[SK_BUFF]: Convert skb->tail to sk_buff_data_t

So that it is also an offset from skb->head, reduces its size from 8 to 4 bytes
on 64bit architectures, allowing us to combine the 4 bytes hole left by the
layer headers conversion, reducing struct sk_buff size to 256 bytes, i.e. 4
64byte cachelines, and since the sk_buff slab cache is SLAB_HWCACHE_ALIGN...
:-)

Many calculations that previously required that skb->{transport,network,
mac}_header be first converted to a pointer now can be done directly, being
meaningful as offsets or pointers.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

76 files changed, 257 insertions, 241 deletions

diff --git a/net/atm/lec.c b/net/atm/lec.c
index d339645dc796..a8c6b285e06c 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -283,7 +283,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         DPRINTK("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
-                (long)skb->head, (long)skb->data, (long)skb->tail,
+                (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
                 (long)skb->end);
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
         if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94f457360560..10cc13cfae6c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1567,7 +1567,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
 
         /* Trim FCS */
         skb->len--; skb->tail--;
-        fcs = *(u8 *) skb->tail;
+        fcs = *(u8 *)skb_tail_pointer(skb);
 
         if (__check_fcs(skb->data, type, fcs)) {
                 BT_ERR("bad checksum in packet");
diff --git a/net/core/dev.c b/net/core/dev.c
index 6562e5736e2f..86dc9f693f66 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1069,7 +1069,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
                         skb_reset_mac_header(skb2);
 
                         if (skb_network_header(skb2) < skb2->data ||
-                            skb_network_header(skb2) > skb2->tail) {
+                            skb2->network_header > skb2->tail) {
                                 if (net_ratelimit())
                                         printk(KERN_CRIT "protocol %04x is "
                                                "buggy, dev %s\n",
@@ -1175,7 +1175,7 @@ int skb_checksum_help(struct sk_buff *skb)
         BUG_ON(offset > (int)skb->len);
         csum = skb_checksum(skb, offset, skb->len-offset, 0);
 
-        offset = skb->tail - skb_transport_header(skb);
+        offset = skb->tail - skb->transport_header;
         BUG_ON(offset <= 0);
         BUG_ON(skb->csum_offset + 2 > offset);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index d2358a5e6339..bd903aaf7aa7 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -46,7 +46,7 @@ static void *__load_pointer(struct sk_buff *skb, int k)
         else if (k >= SKF_LL_OFF)
                 ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
 
-        if (ptr >= skb->head && ptr < skb->tail)
+        if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
                 return ptr;
         return NULL;
 }
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 259473d0559d..bcc25591d8ac 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -61,7 +61,7 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
         spin_lock_bh(lock);
         d->lock = lock;
         if (type)
-                d->tail = (struct rtattr *) skb->tail;
+                d->tail = (struct rtattr *)skb_tail_pointer(skb);
         d->skb = skb;
         d->compat_tc_stats = tc_stats_type;
         d->compat_xstats = xstats_type;
@@ -212,7 +212,7 @@ int
 gnet_stats_finish_copy(struct gnet_dump *d)
 {
         if (d->tail)
-                d->tail->rta_len = d->skb->tail - (u8 *) d->tail;
+                d->tail->rta_len = skb_tail_pointer(d->skb) - (u8 *)d->tail;
 
         if (d->compat_tc_stats)
                 if (gnet_stats_copy(d, d->compat_tc_stats, &d->tc_stats,
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 9da8357addcd..f9469ea530cc 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2357,7 +2357,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                 *vlan_encapsulated_proto = htons(ETH_P_IP);
         }
 
-        skb_set_network_header(skb, skb->tail - skb->data);
+        skb->network_header = skb->tail;
         skb->transport_header = skb->network_header + sizeof(struct iphdr);
         skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr));
 
@@ -2696,7 +2696,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 *vlan_encapsulated_proto = htons(ETH_P_IPV6);
         }
 
-        skb_set_network_header(skb, skb->tail - skb->data);
+        skb->network_header = skb->tail;
         skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
         skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr));
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a48b08681261..ddcbc4d10dab 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -87,8 +87,9 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
 void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 {
         printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p "
-                          "data:%p tail:%p end:%p dev:%s\n",
-               here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end,
+                          "data:%p tail:%#lx end:%p dev:%s\n",
+               here, skb->len, sz, skb->head, skb->data,
+               (unsigned long)skb->tail, skb->end,
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
@@ -105,8 +106,9 @@ void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 {
         printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
-                          "data:%p tail:%p end:%p dev:%s\n",
-               here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end,
+                          "data:%p tail:%#lx end:%p dev:%s\n",
+               here, skb->len, sz, skb->head, skb->data,
+               (unsigned long)skb->tail, skb->end,
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
@@ -167,7 +169,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         atomic_set(&skb->users, 1);
         skb->head = data;
         skb->data = data;
-        skb->tail = data;
+        skb_reset_tail_pointer(skb);
         skb->end  = data + size;
         /* make sure we initialize shinfo sequentially */
         shinfo = skb_shinfo(skb);
@@ -629,7 +631,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
         /* Copy only real data... and, alas, header. This should be
          * optimized for the cases when header is void. */
-        memcpy(data + nhead, skb->head, skb->tail - skb->head);
+        memcpy(data + nhead, skb->head,
+                skb->tail
+#ifndef NET_SKBUFF_DATA_USES_OFFSET
+                - skb->head
+#endif
+                );
         memcpy(data + size, skb->end, sizeof(struct skb_shared_info));
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
@@ -645,9 +652,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
         skb->head     = data;
         skb->end      = data + size;
         skb->data    += off;
-        skb->tail    += off;
 #ifndef NET_SKBUFF_DATA_USES_OFFSET
-        /* {transport,network,mac}_header are relative to skb->head */
+        /* {transport,network,mac}_header and tail are relative to skb->head */
+        skb->tail             += off;
         skb->transport_header += off;
         skb->network_header   += off;
         skb->mac_header       += off;
@@ -762,7 +769,7 @@ int skb_pad(struct sk_buff *skb, int pad)
                 return 0;
         }
 
