set_h225_addr && ct->status & IPS_NAT_MASK) {
                /* Calling ARQ */
-                return set_h225_addr(pskb, data, 0,
+                return set_h225_addr(skb, data, 0,
                                     &arq->srcCallSignalAddress,
                                     &ct->tuplehash[!dir].tuple.dst.u3,
                                     port);
@@ -1501,7 +1501,7 @@ static int process_arq(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_acf(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_acf(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, AdmissionConfirm *acf)
 {
@@ -1522,7 +1522,7 @@ static int process_acf(struct sk_buff **pskb, struct nf_conn *ct,
                /* Answering ACF */
                set_sig_addr = rcu_dereference(set_sig_addr_hook);
                if (set_sig_addr && ct->status & IPS_NAT_MASK)
-                        return set_sig_addr(pskb, ct, ctinfo, data,
+                        return set_sig_addr(skb, ct, ctinfo, data,
                                            &acf->destCallSignalAddress, 1);
                return 0;
        }
@@ -1548,7 +1548,7 @@ static int process_acf(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_lrq(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_lrq(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, LocationRequest *lrq)
 {
@@ -1558,13 +1558,13 @@ static int process_lrq(struct sk_buff **pskb, struct nf_conn *ct,
        set_ras_addr = rcu_dereference(set_ras_addr_hook);
        if (set_ras_addr && ct->status & IPS_NAT_MASK)
-                return set_ras_addr(pskb, ct, ctinfo, data,
+                return set_ras_addr(skb, ct, ctinfo, data,
                                    &lrq->replyAddress, 1);
        return 0;
 }
 /****************************************************************************/
-static int process_lcf(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_lcf(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, LocationConfirm *lcf)
 {
@@ -1603,7 +1603,7 @@ static int process_lcf(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_irr(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_irr(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, InfoRequestResponse *irr)
 {
@@ -1615,7 +1615,7 @@ static int process_irr(struct sk_buff **pskb, struct nf_conn *ct,
        set_ras_addr = rcu_dereference(set_ras_addr_hook);
        if (set_ras_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_ras_addr(pskb, ct, ctinfo, data,
+                ret = set_ras_addr(skb, ct, ctinfo, data,
                                   &irr->rasAddress, 1);
                if (ret < 0)
                        return -1;
@@ -1623,7 +1623,7 @@ static int process_irr(struct sk_buff **pskb, struct nf_conn *ct,
        set_sig_addr = rcu_dereference(set_sig_addr_hook);
        if (set_sig_addr && ct->status & IPS_NAT_MASK) {
-                ret = set_sig_addr(pskb, ct, ctinfo, data,
+                ret = set_sig_addr(skb, ct, ctinfo, data,
                                        irr->callSignalAddress.item,
                                        irr->callSignalAddress.count);
                if (ret < 0)
@@ -1634,40 +1634,40 @@ static int process_irr(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int process_ras(struct sk_buff **pskb, struct nf_conn *ct,
+static int process_ras(struct sk_buff *skb, struct nf_conn *ct,
                       enum ip_conntrack_info ctinfo,
                       unsigned char **data, RasMessage *ras)
 {
        switch (ras->choice) {
        case eRasMessage_gatekeeperRequest:
-                return process_grq(pskb, ct, ctinfo, data,
+                return process_grq(skb, ct, ctinfo, data,
                                   &ras->gatekeeperRequest);
        case eRasMessage_gatekeeperConfirm:
-                return process_gcf(pskb, ct, ctinfo, data,
+                return process_gcf(skb, ct, ctinfo, data,
                                   &ras->gatekeeperConfirm);
        case eRasMessage_registrationRequest:
-                return process_rrq(pskb, ct, ctinfo, data,
+                return process_rrq(skb, ct, ctinfo, data,
                                   &ras->registrationRequest);
        case eRasMessage_registrationConfirm:
-                return process_rcf(pskb, ct, ctinfo, data,
+                return process_rcf(skb, ct, ctinfo, data,
                                   &ras->registrationConfirm);
        case eRasMessage_unregistrationRequest:
-                return process_urq(pskb, ct, ctinfo, data,
+                return process_urq(skb, ct, ctinfo, data,
                                   &ras->unregistrationRequest);
        case eRasMessage_admissionRequest:
-                return process_arq(pskb, ct, ctinfo, data,
+                return process_arq(skb, ct, ctinfo, data,
                                   &ras->admissionRequest);
        case eRasMessage_admissionConfirm:
-                return process_acf(pskb, ct, ctinfo, data,
+                return process_acf(skb, ct, ctinfo, data,
                                   &ras->admissionConfirm);
        case eRasMessage_locationRequest:
-                return process_lrq(pskb, ct, ctinfo, data,
+                return process_lrq(skb, ct, ctinfo, data,
                                   &ras->locationRequest);
        case eRasMessage_locationConfirm:
-                return process_lcf(pskb, ct, ctinfo, data,
+                return process_lcf(skb, ct, ctinfo, data,
                                   &ras->locationConfirm);
        case eRasMessage_infoRequestResponse:
-                return process_irr(pskb, ct, ctinfo, data,
+                return process_irr(skb, ct, ctinfo, data,
                                   &ras->infoRequestResponse);