-        ntail = skb->data_len + pad - (skb->end - skb->tail);
+        ntail = skb->data_len + pad - (skb->end - skb_tail_pointer(skb));
         if (likely(skb_cloned(skb) || ntail > 0)) {
                 err = pskb_expand_head(skb, 0, ntail, GFP_ATOMIC);
                 if (unlikely(err))
@@ -863,7 +870,7 @@ done:
         } else {
                 skb->len       = len;
                 skb->data_len  = 0;
-                skb->tail      = skb->data + len;
+                skb_set_tail_pointer(skb, len);
         }
 
         return 0;
@@ -900,7 +907,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
          * plus 128 bytes for future expansions. If we have enough
          * room at tail, reallocate without expansion only if skb is cloned.
          */
-        int i, k, eat = (skb->tail + delta) - skb->end;
+        int i, k, eat = (skb_tail_pointer(skb) + delta) - skb->end;
 
         if (eat > 0 || skb_cloned(skb)) {
                 if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
@@ -908,7 +915,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
                         return NULL;
         }
 
-        if (skb_copy_bits(skb, skb_headlen(skb), skb->tail, delta))
+        if (skb_copy_bits(skb, skb_headlen(skb), skb_tail_pointer(skb), delta))
                 BUG();
 
         /* Optimization: no fragments, no reasons to preestimate
@@ -1004,7 +1011,7 @@ pull_pages:
         skb->tail     += delta;
         skb->data_len -= delta;
 
-        return skb->tail;
+        return skb_tail_pointer(skb);
 }
 
 /* Copy some data bits from skb to kernel buffer. */
@@ -1539,7 +1546,7 @@ static inline void skb_split_inside_header(struct sk_buff *skb,
         skb1->len                  += skb1->data_len;
         skb->data_len              = 0;
         skb->len                   = len;
-        skb->tail                  = skb->data + len;
+        skb_set_tail_pointer(skb, len);
 }
 
 static inline void skb_split_no_header(struct sk_buff *skb,
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 7c6a5db544f1..4a777b68e3bc 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1938,7 +1938,7 @@ static inline int rtnetlink_fill_iwinfo(struct sk_buff *	skb,
 {
         struct ifinfomsg *r;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char    *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(*r));
         r = NLMSG_DATA(nlh);
@@ -1952,7 +1952,7 @@ static inline int rtnetlink_fill_iwinfo(struct sk_buff *	skb,
         /* Add the wireless events in the netlink packet */
         RTA_PUT(skb, IFLA_WIRELESS, event_len, event);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 84b8c5b45fef..7404653880b0 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -681,8 +681,10 @@ void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
         if (scp->peer.sdn_objnum)
                 type = 0;
 
-        skb_put(skb, dn_sockaddr2username(&scp->peer, skb->tail, type));
-        skb_put(skb, dn_sockaddr2username(&scp->addr, skb->tail, 2));
+        skb_put(skb, dn_sockaddr2username(&scp->peer,
+                                          skb_tail_pointer(skb), type));
+        skb_put(skb, dn_sockaddr2username(&scp->addr,
+                                          skb_tail_pointer(skb), 2));
 
         menuver = DN_MENUVER_ACC | DN_MENUVER_USR;
         if (scp->peer.sdn_flags & SDF_PROXY)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index bb73bf16630f..9678b096b844 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1468,7 +1468,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         struct dn_route *rt = (struct dn_route *)skb->dst;
         struct rtmsg *r;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         long expires;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
@@ -1509,7 +1509,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         if (rt->fl.iif)
                 RTA_PUT(skb, RTA_IIF, sizeof(int), &rt->fl.iif);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 780a141f8342..544c45540746 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -295,7 +295,7 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 {
         struct rtmsg *rtm;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
@@ -337,13 +337,13 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         nhp->rtnh_ifindex = nh->nh_oif;
                         if (nh->nh_gw)
                                 RTA_PUT(skb, RTA_GATEWAY, 2, &nh->nh_gw);
-                        nhp->rtnh_len = skb->tail - (unsigned char *)nhp;
+                        nhp->rtnh_len = skb_tail_pointer(skb) - (unsigned char *)nhp;
                 } endfor_nexthops(fi);
                 mp_head->rta_type = RTA_MULTIPATH;
-                mp_head->rta_len = skb->tail - (u8*)mp_head;
+                mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
         }
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 0e62def05a58..ceefd9dd0c92 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -33,7 +33,7 @@ static struct sk_buff *dnrmg_build_message(struct sk_buff *rt_skb, int *errp)
 {
         struct sk_buff *skb = NULL;
         size_t size;
-        unsigned char *old_tail;
+        sk_buff_data_t old_tail;
         struct nlmsghdr *nlh;
         unsigned char *ptr;
         struct nf_dn_rtmsg *rtm;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 78993dadb53a..b5524f32ac2d 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -366,7 +366,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                         fh->cb = cb;
                         fh->port = port;
                         if (sock->type != SOCK_DGRAM) {
-                                skb->tail = skb->data;
+                                skb_reset_tail_pointer(skb);
                                 skb->len = 0;
                         } else if (res < 0)
                                 goto out_free;
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 59a765c49cf9..2b854941e06c 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -595,7 +595,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                 if (frag != 0)
                         flen -= hdrlen;
 
-                if (frag_skb->tail + flen > frag_skb->end) {
+                if (skb_tail_pointer(frag_skb) + flen > frag_skb->end) {
                         printk(KERN_WARNING "%s: host decrypted and "
                                "reassembled frame did not fit skb\n",
                                dev->name);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index de019f9fbfe1..5e5613930ffb 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -21,6 +21,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         struct blkcipher_desc desc;
         struct esp_data *esp;
         struct sk_buff *trailer;
+        u8 *tail;
         int blksize;
         int clen;
         int alen;
@@ -49,12 +50,13 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
                 goto error;
 
         /* Fill padding... */
+        tail = skb_tail_pointer(trailer);
         do {
                 int i;
                 for (i=0; i<clen-skb->len - 2; i++)
-                        *(u8*)(trailer->tail + i) = i+1;
+                        tail[i] = i + 1;
         } while (0);
-        *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2;
+        tail[clen - skb->len - 2] = (clen - skb->len) - 2;
         pskb_put(skb, trailer, clen - skb->len);
 
         __skb_push(skb, skb->data - skb_network_header(skb));
@@ -62,7 +64,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         esph = (struct ip_esp_hdr *)(skb_network_header(skb) +
                                      top_iph->ihl * 4);
         top_iph->tot_len = htons(skb->len + alen);
-        *(u8*)(trailer->tail - 1) = top_iph->protocol;
+        *(skb_tail_pointer(skb) - 1) = top_iph->protocol;
 