        default:
                pr_debug("nf_ct_ras: RAS message %d\n", ras->choice);
@@ -1678,7 +1678,7 @@ static int process_ras(struct sk_buff **pskb, struct nf_conn *ct,
 }
 /****************************************************************************/
-static int ras_help(struct sk_buff **pskb, unsigned int protoff,
+static int ras_help(struct sk_buff *skb, unsigned int protoff,
                    struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
        static RasMessage ras;
@@ -1686,12 +1686,12 @@ static int ras_help(struct sk_buff **pskb, unsigned int protoff,
        int datalen = 0;
        int ret;
-        pr_debug("nf_ct_ras: skblen = %u\n", (*pskb)->len);
+        pr_debug("nf_ct_ras: skblen = %u\n", skb->len);
        spin_lock_bh(&nf_h323_lock);
        /* Get UDP data */
-        data = get_udp_data(pskb, protoff, &datalen);
+        data = get_udp_data(skb, protoff, &datalen);
        if (data == NULL)
                goto accept;
        pr_debug("nf_ct_ras: RAS message len=%d ", datalen);
@@ -1707,7 +1707,7 @@ static int ras_help(struct sk_buff **pskb, unsigned int protoff,
        }
        /* Process RAS message */
-        if (process_ras(pskb, ct, ctinfo, &data, &ras) < 0)
+        if (process_ras(skb, ct, ctinfo, &data, &ras) < 0)
                goto drop;
      accept:
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 1562ca97a349..dfaed4ba83cd 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -30,7 +30,7 @@ static unsigned int dcc_timeout __read_mostly = 300;
 static char *irc_buffer;
 static DEFINE_SPINLOCK(irc_buffer_lock);
-unsigned int (*nf_nat_irc_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_irc_hook)(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,
                                unsigned int matchoff,
                                unsigned int matchlen,
@@ -89,7 +89,7 @@ static int parse_dcc(char *data, char *data_end, u_int32_t *ip,
        return 0;
 }
-static int help(struct sk_buff **pskb, unsigned int protoff,
+static int help(struct sk_buff *skb, unsigned int protoff,
                struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
        unsigned int dataoff;
@@ -116,22 +116,22 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
                return NF_ACCEPT;
        /* Not a full tcp header? */
-        th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
        if (th == NULL)
                return NF_ACCEPT;
        /* No data? */
        dataoff = protoff + th->doff*4;
-        if (dataoff >= (*pskb)->len)
+        if (dataoff >= skb->len)
                return NF_ACCEPT;
        spin_lock_bh(&irc_buffer_lock);
-        ib_ptr = skb_header_pointer(*pskb, dataoff, (*pskb)->len - dataoff,
+        ib_ptr = skb_header_pointer(skb, dataoff, skb->len - dataoff,
                                    irc_buffer);
        BUG_ON(ib_ptr == NULL);
        data = ib_ptr;
-        data_limit = ib_ptr + (*pskb)->len - dataoff;
+        data_limit = ib_ptr + skb->len - dataoff;
        /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
         * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
@@ -143,7 +143,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
                data += 5;
                /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                pr_debug("DCC found in master %u.%u.%u.%u:%u %u.%u.%u.%u:%u\n",
                         NIPQUAD(iph->saddr), ntohs(th->source),
                         NIPQUAD(iph->daddr), ntohs(th->dest));
@@ -193,7 +193,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
                        nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
                        if (nf_nat_irc && ct->status & IPS_NAT_MASK)
-                                ret = nf_nat_irc(pskb, ctinfo,
+                                ret = nf_nat_irc(skb, ctinfo,
                                                 addr_beg_p - ib_ptr,
                                                 addr_end_p - addr_beg_p,
                                                 exp);
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index 1d59fabeb5f7..9810d81e2a06 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -42,17 +42,17 @@ static unsigned int timeout __read_mostly = 3;
 module_param(timeout, uint, 0400);
 MODULE_PARM_DESC(timeout, "timeout for master connection/replies in seconds");
-static int help(struct sk_buff **pskb, unsigned int protoff,
+static int help(struct sk_buff *skb, unsigned int protoff,
                struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
        struct nf_conntrack_expect *exp;
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
-        struct rtable *rt = (struct rtable *)(*pskb)->dst;
+        struct rtable *rt = (struct rtable *)skb->dst;
        struct in_device *in_dev;
        __be32 mask = 0;
        /* we're only interested in locally generated packets */
-        if ((*pskb)->sk == NULL)
+        if (skb->sk == NULL)
                goto out;
        if (rt == NULL || !(rt->rt_flags & RTCF_BROADCAST))
                goto out;
@@ -91,7 +91,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
        nf_ct_expect_related(exp);
        nf_ct_expect_put(exp);
-        nf_ct_refresh(ct, *pskb, timeout * HZ);
+        nf_ct_refresh(ct, skb, timeout * HZ);
 out:
        return NF_ACCEPT;
 }
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index b0804199ab59..099b6df3e2b5 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -41,14 +41,14 @@ MODULE_ALIAS("ip_conntrack_pptp");
 static DEFINE_SPINLOCK(nf_pptp_lock);
 int
-(*nf_nat_pptp_hook_outbound)(struct sk_buff **pskb,
+(*nf_nat_pptp_hook_outbound)(struct sk_buff *skb,
                             struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                             struct PptpControlHeader *ctlh,
                             union pptp_ctrl_union *pptpReq) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_outbound);
 int
-(*nf_nat_pptp_hook_inbound)(struct sk_buff **pskb,
+(*nf_nat_pptp_hook_inbound)(struct sk_buff *skb,
                            struct nf_conn *ct, enum ip_conntrack_info ctinfo,
                            struct PptpControlHeader *ctlh,
                            union pptp_ctrl_union *pptpReq) __read_mostly;
@@ -254,7 +254,7 @@ out_unexpect_orig:
 }
 static inline int
-pptp_inbound_pkt(struct sk_buff **pskb,
+pptp_inbound_pkt(struct sk_buff *skb,
                 struct PptpControlHeader *ctlh,
                 union pptp_ctrl_union *pptpReq,
                 unsigned int reqlen,
@@ -367,7 +367,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
        nf_nat_pptp_inbound = rcu_dereference(nf_nat_pptp_hook_inbound);
        if (nf_nat_pptp_inbound && ct->status & IPS_NAT_MASK)
-                return nf_nat_pptp_inbound(pskb, ct, ctinfo, ctlh, pptpReq);
+                return nf_nat_pptp_inbound(skb, ct, ctinfo, ctlh, pptpReq);
        return NF_ACCEPT;
 invalid:
@@ -380,7 +380,7 @@ invalid:
 }
 static inline int
-pptp_outbound_pkt(struct sk_buff **pskb,
+pptp_outbound_pkt(struct sk_buff *skb,
                  struct PptpControlHeader *ctlh,
                  union pptp_ctrl_union *pptpReq,
                  unsigned int reqlen,
@@ -462,7 +462,7 @@ pptp_outbound_pkt(struct sk_buff **pskb,
        nf_nat_pptp_outbound = rcu_dereference(nf_nat_pptp_hook_outbound);
        if (nf_nat_pptp_outbound && ct->status & IPS_NAT_MASK)
-                return nf_nat_pptp_outbound(pskb, ct, ctinfo, ctlh, pptpReq);
+                return nf_nat_pptp_outbound(skb, ct, ctinfo, ctlh, pptpReq);
        return NF_ACCEPT;
 invalid:
@@ -492,7 +492,7 @@ static const unsigned int pptp_msg_size[] = {
 /* track caller id inside control connection, call expect_related */
 static int
-conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
+conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,
                    struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 {
@@ -502,7 +502,7 @@ conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
        struct pptp_pkt_hdr _pptph, *pptph;
        struct PptpControlHeader _ctlh, *ctlh;
        union pptp_ctrl_union _pptpReq, *pptpReq;
-        unsigned int tcplen = (*pskb)->len - protoff;
+        unsigned int tcplen = skb->len - protoff;
        unsigned int datalen, reqlen, nexthdr_off;
        int oldsstate, oldcstate;
        int ret;
@@ -514,12 +514,12 @@ conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
                return NF_ACCEPT;
        nexthdr_off = protoff;
-        tcph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_tcph), &_tcph);
+        tcph = skb_header_pointer(skb, nexthdr_off, sizeof(_tcph), &_tcph);
        BUG_ON(!tcph);
        nexthdr_off += tcph->doff * 4;
        datalen = tcplen - tcph->doff * 4;
-        pptph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_pptph), &_pptph);
+        pptph = skb_header_pointer(skb, nexthdr_off, sizeof(_pptph), &_pptph);
        if (!pptph) {
                pr_debug("no full PPTP header, can't track\n");
                return NF_ACCEPT;
@@ -534,7 +534,7 @@ conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
                return NF_ACCEPT;
        }
-        ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
+        ctlh = skb_header_pointer(skb, nexthdr_off, sizeof(_ctlh), &_ctlh);
        if (!ctlh)
                return NF_ACCEPT;
        nexthdr_off += sizeof(_ctlh);
@@ -547,7 +547,7 @@ conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
        if (reqlen > sizeof(*pptpReq))
                reqlen = sizeof(*pptpReq);
-        pptpReq = skb_header_pointer(*pskb, nexthdr_off, reqlen, &_pptpReq);
+        pptpReq = skb_header_pointer(skb, nexthdr_off, reqlen, &_pptpReq);
        if (!pptpReq)
                return NF_ACCEPT;
@@ -560,11 +560,11 @@ conntrack_pptp_help(struct sk_buff **pskb, unsigned int protoff,
         * established from PNS->PAC.  However, RFC makes no guarantee */
        if (dir == IP_CT_DIR_ORIGINAL)
                /* client -> server (PNS -> PAC) */
-                ret = pptp_outbound_pkt(pskb, ctlh, pptpReq, reqlen, ct,
+                ret = pptp_outbound_pkt(skb, ctlh, pptpReq, reqlen, ct,
                                        ctinfo);
        else
                /* server -> client (PAC -> PNS) */
-                ret = pptp_inbound_pkt(pskb, ctlh, pptpReq, reqlen, ct,
+                ret = pptp_inbound_pkt(skb, ctlh, pptpReq, reqlen, ct,
                                       ctinfo);
        pr_debug("sstate: %d->%d, cstate: %d->%d\n",
                 oldsstate, info->sstate, oldcstate, info->cstate);
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index 355d371bac93..b5a16c6e21c2 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -56,7 +56,7 @@ struct sane_reply_net_start {
        /* other fields aren't interesting for conntrack */
 };
-static int help(struct sk_buff **pskb,
+static int help(struct sk_buff *skb,
                unsigned int protoff,
                struct nf_conn *ct,
                enum ip_conntrack_info ctinfo)
@@ -80,19 +80,19 @@ static int help(struct sk_buff **pskb,
                return NF_ACCEPT;
        /* Not a full tcp header? */
-        th = skb_header_pointer(*pskb, protoff, sizeof(_tcph), &_tcph);
+        th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
        if (th == NULL)
                return NF_ACCEPT;
        /* No data? */
        dataoff = protoff + th->doff * 4;
-        if (dataoff >= (*pskb)->len)