         /* this is non-NULL only with UDP Encapsulation */
         if (x->encap) {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 8372f8b8f0cd..d38cbba92a4d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -450,7 +450,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
          */
         iph = ip_hdr(skb_in);
 
-        if ((u8 *)iph < skb_in->head || (u8 *)(iph + 1) > skb_in->tail)
+        if ((u8 *)iph < skb_in->head ||
+            (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
                 goto out;
 
         /*
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fc637fb6750..2506021c2935 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -348,8 +348,8 @@ static int igmpv3_sendpack(struct sk_buff *skb)
 {
         struct iphdr *pip = ip_hdr(skb);
         struct igmphdr *pig = igmp_hdr(skb);
-        const int iplen = skb->tail - skb_network_header(skb);
-        const int igmplen = skb->tail - skb_transport_header(skb);
+        const int iplen = skb->tail - skb->network_header;
+        const int igmplen = skb->tail - skb->transport_header;
 
         pip->tot_len = htons(iplen);
         ip_send_check(pip);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 5df71cd08da8..37362cd1d07f 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -60,7 +60,7 @@ static int inet_csk_diag_fill(struct sock *sk,
         struct nlmsghdr  *nlh;
         void *info = NULL;
         struct inet_diag_meminfo  *minfo = NULL;
-        unsigned char    *b = skb->tail;
+        unsigned char    *b = skb_tail_pointer(skb);
         const struct inet_diag_handler *handler;
 
         handler = inet_diag_table[unlh->nlmsg_type];
@@ -147,7 +147,7 @@ static int inet_csk_diag_fill(struct sock *sk,
             icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
                 icsk->icsk_ca_ops->get_info(sk, ext, skb);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -163,7 +163,7 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
 {
         long tmo;
         struct inet_diag_msg *r;
-        const unsigned char *previous_tail = skb->tail;
+        const unsigned char *previous_tail = skb_tail_pointer(skb);
         struct nlmsghdr *nlh = NLMSG_PUT(skb, pid, seq,
                                          unlh->nlmsg_type, sizeof(*r));
 
@@ -205,7 +205,7 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
                                &tw6->tw_v6_daddr);
         }
 #endif
-        nlh->nlmsg_len = skb->tail - previous_tail;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - previous_tail;
         return skb->len;
 nlmsg_failure:
         skb_trim(skb, previous_tail - skb->data);
@@ -535,7 +535,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct inet_sock *inet = inet_sk(sk);
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct inet_diag_msg *r;
         struct nlmsghdr *nlh;
         long tmo;
@@ -574,7 +574,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
                                &inet6_rsk(req)->rmt_addr);
         }
 #endif
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
 
         return skb->len;
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fcb35cd5ccfd..c199d2311731 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -316,7 +316,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
         serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = port;
 
-        __skb_pull(skb, skb->tail - skb->data);
+        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
         skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 50d0b301380e..ea0a491dce92 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -513,7 +513,8 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
 
                         if (ipmr_fill_mroute(skb, c, NLMSG_DATA(nlh)) > 0) {
-                                nlh->nlmsg_len = skb->tail - (u8*)nlh;
+                                nlh->nlmsg_len = (skb_tail_pointer(skb) -
+                                                  (u8 *)nlh);
                         } else {
                                 nlh->nlmsg_type = NLMSG_ERROR;
                                 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
@@ -580,7 +581,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
          *      Copy the IP header
          */
 
-        skb_set_network_header(skb, skb->tail - skb->data);
+        skb->network_header = skb->tail;
         skb_put(skb, ihl);
         memcpy(skb->data,pkt->data,ihl);
         ip_hdr(skb)->protocol = 0;                      /* Flag to the kernel this is a route add */
@@ -1544,7 +1545,7 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net_device *dev = vif_table[c->mfc_parent].dev;
-        u8 *b = skb->tail;
+        u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
         if (dev)
@@ -1564,7 +1565,7 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
                 }
         }
         mp_head->rta_type = RTA_MULTIPATH;
-        mp_head->rta_len = skb->tail - (u8*)mp_head;
+        mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
         rtm->rtm_type = RTN_MULTICAST;
         return 1;
 
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 25bd68967305..344ddbbdc756 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -162,7 +162,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 iph = ip_hdr(*pskb);
                 th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
                 data = (char *)th + (th->doff << 2);
-                data_limit = (*pskb)->tail;
+                data_limit = skb_tail_pointer(*pskb);
 
                 if (ip_vs_ftp_get_addrport(data, data_limit,
                                            SERVER_STRING,
@@ -269,7 +269,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
            the length of the header in 32-bit multiples, it is accurate
            to calculate data address by th+HLEN*4 */
         data = data_start = (char *)th + (th->doff << 2);
-        data_limit = (*pskb)->tail;
+        data_limit = skb_tail_pointer(*pskb);
 
         while (data <= data_limit - 6) {
                 if (strnicmp(data, "PASV\r\n", 6) == 0) {
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index b4450f1ccc1b..6298d404e7c7 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -37,28 +37,28 @@ target(struct sk_buff **pskb,
         /* We assume that pln and hln were checked in the match */
         if (mangle->flags & ARPT_MANGLE_SDEV) {
                 if (ARPT_DEV_ADDR_LEN_MAX < hln ||
-                   (arpptr + hln > (**pskb).tail))
+                   (arpptr + hln > skb_tail_pointer(*pskb)))
                         return NF_DROP;
                 memcpy(arpptr, mangle->src_devaddr, hln);
         }
         arpptr += hln;
         if (mangle->flags & ARPT_MANGLE_SIP) {
                 if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
-                   (arpptr + pln > (**pskb).tail))
+                   (arpptr + pln > skb_tail_pointer(*pskb)))
                         return NF_DROP;
                 memcpy(arpptr, &mangle->u_s.src_ip, pln);
         }
         arpptr += pln;
         if (mangle->flags & ARPT_MANGLE_TDEV) {
                 if (ARPT_DEV_ADDR_LEN_MAX < hln ||
-                   (arpptr + hln > (**pskb).tail))
+                   (arpptr + hln > skb_tail_pointer(*pskb)))
                         return NF_DROP;
                 memcpy(arpptr, mangle->tgt_devaddr, hln);
         }
         arpptr += hln;
         if (mangle->flags & ARPT_MANGLE_TIP) {
                 if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
-                   (arpptr + pln > (**pskb).tail))
+                   (arpptr + pln > skb_tail_pointer(*pskb)))
                         return NF_DROP;
                 memcpy(arpptr, &mangle->u_t.tgt_ip, pln);
         }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5842f1aa973a..15e0d2002235 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -191,7 +191,7 @@ ipq_flush(int verdict)
 static struct sk_buff *
 ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 {
-        unsigned char *old_tail;
+        sk_buff_data_t old_tail;
         size_t size = 0;
         size_t data_len = 0;
         struct sk_buff *skb;
@@ -235,7 +235,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         if (!skb)
                 goto nlmsg_failure;
 