+        if (dataoff >= skb->len)
                return NF_ACCEPT;
-        datalen = (*pskb)->len - dataoff;
+        datalen = skb->len - dataoff;
        spin_lock_bh(&nf_sane_lock);
-        sb_ptr = skb_header_pointer(*pskb, dataoff, datalen, sane_buffer);
+        sb_ptr = skb_header_pointer(skb, dataoff, datalen, sane_buffer);
        BUG_ON(sb_ptr == NULL);
        if (dir == IP_CT_DIR_ORIGINAL) {
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index d449fa47491c..8f8b5a48df38 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -36,13 +36,13 @@ static unsigned int sip_timeout __read_mostly = SIP_TIMEOUT;
 module_param(sip_timeout, uint, 0600);
 MODULE_PARM_DESC(sip_timeout, "timeout for the master SIP session");
-unsigned int (*nf_nat_sip_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_sip_hook)(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,
                                struct nf_conn *ct,
                                const char **dptr) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sip_hook);
-unsigned int (*nf_nat_sdp_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
                                enum ip_conntrack_info ctinfo,
                                struct nf_conntrack_expect *exp,
                                const char *dptr) __read_mostly;
@@ -363,7 +363,7 @@ int ct_sip_get_info(struct nf_conn *ct,
 }
 EXPORT_SYMBOL_GPL(ct_sip_get_info);
-static int set_expected_rtp(struct sk_buff **pskb,
+static int set_expected_rtp(struct sk_buff *skb,
                            struct nf_conn *ct,
                            enum ip_conntrack_info ctinfo,
                            union nf_conntrack_address *addr,
@@ -385,7 +385,7 @@ static int set_expected_rtp(struct sk_buff **pskb,
        nf_nat_sdp = rcu_dereference(nf_nat_sdp_hook);
        if (nf_nat_sdp && ct->status & IPS_NAT_MASK)
-                ret = nf_nat_sdp(pskb, ctinfo, exp, dptr);
+                ret = nf_nat_sdp(skb, ctinfo, exp, dptr);
        else {
                if (nf_ct_expect_related(exp) != 0)
                        ret = NF_DROP;
@@ -397,7 +397,7 @@ static int set_expected_rtp(struct sk_buff **pskb,
        return ret;
 }
-static int sip_help(struct sk_buff **pskb,
+static int sip_help(struct sk_buff *skb,
                    unsigned int protoff,
                    struct nf_conn *ct,
                    enum ip_conntrack_info ctinfo)
@@ -414,13 +414,13 @@ static int sip_help(struct sk_buff **pskb,
        /* No Data ? */
        dataoff = protoff + sizeof(struct udphdr);
-        if (dataoff >= (*pskb)->len)
+        if (dataoff >= skb->len)
                return NF_ACCEPT;
-        nf_ct_refresh(ct, *pskb, sip_timeout * HZ);
+        nf_ct_refresh(ct, skb, sip_timeout * HZ);
-        if (!skb_is_nonlinear(*pskb))
+        if (!skb_is_nonlinear(skb))
-                dptr = (*pskb)->data + dataoff;
+                dptr = skb->data + dataoff;
        else {
                pr_debug("Copy of skbuff not supported yet.\n");
                goto out;
@@ -428,13 +428,13 @@ static int sip_help(struct sk_buff **pskb,
        nf_nat_sip = rcu_dereference(nf_nat_sip_hook);
        if (nf_nat_sip && ct->status & IPS_NAT_MASK) {
-                if (!nf_nat_sip(pskb, ctinfo, ct, &dptr)) {
+                if (!nf_nat_sip(skb, ctinfo, ct, &dptr)) {
                        ret = NF_DROP;
                        goto out;
                }
        }
-        datalen = (*pskb)->len - dataoff;
+        datalen = skb->len - dataoff;
        if (datalen < sizeof("SIP/2.0 200") - 1)
                goto out;
@@ -464,7 +464,7 @@ static int sip_help(struct sk_buff **pskb,
                                ret = NF_DROP;
                                goto out;
                        }
-                        ret = set_expected_rtp(pskb, ct, ctinfo, &addr,
+                        ret = set_expected_rtp(skb, ct, ctinfo, &addr,
                                               htons(port), dptr);
                }
        }
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index cc19506cf2f8..e894aa1ff3ad 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -29,12 +29,12 @@ static int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
-unsigned int (*nf_nat_tftp_hook)(struct sk_buff **pskb,
+unsigned int (*nf_nat_tftp_hook)(struct sk_buff *skb,
                                 enum ip_conntrack_info ctinfo,
                                 struct nf_conntrack_expect *exp) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_tftp_hook);
-static int tftp_help(struct sk_buff **pskb,
+static int tftp_help(struct sk_buff *skb,
                     unsigned int protoff,
                     struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo)
@@ -46,7 +46,7 @@ static int tftp_help(struct sk_buff **pskb,
        int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
        typeof(nf_nat_tftp_hook) nf_nat_tftp;
-        tfh = skb_header_pointer(*pskb, protoff + sizeof(struct udphdr),
+        tfh = skb_header_pointer(skb, protoff + sizeof(struct udphdr),
                                 sizeof(_tftph), &_tftph);
        if (tfh == NULL)
                return NF_ACCEPT;
@@ -70,7 +70,7 @@ static int tftp_help(struct sk_buff **pskb,
                nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
                if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
-                        ret = nf_nat_tftp(pskb, ctinfo, exp);
+                        ret = nf_nat_tftp(skb, ctinfo, exp);
                else if (nf_ct_expect_related(exp) != 0)
                        ret = NF_DROP;
                nf_ct_expect_put(exp);
diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
index 0df7fff196a7..196269c1e586 100644
--- a/net/netfilter/nf_internals.h