-        old_tail= skb->tail;
+        old_tail = skb->tail;
         nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
         pmsg = NLMSG_DATA(nlh);
         memset(pmsg, 0, sizeof(*pmsg));
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index c2c92ff12781..8a40fbe842b7 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -92,7 +92,8 @@ static void mangle_contents(struct sk_buff *skb,
         /* move post-replacement */
         memmove(data + match_offset + rep_len,
                 data + match_offset + match_len,
-                skb->tail - (data + match_offset + match_len));
+                skb->tail - (skb->network_header + dataoff +
+                             match_offset + match_len));
 
         /* insert data from buffer */
         memcpy(data + match_offset, rep_buffer, rep_len);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2b214cc3724c..18a09a78ca0b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2231,7 +2231,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                 th->cwr = 0;
         } while (skb->next);
 
-        delta = htonl(oldlen + (skb->tail - skb_transport_header(skb)) +
+        delta = htonl(oldlen + (skb->tail - skb->transport_header) +
                       skb->data_len);
         th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
                                 (__force u32)delta));
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 29c53fbb2204..c22cdcd84320 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -733,7 +733,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         }
         skb_shinfo(skb)->nr_frags = k;
 
-        skb->tail = skb->data;
+        skb_reset_tail_pointer(skb);
         skb->data_len -= len;
         skb->len = skb->data_len;
 }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f16f4f0c5814..4a355fea4098 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -268,7 +268,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = fl->fl_ip_dport;
 
-        __skb_pull(skb, skb->tail - skb->data);
+        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
         skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7fdf84dee73f..b8e8914cc002 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -51,6 +51,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         int clen;
         int alen;
         int nfrags;
+        u8 *tail;
         struct esp_data *esp = x->data;
         int hdr_len = (skb_transport_offset(skb) +
                        sizeof(*esph) + esp->conf.ivlen);
@@ -78,18 +79,19 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         /* Fill padding... */
+        tail = skb_tail_pointer(trailer);
         do {
                 int i;
                 for (i=0; i<clen-skb->len - 2; i++)
-                        *(u8*)(trailer->tail + i) = i+1;
+                        tail[i] = i + 1;
         } while (0);
-        *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2;
+        tail[clen-skb->len - 2] = (clen - skb->len) - 2;
         pskb_put(skb, trailer, clen - skb->len);
 
         top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
         esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);
         top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
-        *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
+        *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);
         *skb_network_header(skb) = IPPROTO_ESP;
 
         esph->spi = x->id.spi;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index a6a275db88cd..275d2e812a44 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -51,7 +51,7 @@
 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
 {
         const unsigned char *nh = skb_network_header(skb);
-        int packet_len = skb->tail - nh;
+        int packet_len = skb->tail - skb->network_header;
         struct ipv6_opt_hdr *hdr;
         int len;
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d3edc3cf1ce9..e94992ab92e6 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -317,7 +317,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         int hlimit, tclass;
         int err = 0;
 
-        if ((u8*)hdr < skb->head || (u8*)(hdr+1) > skb->tail)
+        if ((u8 *)hdr < skb->head ||
+            (skb->network_header + sizeof(*hdr)) > skb->tail)
                 return;
 
         /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b2c092c6b9dc..e2b8db6b9aef 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -514,7 +514,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr =
                                 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
-        unsigned int packet_len = skb->tail - skb_network_header(skb);
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4c45bcce75e8..6c2758951d60 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1423,7 +1423,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
 
         memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
         skb_put(skb, sizeof(*pmr));
         pmr = (struct mld2_report *)skb_transport_header(skb);
         pmr->type = ICMPV6_MLD2_REPORT;
@@ -1468,8 +1468,8 @@ static void mld_sendpack(struct sk_buff *skb)
         int err;
 
         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
-        payload_len = skb->tail - skb_network_header(skb) - sizeof(*pip6);
-        mldlen = skb->tail - skb_transport_header(skb);
+        payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
+        mldlen = skb->tail - skb->transport_header;
         pip6->payload_len = htons(payload_len);
 
         pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index f0288e92fb52..6ed763ee6785 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -260,7 +260,7 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - nh;
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
@@ -392,7 +392,7 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - nh;
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f8e619772fb4..b1cf70816477 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -492,7 +492,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, src_addr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         msg = (struct nd_msg *)skb_transport_header(skb);
 
@@ -584,7 +584,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         msg = (struct nd_msg *)skb_transport_header(skb);
         msg->icmph.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION;
@@ -685,7 +685,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         hdr = icmp6_hdr(skb);
         hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
@@ -767,7 +767,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - msg->opt;
+        u32 ndoptlen = skb->tail - (skb->transport_header +
+                                    offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
         struct inet6_ifaddr *ifp;
@@ -945,7 +946,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - msg->opt;
+        u32 ndoptlen = skb->tail - (skb->transport_header +
+                                    offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
         struct inet6_ifaddr *ifp;
@@ -1111,8 +1113,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         __u8 * opt = (__u8 *)(ra_msg + 1);
 
-        optlen = (skb->tail - skb_transport_header(skb)) -
-                  sizeof(struct ra_msg);
+        optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK2(KERN_WARNING
@@ -1361,7 +1362,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 return;
         }
 
-        optlen = skb->tail - skb_transport_header(skb);
+        optlen = skb->tail - skb->transport_header;
         optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
 
         if (optlen < 0) {
@@ -1522,7 +1523,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
                    IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(buff, buff->tail - buff->data);
+        skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
         skb_put(buff, len);
         icmph = icmp6_hdr(buff);
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 66a2c4135251..5cfce218c5e1 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -189,7 +189,7 @@ ipq_flush(int verdict)
 static struct sk_buff *
 ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 {
-        unsigned char *old_tail;
+        sk_buff_data_t old_tail;
         size_t size = 0;
         size_t data_len = 0;
         struct sk_buff *skb;
@@ -233,7 +233,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         if (!skb)
                 goto nlmsg_failure;
 
-        old_tail= skb->tail;
+        old_tail = skb->tail;
         nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
         pmsg = NLMSG_DATA(nlh);
         memset(pmsg, 0, sizeof(*pmsg));
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8705f6a502d9..2b3be68b70a7 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1077,7 +1077,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL)
-                                amount = skb->tail - skb_transport_header(skb);
+                                amount = skb->tail - skb->transport_header;
                         spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index 01d7c9c7b3b4..e5e4792a0314 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -133,8 +133,8 @@ int ircomm_param_request(struct ircomm_tty_cb *self, __u8 pi, int flush)
          * Inserting is a little bit tricky since we don't know how much
          * room we will need. But this should hopefully work OK
          */
-        count = irda_param_insert(self, pi, skb->tail, skb_tailroom(skb),
-                                  &ircomm_param_info);
+        count = irda_param_insert(self, pi, skb_tail_pointer(skb),
+                                  skb_tailroom(skb), &ircomm_param_info);
         if (count < 0) {
                 IRDA_WARNING("%s(), no room for parameter!\n", __FUNCTION__);
                 spin_unlock_irqrestore(&self->spinlock, flags);
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index fcf9d6599628..ed69773b0f8e 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1039,7 +1039,7 @@ static int __irlan_insert_param(struct sk_buff *skb, char *param, int type,
         }
 
         /* Insert at end of sk-buffer */
-        frame = skb->tail;
+        frame = skb_tail_pointer(skb);
 
         /* Make space for data */
         if (skb_tailroom(skb) < (param_len+value_len+3)) {
diff --git a/net/irda/qos.c b/net/irda/qos.c
index 349012c926b7..aeb18cf1dcae 100644
--- a/net/irda/qos.c
+++ b/net/irda/qos.c
@@ -469,49 +469,49 @@ int irlap_insert_qos_negotiation_params(struct irlap_cb *self,
         int ret;
 
         /* Insert data rate */
-        ret = irda_param_insert(self, PI_BAUD_RATE, skb->tail,
+        ret = irda_param_insert(self, PI_BAUD_RATE, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert max turnaround time */
-        ret = irda_param_insert(self, PI_MAX_TURN_TIME, skb->tail,
+        ret = irda_param_insert(self, PI_MAX_TURN_TIME, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert data size */
-        ret = irda_param_insert(self, PI_DATA_SIZE, skb->tail,
+        ret = irda_param_insert(self, PI_DATA_SIZE, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert window size */
-        ret = irda_param_insert(self, PI_WINDOW_SIZE, skb->tail,
+        ret = irda_param_insert(self, PI_WINDOW_SIZE, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert additional BOFs */
-        ret = irda_param_insert(self, PI_ADD_BOFS, skb->tail,
+        ret = irda_param_insert(self, PI_ADD_BOFS, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert minimum turnaround time */
-        ret = irda_param_insert(self, PI_MIN_TURN_TIME, skb->tail,
+        ret = irda_param_insert(self, PI_MIN_TURN_TIME, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
         skb_put(skb, ret);
 
         /* Insert link disconnect/threshold time */
-        ret = irda_param_insert(self, PI_LINK_DISC, skb->tail,
+        ret = irda_param_insert(self, PI_LINK_DISC, skb_tail_pointer(skb),
                                 skb_tailroom(skb), &irlap_param_info);
         if (ret < 0)
                 return ret;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 48f05314ebf7..442300c633d7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -268,9 +268,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         struct nfattr *nest_parms;
-        unsigned char *b;
-
-        b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         event |= NFNL_SUBSYS_CTNETLINK << 8;
         nlh    = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
@@ -303,7 +301,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
             ctnetlink_dump_use(skb, ct) < 0)
                 goto nfattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -322,7 +320,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         struct nf_conn *ct = (struct nf_conn *)ptr;
         struct sk_buff *skb;
         unsigned int type;
-        unsigned char *b;
+        sk_buff_data_t b;
         unsigned int flags = 0, group;
 
         /* ignore our fake conntrack entry */
@@ -1152,9 +1150,7 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
 {
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
-        unsigned char *b;
-
-        b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
         nlh    = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
@@ -1168,7 +1164,7 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
         if (ctnetlink_exp_dump_expect(skb, exp) < 0)
                 goto nfattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -1186,7 +1182,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
         struct sk_buff *skb;
         unsigned int type;
-        unsigned char *b;
+        sk_buff_data_t b;
         int flags = 0;
 
         if (events & IPEXP_NEW) {
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 5eeebd2efa7a..9709f94787f8 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -409,15 +409,14 @@ __build_packet_message(struct nfulnl_instance *inst,
                         const struct nf_loginfo *li,
                         const char *prefix, unsigned int plen)
 {
-        unsigned char *old_tail;
         struct nfulnl_msg_packet_hdr pmsg;
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
         __be32 tmp_uint;
+        sk_buff_data_t old_tail = inst->skb->tail;
 
         UDEBUG("entered\n");
 
-        old_tail = inst->skb->tail;
         nlh = NLMSG_PUT(inst->skb, 0, 0,
                         NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
                         sizeof(struct nfgenmsg));
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cfbee39f61d6..b6585caa431e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -338,7 +338,7 @@ static struct sk_buff *
 nfqnl_build_packet_message(struct nfqnl_instance *queue,
                            struct nfqnl_queue_entry *entry, int *errp)
 {
-        unsigned char *old_tail;
+        sk_buff_data_t old_tail;
         size_t size;
         size_t data_len = 0;
         struct sk_buff *skb;
@@ -404,7 +404,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (!skb)
                 goto nlmsg_failure;
 
-        old_tail= skb->tail;
+        old_tail = skb->tail;
         nlh = NLMSG_PUT(skb, 0, 0,
                         NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
                         sizeof(struct nfgenmsg));
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 50dc5edb7752..fdb6eb13cbcb 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -785,7 +785,7 @@ static inline struct sk_buff *netlink_trim(struct sk_buff *skb,
 
         skb_orphan(skb);
 