+++ b/net/netfilter/nf_internals.h
@@ -14,7 +14,7 @@
 /* core.c */
 extern unsigned int nf_iterate(struct list_head *head,
-                                struct sk_buff **skb,
+                                struct sk_buff *skb,
                                int hook,
                                const struct net_device *indev,
                                const struct net_device *outdev,
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index a481a349f7bf..0cef1433d660 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -256,14 +256,14 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
        if (verdict == NF_ACCEPT) {
                afinfo = nf_get_afinfo(info->pf);
-                if (!afinfo || afinfo->reroute(&skb, info) < 0)
+                if (!afinfo || afinfo->reroute(skb, info) < 0)
                        verdict = NF_DROP;
        }
        if (verdict == NF_ACCEPT) {
        next_hook:
                verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
-                                     &skb, info->hook,
+                                     skb, info->hook,
                                     info->indev, info->outdev, &elem,
                                     info->okfn, INT_MIN);
        }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 49f0480afe09..3ceeffcf6f9d 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -617,6 +617,7 @@ static int
 nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
 {
        int diff;
+        int err;
        diff = data_len - e->skb->len;
        if (diff < 0) {
@@ -626,25 +627,18 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
                if (data_len > 0xFFFF)
                        return -EINVAL;
                if (diff > skb_tailroom(e->skb)) {
-                        struct sk_buff *newskb;
+                        err = pskb_expand_head(e->skb, 0,
+                                               diff - skb_tailroom(e->skb),
-                        newskb = skb_copy_expand(e->skb,
+                                               GFP_ATOMIC);
-                                                 skb_headroom(e->skb),
+                        if (err) {
-                                                 diff,
-                                                 GFP_ATOMIC);
-                        if (newskb == NULL) {
                                printk(KERN_WARNING "nf_queue: OOM "
                                      "in mangle, dropping packet\n");
-                                return -ENOMEM;
+                                return err;
                        }
-                        if (e->skb->sk)
-                                skb_set_owner_w(newskb, e->skb->sk);
-                        kfree_skb(e->skb);
-                        e->skb = newskb;
                }
                skb_put(e->skb, diff);
        }
-        if (!skb_make_writable(&e->skb, data_len))
+        if (!skb_make_writable(e->skb, data_len))
                return -ENOMEM;
        skb_copy_to_linear_data(e->skb, data, data_len);
        e->skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/netfilter/xt_CLASSIFY.c b/net/netfilter/xt_CLASSIFY.c
index 07a1b9665005..77eeae658d42 100644
--- a/net/netfilter/xt_CLASSIFY.c
+++ b/net/netfilter/xt_CLASSIFY.c
@@ -27,7 +27,7 @@ MODULE_ALIAS("ipt_CLASSIFY");
 MODULE_ALIAS("ip6t_CLASSIFY");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -36,7 +36,7 @@ target(struct sk_buff **pskb,
 {
        const struct xt_classify_target_info *clinfo = targinfo;
-        (*pskb)->priority = clinfo->priority;
+        skb->priority = clinfo->priority;
        return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_CONNMARK.c b/net/netfilter/xt_CONNMARK.c
index 7043c2757e09..8cc324b159e9 100644
--- a/net/netfilter/xt_CONNMARK.c
+++ b/net/netfilter/xt_CONNMARK.c
@@ -34,7 +34,7 @@ MODULE_ALIAS("ip6t_CONNMARK");
 #include <net/netfilter/nf_conntrack_ecache.h>
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -48,28 +48,28 @@ target(struct sk_buff **pskb,
        u_int32_t mark;
        u_int32_t newmark;
-        ct = nf_ct_get(*pskb, &ctinfo);
+        ct = nf_ct_get(skb, &ctinfo);
        if (ct) {
                switch(markinfo->mode) {
                case XT_CONNMARK_SET:
                        newmark = (ct->mark & ~markinfo->mask) | markinfo->mark;
                        if (newmark != ct->mark) {
                                ct->mark = newmark;
-                                nf_conntrack_event_cache(IPCT_MARK, *pskb);
+                                nf_conntrack_event_cache(IPCT_MARK, skb);
                        }
                        break;
                case XT_CONNMARK_SAVE:
                        newmark = (ct->mark & ~markinfo->mask) |
-                                  ((*pskb)->mark & markinfo->mask);
+                                  (skb->mark & markinfo->mask);
                        if (ct->mark != newmark) {
                                ct->mark = newmark;
-                                nf_conntrack_event_cache(IPCT_MARK, *pskb);
+                                nf_conntrack_event_cache(IPCT_MARK, skb);
                        }
                        break;
                case XT_CONNMARK_RESTORE:
-                        mark = (*pskb)->mark;
+                        mark = skb->mark;
                        diff = (ct->mark ^ mark) & markinfo->mask;
-                        (*pskb)->mark = mark ^ diff;
+                        skb->mark = mark ^ diff;
                        break;
                }
        }
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 63d73138c1b9..021b5c8d20e2 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -61,12 +61,11 @@ static void secmark_restore(struct sk_buff *skb)
        }
 }
-static unsigned int target(struct sk_buff **pskb, const struct net_device *in,
+static unsigned int target(struct sk_buff *skb, const struct net_device *in,
                           const struct net_device *out, unsigned int hooknum,
                           const struct xt_target *target,
                           const void *targinfo)
 {
-        struct sk_buff *skb = *pskb;
        const struct xt_connsecmark_target_info *info = targinfo;
        switch (info->mode) {
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 798ab731009d..6322a933ab71 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -25,7 +25,7 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_DSCP");
 MODULE_ALIAS("ip6t_DSCP");
-static unsigned int target(struct sk_buff **pskb,
+static unsigned int target(struct sk_buff *skb,
                           const struct net_device *in,
                           const struct net_device *out,
                           unsigned int hooknum,
@@ -33,20 +33,20 @@ static unsigned int target(struct sk_buff **pskb,
                           const void *targinfo)
 {
        const struct xt_DSCP_info *dinfo = targinfo;
-        u_int8_t dscp = ipv4_get_dsfield(ip_hdr(*pskb)) >> XT_DSCP_SHIFT;
+        u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
        if (dscp != dinfo->dscp) {
-                if (!skb_make_writable(pskb, sizeof(struct iphdr)))
+                if (!skb_make_writable(skb, sizeof(struct iphdr)))
                        return NF_DROP;
-                ipv4_change_dsfield(ip_hdr(*pskb), (__u8)(~XT_DSCP_MASK),
+                ipv4_change_dsfield(ip_hdr(skb), (__u8)(~XT_DSCP_MASK),
                                    dinfo->dscp << XT_DSCP_SHIFT);
        }
        return XT_CONTINUE;
 }
-static unsigned int target6(struct sk_buff **pskb,
+static unsigned int target6(struct sk_buff *skb,
                            const struct net_device *in,
                            const struct net_device *out,
                            unsigned int hooknum,
@@ -54,13 +54,13 @@ static unsigned int target6(struct sk_buff **pskb,
                            const void *targinfo)
 {
        const struct xt_DSCP_info *dinfo = targinfo;
-        u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(*pskb)) >> XT_DSCP_SHIFT;
+        u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
        if (dscp != dinfo->dscp) {
-                if (!skb_make_writable(pskb, sizeof(struct ipv6hdr)))
+                if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
                        return NF_DROP;
-                ipv6_change_dsfield(ipv6_hdr(*pskb), (__u8)(~XT_DSCP_MASK),
+                ipv6_change_dsfield(ipv6_hdr(skb), (__u8)(~XT_DSCP_MASK),
                                    dinfo->dscp << XT_DSCP_SHIFT);
        }
        return XT_CONTINUE;
diff --git a/net/netfilter/xt_MARK.c b/net/netfilter/xt_MARK.c
index f30fe0baf7de..bc6503d77d75 100644
--- a/net/netfilter/xt_MARK.c
+++ b/net/netfilter/xt_MARK.c
@@ -22,7 +22,7 @@ MODULE_ALIAS("ipt_MARK");
 MODULE_ALIAS("ip6t_MARK");
 static unsigned int
-target_v0(struct sk_buff **pskb,
+target_v0(struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          unsigned int hooknum,
@@ -31,12 +31,12 @@ target_v0(struct sk_buff **pskb,
 {
        const struct xt_mark_target_info *markinfo = targinfo;
-        (*pskb)->mark = markinfo->mark;
+        skb->mark = markinfo->mark;
        return XT_CONTINUE;
 }
 static unsigned int
-target_v1(struct sk_buff **pskb,
+target_v1(struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
          unsigned int hooknum,
@@ -52,15 +52,15 @@ target_v1(struct sk_buff **pskb,
                break;
        case XT_MARK_AND:
-                mark = (*pskb)->mark & markinfo->mark;
+                mark = skb->mark & markinfo->mark;
                break;
        case XT_MARK_OR:
-                mark = (*pskb)->mark | markinfo->mark;
+                mark = skb->mark | markinfo->mark;
                break;
        }
-        (*pskb)->mark = mark;
+        skb->mark = mark;
        return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index d3594c7ccb26..9fb449ffbf8b 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -20,7 +20,7 @@ MODULE_ALIAS("ipt_NFLOG");
 MODULE_ALIAS("ip6t_NFLOG");
 static unsigned int
-nflog_target(struct sk_buff **pskb,
+nflog_target(struct sk_buff *skb,
             const struct net_device *in, const struct net_device *out,
             unsigned int hooknum, const struct xt_target *target,
             const void *targinfo)
@@ -33,7 +33,7 @@ nflog_target(struct sk_buff **pskb,
        li.u.ulog.group      = info->group;
        li.u.ulog.qthreshold = info->threshold;
-        nf_log_packet(target->family, hooknum, *pskb, in, out, &li,
+        nf_log_packet(target->family, hooknum, skb, in, out, &li,
                      "%s", info->prefix);
        return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 13f59f3e8c38..c3984e9f766a 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -24,7 +24,7 @@ MODULE_ALIAS("ip6t_NFQUEUE");
 MODULE_ALIAS("arpt_NFQUEUE");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
diff --git a/net/netfilter/xt_NOTRACK.c b/net/netfilter/xt_NOTRACK.c
index fec1aefb1c32..4976ce186615 100644
--- a/net/netfilter/xt_NOTRACK.c
+++ b/net/netfilter/xt_NOTRACK.c
@@ -12,7 +12,7 @@ MODULE_ALIAS("ipt_NOTRACK");
 MODULE_ALIAS("ip6t_NOTRACK");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
@@ -20,16 +20,16 @@ target(struct sk_buff **pskb,
       const void *targinfo)
 {
        /* Previously seen (loopback)? Ignore. */
-        if ((*pskb)->nfct != NULL)
+        if (skb->nfct != NULL)
                return XT_CONTINUE;
        /* Attach fake conntrack entry.