-        delta = skb->end - skb->tail;
+        delta = skb->end - skb_tail_pointer(skb);
         if (delta * 2 < skb->truesize)
                 return skb;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 51c059b09a37..36388b2f32f9 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -775,7 +775,7 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = -EINVAL;
                 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
                 if (sock->type != SOCK_DGRAM) {
-                        skb->tail = skb->data;
+                        skb_reset_tail_pointer(skb);
                         skb->len = 0;
                 } else if (res < 0)
                         goto out_free;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index cb21617a5670..28326fb1fc4e 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -93,7 +93,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                                 continue;
                         a->priv = p;
                         a->order = n_i;
-                        r = (struct rtattr*) skb->tail;
+                        r = (struct rtattr *)skb_tail_pointer(skb);
                         RTA_PUT(skb, a->order, 0, NULL);
                         err = tcf_action_dump_1(skb, a, 0, 0);
                         if (err < 0) {
@@ -101,7 +101,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                                 skb_trim(skb, (u8*)r - skb->data);
                                 goto done;
                         }
-                        r->rta_len = skb->tail - (u8*)r;
+                        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                         n_i++;
                         if (n_i >= TCA_ACT_MAX_PRIO)
                                 goto done;
@@ -125,7 +125,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
         struct rtattr *r ;
         int i= 0, n_i = 0;
 
-        r = (struct rtattr*) skb->tail;
+        r = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, a->order, 0, NULL);
         RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
         for (i = 0; i < (hinfo->hmask + 1); i++) {
@@ -140,7 +140,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
                 }
         }
         RTA_PUT(skb, TCA_FCNT, 4, &n_i);
-        r->rta_len = skb->tail - (u8*)r;
+        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
 
         return n_i;
 rtattr_failure:
@@ -423,7 +423,7 @@ int
 tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         int err = -EINVAL;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *r;
 
         if (a->ops == NULL || a->ops->dump == NULL)
@@ -432,10 +432,10 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
         RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
         if (tcf_action_copy_stats(skb, a, 0))
                 goto rtattr_failure;
-        r = (struct rtattr*) skb->tail;
+        r = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if ((err = tcf_action_dump_old(skb, a, bind, ref)) > 0) {
-                r->rta_len = skb->tail - (u8*)r;
+                r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                 return err;
         }
 
@@ -449,17 +449,17 @@ tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
 {
         struct tc_action *a;
         int err = -EINVAL;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *r ;
 
         while ((a = act) != NULL) {
-                r = (struct rtattr*) skb->tail;
+                r = (struct rtattr *)skb_tail_pointer(skb);
                 act = a->next;
                 RTA_PUT(skb, a->order, 0, NULL);
                 err = tcf_action_dump_1(skb, a, bind, ref);
                 if (err < 0)
                         goto errout;
-                r->rta_len = skb->tail - (u8*)r;
+                r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
         }
 
         return 0;
@@ -635,7 +635,7 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
 {
         struct tcamsg *t;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *x;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
@@ -645,15 +645,15 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr*) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         if (tcf_action_dump(skb, a, bind, ref) < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8*)x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -767,7 +767,7 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
                 return -ENOBUFS;
         }
 
-        b = (unsigned char *)skb->tail;
+        b = skb_tail_pointer(skb);
 
         if (rtattr_parse_nested(tb, TCA_ACT_MAX, rta) < 0)
                 goto err_out;
@@ -783,16 +783,16 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr *) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
         if (err < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8 *) x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         nlh->nlmsg_flags |= NLM_F_ROOT;
         module_put(a->ops->owner);
         kfree(a);
@@ -884,7 +884,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
         if (!skb)
                 return -ENOBUFS;
 
-        b = (unsigned char *)skb->tail;
+        b = skb_tail_pointer(skb);
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
         t = NLMSG_DATA(nlh);
@@ -892,15 +892,15 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr*) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         if (tcf_action_dump(skb, a, 0, 0) < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8*)x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         NETLINK_CB(skb).dst_group = RTNLGRP_TC;
 
         err = rtnetlink_send(skb, pid, RTNLGRP_TC, flags&NLM_F_ECHO);
@@ -1015,7 +1015,7 @@ static int
 tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *x;
         struct tc_action_ops *a_o;
         struct tc_action a;
@@ -1048,7 +1048,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr *) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         ret = a_o->walk(skb, cb, RTM_GETACTION, &a);
@@ -1056,12 +1056,12 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
                 goto rtattr_failure;
 
         if (ret > 0) {
-                x->rta_len = skb->tail - (u8 *) x;
+                x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
                 ret = skb->len;
         } else
                 skb_trim(skb, (u8*)x - skb->data);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         if (NETLINK_CB(cb->skb).pid && ret)
                 nlh->nlmsg_flags |= NLM_F_MULTI;
         module_put(a_o->owner);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 87d0faf32867..aad748b3b38c 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -155,7 +155,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_gact opt;
         struct tcf_gact *gact = a->priv;
         struct tcf_t t;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 47f0b1324239..2ccfd5b20fab 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -245,7 +245,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
 
 static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_ipt *ipt = a->priv;
         struct ipt_entry_target *t;
         struct tcf_t tm;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 3e93683e9ab3..15f6ecdaf611 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -206,7 +206,7 @@ bad_mirred:
 
 static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_mirred *m = a->priv;
         struct tc_mirred opt;
         struct tcf_t t;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 20813eee8af4..d654cea1a46c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -195,7 +195,7 @@ done:
 static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
                           int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_pedit *p = a->priv;
         struct tc_pedit *opt;
         struct tcf_t t;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 10a5a5c36f76..068b23763665 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -80,7 +80,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
                                 continue;
                         a->priv = p;
                         a->order = index;
-                        r = (struct rtattr*) skb->tail;
+                        r = (struct rtattr *)skb_tail_pointer(skb);
                         RTA_PUT(skb, a->order, 0, NULL);
                         if (type == RTM_DELACTION)
                                 err = tcf_action_dump_1(skb, a, 0, 1);
@@ -91,7 +91,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
                                 skb_trim(skb, (u8*)r - skb->data);
                                 goto done;
                         }
-                        r->rta_len = skb->tail - (u8*)r;
+                        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                         n_i++;
                 }
         }
@@ -326,7 +326,7 @@ static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
 static int
 tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_police *police = a->priv;
         struct tc_police opt;
 
@@ -572,7 +572,7 @@ EXPORT_SYMBOL(tcf_police);
 
 int tcf_police_dump(struct sk_buff *skb, struct tcf_police *police)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_police opt;
 
         opt.index = police->tcf_index;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index c7971182af07..ecbcfa59b76c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -155,7 +155,7 @@ static inline int tcf_simp_cleanup(struct tc_action *a, int bind)
 static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
                                 int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_defact *d = a->priv;
         struct tc_defact opt;
         struct tcf_t t;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 5c6ffdb77d2d..84231baf77d1 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -323,7 +323,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
         tcm = NLMSG_DATA(nlh);
@@ -340,7 +340,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
                 if (tp->ops->dump && tp->ops->dump(tp, fh, skb, tcm) < 0)
                         goto rtattr_failure;
         }
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -563,30 +563,30 @@ tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
                  * to work with both old and new modes of entering
                  * tc data even if iproute2  was newer - jhs
                  */
-                struct rtattr * p_rta = (struct rtattr*) skb->tail;
+                struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
 
                 if (exts->action->type != TCA_OLD_COMPAT) {
                         RTA_PUT(skb, map->action, 0, NULL);
                         if (tcf_action_dump(skb, exts->action, 0, 0) < 0)
                                 goto rtattr_failure;
-                        p_rta->rta_len = skb->tail - (u8*)p_rta;
+                        p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
                 } else if (map->police) {
                         RTA_PUT(skb, map->police, 0, NULL);
                         if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0)
                                 goto rtattr_failure;
-                        p_rta->rta_len = skb->tail - (u8*)p_rta;
+                        p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
                 }
         }
 #elif defined CONFIG_NET_CLS_POLICE
         if (map->police && exts->police) {
-                struct rtattr * p_rta = (struct rtattr*) skb->tail;
+                struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
 
                 RTA_PUT(skb, map->police, 0, NULL);
 
                 if (tcf_police_dump(skb, exts->police) < 0)
                         goto rtattr_failure;
 
-                p_rta->rta_len = skb->tail - (u8*)p_rta;
+                p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
         }
 #endif
         return 0;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 4a91f082a81d..800ec2ac326b 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -245,7 +245,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
                       struct sk_buff *skb, struct tcmsg *t)
 {
         struct basic_filter *f = (struct basic_filter *) fh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (f == NULL)
@@ -263,7 +263,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
             tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = (skb->tail - b);
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 5dbb9d451f73..f5f355852a87 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -348,7 +348,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct fw_head *head = (struct fw_head *)tp->root;
         struct fw_filter *f = (struct fw_filter*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (f == NULL)
@@ -374,7 +374,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &fw_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index abc47cc48ad0..1f94df36239d 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -562,7 +562,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
                        struct sk_buff *skb, struct tcmsg *t)
 {
         struct route4_filter *f = (struct route4_filter*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         u32 id;
 
@@ -591,7 +591,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &route_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 6f373b020eb4..87ed6f3c5070 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -593,7 +593,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct rsvp_filter *f = (struct rsvp_filter*)fh;
         struct rsvp_session *s;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_rsvp_pinfo pinfo;
 
@@ -623,7 +623,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &rsvp_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7563fdcef4b7..0537d6066b43 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -448,7 +448,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct tcindex_data *p = PRIV(tp);
         struct tcindex_filter_result *r = (struct tcindex_filter_result *) fh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         DPRINTK("tcindex_dump(tp %p,fh 0x%lx,skb %p,t %p),p %p,r %p,b %p\n",
@@ -463,7 +463,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
                 RTA_PUT(skb,TCA_TCINDEX_SHIFT,sizeof(p->shift),&p->shift);
                 RTA_PUT(skb,TCA_TCINDEX_FALL_THROUGH,sizeof(p->fall_through),
                     &p->fall_through);
-                rta->rta_len = skb->tail-b;
+                rta->rta_len = skb_tail_pointer(skb) - b;
         } else {
                 if (p->perfect) {
                         t->tcm_handle = r-p->perfect;
@@ -486,7 +486,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
 
                 if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0)
                         goto rtattr_failure;
-                rta->rta_len = skb->tail-b;
+                rta->rta_len = skb_tail_pointer(skb) - b;
 
                 if (tcf_exts_dump_stats(skb, &r->exts, &tcindex_ext_map) < 0)
                         goto rtattr_failure;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 695b34051b9f..fa11bb750049 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -213,7 +213,7 @@ check_terminal:
                         off2 = 0;
                 }
 
-                if (ptr < skb->tail)
+                if (ptr < skb_tail_pointer(skb))
                         goto next_ht;
         }
 
@@ -718,7 +718,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
                      struct sk_buff *skb, struct tcmsg *t)
 {
         struct tc_u_knode *n = (struct tc_u_knode*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (n == NULL)
@@ -765,7 +765,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
 #endif
         }
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         if (TC_U32_KEY(n->handle))
                 if (tcf_exts_dump_stats(skb, &n->exts, &u32_ext_map) < 0)
                         goto rtattr_failure;
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 959c306c5714..63146d339d81 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -418,17 +418,19 @@ void tcf_em_tree_destroy(struct tcf_proto *tp, struct tcf_ematch_tree *tree)
 int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
 {
         int i;
-        struct rtattr * top_start = (struct rtattr*) skb->tail;
-        struct rtattr * list_start;
+        u8 *tail;
+        struct rtattr *top_start = (struct rtattr *)skb_tail_pointer(skb);
+        struct rtattr *list_start;
 
         RTA_PUT(skb, tlv, 0, NULL);
         RTA_PUT(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr);
 
-        list_start = (struct rtattr *) skb->tail;
+        list_start = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_EMATCH_TREE_LIST, 0, NULL);
 
+        tail = skb_tail_pointer(skb);
         for (i = 0; i < tree->hdr.nmatches; i++) {
-                struct rtattr *match_start = (struct rtattr*) skb->tail;
+                struct rtattr *match_start = (struct rtattr *)tail;
                 struct tcf_ematch *em = tcf_em_get_match(tree, i);
                 struct tcf_ematch_hdr em_hdr = {
                         .kind = em->ops ? em->ops->kind : TCF_EM_CONTAINER,
@@ -447,11 +449,12 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
                 } else if (em->datalen > 0)
                         RTA_PUT_NOHDR(skb, em->datalen, (void *) em->data);
 
-                match_start->rta_len = skb->tail - (u8*) match_start;
+                tail = skb_tail_pointer(skb);
+                match_start->rta_len = tail - (u8 *)match_start;
         }
 
-        list_start->rta_len = skb->tail - (u8 *) list_start;
-        top_start->rta_len = skb->tail - (u8 *) top_start;
+        list_start->rta_len = tail - (u8 *)list_start;
+        top_start->rta_len = tail - (u8 *)top_start;
 
         return 0;
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ecbdc6b42a9c..7482a950717b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -813,7 +813,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
@@ -847,7 +847,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -1051,7 +1051,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
         struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
 