           If there is a real ct entry correspondig to this packet,
           it'll hang aroun till timing out. We don't deal with it
           for performance reasons. JK */
-        (*pskb)->nfct = &nf_conntrack_untracked.ct_general;
+        skb->nfct = &nf_conntrack_untracked.ct_general;
-        (*pskb)->nfctinfo = IP_CT_NEW;
+        skb->nfctinfo = IP_CT_NEW;
-        nf_conntrack_get((*pskb)->nfct);
+        nf_conntrack_get(skb->nfct);
        return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index c83779a941a1..235806eb6ecd 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -28,7 +28,7 @@ MODULE_ALIAS("ip6t_SECMARK");
 static u8 mode;
-static unsigned int target(struct sk_buff **pskb, const struct net_device *in,
+static unsigned int target(struct sk_buff *skb, const struct net_device *in,
                           const struct net_device *out, unsigned int hooknum,
                           const struct xt_target *target,
                           const void *targinfo)
@@ -47,7 +47,7 @@ static unsigned int target(struct sk_buff **pskb, const struct net_device *in,
                BUG();
        }
-        (*pskb)->secmark = secmark;
+        skb->secmark = secmark;
        return XT_CONTINUE;
 }
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index d40f7e4b1289..07435a602b11 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -39,7 +39,7 @@ optlen(const u_int8_t *opt, unsigned int offset)
 }
 static int
-tcpmss_mangle_packet(struct sk_buff **pskb,
+tcpmss_mangle_packet(struct sk_buff *skb,
                     const struct xt_tcpmss_info *info,
                     unsigned int tcphoff,
                     unsigned int minlen)
@@ -50,11 +50,11 @@ tcpmss_mangle_packet(struct sk_buff **pskb,
        u16 newmss;
        u8 *opt;
-        if (!skb_make_writable(pskb, (*pskb)->len))
+        if (!skb_make_writable(skb, skb->len))
                return -1;
-        tcplen = (*pskb)->len - tcphoff;
+        tcplen = skb->len - tcphoff;
-        tcph = (struct tcphdr *)(skb_network_header(*pskb) + tcphoff);
+        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
        /* Since it passed flags test in tcp match, we know it is is
           not a fragment, and has data >= tcp header length.  SYN
@@ -64,19 +64,19 @@ tcpmss_mangle_packet(struct sk_buff **pskb,
        if (tcplen != tcph->doff*4) {
                if (net_ratelimit())
                        printk(KERN_ERR "xt_TCPMSS: bad length (%u bytes)\n",
-                               (*pskb)->len);
+                               skb->len);
                return -1;
        }
        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
-                if (dst_mtu((*pskb)->dst) <= minlen) {
+                if (dst_mtu(skb->dst) <= minlen) {
                        if (net_ratelimit())
                                printk(KERN_ERR "xt_TCPMSS: "
                                       "unknown or invalid path-MTU (%u)\n",
-                                       dst_mtu((*pskb)->dst));
+                                       dst_mtu(skb->dst));
                        return -1;
                }
-                newmss = dst_mtu((*pskb)->dst) - minlen;
+                newmss = dst_mtu(skb->dst) - minlen;
        } else
                newmss = info->mss;
@@ -95,7 +95,7 @@ tcpmss_mangle_packet(struct sk_buff **pskb,
                        opt[i+2] = (newmss & 0xff00) >> 8;
                        opt[i+3] = newmss & 0x00ff;
-                        nf_proto_csum_replace2(&tcph->check, *pskb,
+                        nf_proto_csum_replace2(&tcph->check, skb,
                                               htons(oldmss), htons(newmss), 0);
                        return 0;
                }
@@ -104,57 +104,53 @@ tcpmss_mangle_packet(struct sk_buff **pskb,
        /*
         * MSS Option not found ?! add it..
         */
-        if (skb_tailroom((*pskb)) < TCPOLEN_MSS) {
+        if (skb_tailroom(skb) < TCPOLEN_MSS) {
-                struct sk_buff *newskb;
+                if (pskb_expand_head(skb, 0,
+                                     TCPOLEN_MSS - skb_tailroom(skb),
-                newskb = skb_copy_expand(*pskb, skb_headroom(*pskb),
+                                     GFP_ATOMIC))
-                                         TCPOLEN_MSS, GFP_ATOMIC);
-                if (!newskb)
                        return -1;
-                kfree_skb(*pskb);
+                tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
-                *pskb = newskb;
-                tcph = (struct tcphdr *)(skb_network_header(*pskb) + tcphoff);
        }
-        skb_put((*pskb), TCPOLEN_MSS);
+        skb_put(skb, TCPOLEN_MSS);
        opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
        memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
-        nf_proto_csum_replace2(&tcph->check, *pskb,
+        nf_proto_csum_replace2(&tcph->check, skb,
                               htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
        opt[0] = TCPOPT_MSS;
        opt[1] = TCPOLEN_MSS;
        opt[2] = (newmss & 0xff00) >> 8;
        opt[3] = newmss & 0x00ff;
-        nf_proto_csum_replace4(&tcph->check, *pskb, 0, *((__be32 *)opt), 0);
+        nf_proto_csum_replace4(&tcph->check, skb, 0, *((__be32 *)opt), 0);
        oldval = ((__be16 *)tcph)[6];
        tcph->doff += TCPOLEN_MSS/4;
-        nf_proto_csum_replace2(&tcph->check, *pskb,
+        nf_proto_csum_replace2(&tcph->check, skb,
                                oldval, ((__be16 *)tcph)[6], 0);
        return TCPOLEN_MSS;
 }
 static unsigned int
-xt_tcpmss_target4(struct sk_buff **pskb,
+xt_tcpmss_target4(struct sk_buff *skb,
                  const struct net_device *in,
                  const struct net_device *out,
                  unsigned int hooknum,
                  const struct xt_target *target,
                  const void *targinfo)
 {
-        struct iphdr *iph = ip_hdr(*pskb);
+        struct iphdr *iph = ip_hdr(skb);
        __be16 newlen;
        int ret;
-        ret = tcpmss_mangle_packet(pskb, targinfo, iph->ihl * 4,
+        ret = tcpmss_mangle_packet(skb, targinfo, iph->ihl * 4,
                                   sizeof(*iph) + sizeof(struct tcphdr));
        if (ret < 0)
                return NF_DROP;
        if (ret > 0) {
-                iph = ip_hdr(*pskb);
+                iph = ip_hdr(skb);
                newlen = htons(ntohs(iph->tot_len) + ret);
                nf_csum_replace2(&iph->check, iph->tot_len, newlen);
                iph->tot_len = newlen;
@@ -164,30 +160,30 @@ xt_tcpmss_target4(struct sk_buff **pskb,
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 static unsigned int
-xt_tcpmss_target6(struct sk_buff **pskb,
+xt_tcpmss_target6(struct sk_buff *skb,
                  const struct net_device *in,
                  const struct net_device *out,
                  unsigned int hooknum,
                  const struct xt_target *target,
                  const void *targinfo)
 {
-        struct ipv6hdr *ipv6h = ipv6_hdr(*pskb);
+        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
        u8 nexthdr;
        int tcphoff;
        int ret;
        nexthdr = ipv6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(*pskb, sizeof(*ipv6h), &nexthdr);
+        tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
        if (tcphoff < 0) {
                WARN_ON(1);
                return NF_DROP;
        }
-        ret = tcpmss_mangle_packet(pskb, targinfo, tcphoff,
+        ret = tcpmss_mangle_packet(skb, targinfo, tcphoff,
                                   sizeof(*ipv6h) + sizeof(struct tcphdr));
        if (ret < 0)
                return NF_DROP;
        if (ret > 0) {
-                ipv6h = ipv6_hdr(*pskb);
+                ipv6h = ipv6_hdr(skb);
                ipv6h->payload_len = htons(ntohs(ipv6h->payload_len) + ret);
        }
        return XT_CONTINUE;
diff --git a/net/netfilter/xt_TRACE.c b/net/netfilter/xt_TRACE.c
index 4df2dedcc0b5..26c5d08ab2c2 100644
--- a/net/netfilter/xt_TRACE.c
+++ b/net/netfilter/xt_TRACE.c
@@ -10,14 +10,14 @@ MODULE_ALIAS("ipt_TRACE");
 MODULE_ALIAS("ip6t_TRACE");
 static unsigned int
-target(struct sk_buff **pskb,
+target(struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
       unsigned int hooknum,
       const struct xt_target *target,
       const void *targinfo)
 {
-        (*pskb)->nf_trace = 1;
+        skb->nf_trace = 1;
        return XT_CONTINUE;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c776bcd9f825..98e313e5e594 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1378,6 +1378,8 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
                nl_table[unit].cb_mutex = cb_mutex;
                nl_table[unit].module = module;
                nl_table[unit].registered = 1;
+        } else {
+                kfree(listeners);
        }
        netlink_table_ungrab();
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6b407ece953c..fa006e06ce33 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -202,11 +202,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
        /* yes, we have to worry about both in and out dev
         worry later - danger - this API seems to have changed
         from earlier kernels */
+        ret = ipt->tcfi_t->u.kernel.target->target(skb, skb->dev, NULL,
-        /* iptables targets take a double skb pointer in case the skb
-         * needs to be replaced. We don't own the skb, so this must not
-         * happen. The pskb_expand_head above should make sure of this */
-        ret = ipt->tcfi_t->u.kernel.target->target(&skb, skb->dev, NULL,
                                                   ipt->tcfi_hook,
                                                   ipt->tcfi_t->u.kernel.target,
                                                   ipt->tcfi_t->data);
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 2d32fd27496e..3f8335e6ea2e 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -205,20 +205,19 @@ static unsigned int ingress_drop(struct Qdisc *sch)
 #ifndef CONFIG_NET_CLS_ACT
 #ifdef CONFIG_NETFILTER
 static unsigned int
-ing_hook(unsigned int hook, struct sk_buff **pskb,
+ing_hook(unsigned int hook, struct sk_buff *skb,
                             const struct net_device *indev,
                             const struct net_device *outdev,
                             int (*okfn)(struct sk_buff *))
 {
        struct Qdisc *q;
-        struct sk_buff *skb = *pskb;
        struct net_device *dev = skb->dev;
        int fwres=NF_ACCEPT;
        DPRINTK("ing_hook: skb %s dev=%s len=%u\n",
                skb->sk ? "(owned)" : "(unowned)",
-                skb->dev ? (*pskb)->dev->name : "(no dev)",
+                skb->dev ? skb->dev->name : "(no dev)",
                skb->len);
        if (dev->qdisc_ingress) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 9de3ddaa2768..eb4deaf58914 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -954,9 +954,9 @@ static struct inet_protosw sctpv6_stream_protosw = {
        .flags         = SCTP_PROTOSW_FLAG,
 };
-static int sctp6_rcv(struct sk_buff **pskb)
+static int sctp6_rcv(struct sk_buff *skb)
 {
-        return sctp_rcv(*pskb) ? -1 : 0;
+        return sctp_rcv(skb) ? -1 : 0;
 }
 static struct inet6_protocol sctpv6_protocol = {
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3c3fff33d1ce..cf76150e623e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3932,7 +3932,7 @@ out:
 }
 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
-                                              struct sk_buff **pskb,
+                                              struct sk_buff *skb,
                                              const struct net_device *in,
                                              const struct net_device *out,
                                              int (*okfn)(struct sk_buff *),
@@ -3941,7 +3941,6 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
        char *addrp;
        int len, err = 0;
        struct sock *sk;
-        struct sk_buff *skb = *pskb;
        struct avc_audit_data ad;
        struct net_device *dev = (struct net_device *)out;
        struct sk_security_struct *sksec;
@@ -3977,23 +3976,23 @@ out:
 }
 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
-                                                struct sk_buff **pskb,
+                                                struct sk_buff *skb,
                                                const struct net_device *in,
                                                const struct net_device *out,
                                                int (*okfn)(struct sk_buff *))
 {
-        return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
+        return selinux_ip_postroute_last(hooknum, skb, in, out, okfn, PF_INET);
 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
-                                                struct sk_buff **pskb,
+                                                struct sk_buff *skb,
                                                const struct net_device *in,
                                                const struct net_device *out,
                                                int (*okfn)(struct sk_buff *))
 {
-        return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
+        return selinux_ip_postroute_last(hooknum, skb, in, out, okfn, PF_INET6);
 }
 #endif  /* IPV6 */
author	Linus Torvalds <torvalds@woody.linux-foundation.org>	2007-10-15 17:06:58 -0400
committer	Linus Torvalds <torvalds@woody.linux-foundation.org>	2007-10-15 17:06:58 -0400
commit	a52cefc80fc92981592c688d1c8067442afe4cec (patch)
tree	ad119b5a4f5e4a257779c0ef324b5c9354c915f1
parent	fba956c46a72f9e7503fd464ffee43c632307e31 (diff)
parent	4acad72ded8e3f0211bd2a762e23c28229c61a51 (diff)