@@ -1076,7 +1076,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index baca8743c12b..1d7bb1632138 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -631,7 +631,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
 {
         struct atm_qdisc_data *p = PRIV(sch);
         struct atm_flow_data *flow = (struct atm_flow_data *) cl;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         DPRINTK("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
@@ -661,7 +661,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
 
                 RTA_PUT(skb,TCA_ATM_EXCESS,sizeof(zero),&zero);
         }
-        rta->rta_len = skb->tail-b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index d83414d828d8..be98a01253e9 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,7 +1465,7 @@ static int cbq_init(struct Qdisc *sch, struct rtattr *opt)
 
 static __inline__ int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         RTA_PUT(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate);
         return skb->len;
@@ -1477,7 +1477,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_lssopt opt;
 
         opt.flags = 0;
@@ -1502,7 +1502,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
         opt.flags = 0;
@@ -1520,7 +1520,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_ovl opt;
 
         opt.strategy = cl->ovl_strategy;
@@ -1537,7 +1537,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_fopt opt;
 
         if (cl->split || cl->defmap) {
@@ -1556,7 +1556,7 @@ rtattr_failure:
 #ifdef CONFIG_NET_CLS_POLICE
 static __inline__ int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_police opt;
 
         if (cl->police) {
@@ -1590,14 +1590,14 @@ static int cbq_dump_attr(struct sk_buff *skb, struct cbq_class *cl)
 static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         rta = (struct rtattr*)b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (cbq_dump_attr(skb, &q->link) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -1619,7 +1619,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
                struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct cbq_class *cl = (struct cbq_class*)arg;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (cl->tparent)
@@ -1633,7 +1633,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (cbq_dump_attr(skb, cl) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 5197b6caaf2d..80e6f811e3bc 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1363,7 +1363,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
                 struct tcmsg *tcm)
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta = (struct rtattr *)b;
 
         tcm->tcm_parent = cl->cl_parent ? cl->cl_parent->classid : TC_H_ROOT;
@@ -1374,7 +1374,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (hfsc_dump_curves(skb, cl) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
  rtattr_failure:
@@ -1576,7 +1576,7 @@ static int
 hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
 
         qopt.defcls = q->defcls;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index f76c20c0a109..c687388a8cb6 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1110,7 +1110,7 @@ static int htb_init(struct Qdisc *sch, struct rtattr *opt)
 static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct htb_sched *q = qdisc_priv(sch);
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_htb_glob gopt;
         spin_lock_bh(&sch->dev->queue_lock);
@@ -1123,12 +1123,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
         rta = (struct rtattr *)b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         spin_unlock_bh(&sch->dev->queue_lock);
         return skb->len;
 rtattr_failure:
         spin_unlock_bh(&sch->dev->queue_lock);
-        skb_trim(skb, skb->tail - skb->data);
+        skb_trim(skb, skb_tail_pointer(skb) - skb->data);
         return -1;
 }
 
@@ -1136,7 +1136,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
                           struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct htb_class *cl = (struct htb_class *)arg;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_htb_opt opt;
 
@@ -1159,7 +1159,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
         opt.prio = cl->un.leaf.prio;
         opt.level = cl->level;
         RTA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         spin_unlock_bh(&sch->dev->queue_lock);
         return skb->len;
 rtattr_failure:
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index cfe070ee6ee3..d19f4070c237 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -362,12 +362,12 @@ static void ingress_destroy(struct Qdisc *sch)
 
 static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         rta = (struct rtattr *) b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 915f82a2cc3d..2a9b1e429ff8 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -583,7 +583,7 @@ static void netem_destroy(struct Qdisc *sch)
 static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         const struct netem_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta = (struct rtattr *) b;
         struct tc_netem_qopt qopt;
         struct tc_netem_corr cor;
@@ -611,7 +611,7 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         corrupt.correlation = q->corrupt_cor.rho;
         RTA_PUT(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt);
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         return skb->len;
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index de889f23f22a..5b371109ec1c 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -271,7 +271,7 @@ static int prio_init(struct Qdisc *sch, struct rtattr *opt)
 static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_prio_qopt opt;
 
         opt.bands = q->bands;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index e3695407afc6..a511ba83e26f 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -461,7 +461,7 @@ static void sfq_destroy(struct Qdisc *sch)
 static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_sfq_qopt opt;
 
         opt.quantum = q->quantum;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index f14692f3a14e..231895562c66 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -387,7 +387,7 @@ static void tbf_destroy(struct Qdisc *sch)
 static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_tbf_qopt opt;
 
@@ -403,7 +403,7 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
         opt.mtu = q->mtu;
         opt.buffer = q->buffer;
         RTA_PUT(skb, TCA_TBF_PARMS, sizeof(opt), &opt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         return skb->len;
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 1ff47b18724a..18b97eedc1fa 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -612,7 +612,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
                         break;
 
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
-                if (ch_end > skb->tail)
+                if (ch_end > skb_tail_pointer(skb))
                         break;
 
                 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
@@ -644,7 +644,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
                 }
 
                 ch = (sctp_chunkhdr_t *) ch_end;
-        } while (ch_end < skb->tail);
+        } while (ch_end < skb_tail_pointer(skb));
 
         return 0;
 
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30629e17781..88aa22407549 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -159,16 +159,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
          * the skb->tail.
          */
         if (unlikely(skb_is_nonlinear(chunk->skb))) {
-                if (chunk->chunk_end > chunk->skb->tail)
-                        chunk->chunk_end = chunk->skb->tail;
+                if (chunk->chunk_end > skb_tail_pointer(chunk->skb))
+                        chunk->chunk_end = skb_tail_pointer(chunk->skb);
         }
         skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
         chunk->subh.v = NULL; /* Subheader is no longer valid.  */
 
-        if (chunk->chunk_end < chunk->skb->tail) {
+        if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
                 /* This is not a singleton */
                 chunk->singleton = 0;
-        } else if (chunk->chunk_end > chunk->skb->tail) {
+        } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
                 /* RFC 2960, Section 6.10  Bundling
                  *
                  * Partial chunks MUST NOT be placed in an SCTP packet.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 60c5b59d4c65..759ea3d19976 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1143,7 +1143,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
 
         /* Adjust the chunk length field.  */
         chunk->chunk_hdr->length = htons(chunklen + padlen + len);
-        chunk->chunk_end = chunk->skb->tail;
+        chunk->chunk_end = skb_tail_pointer(chunk->skb);
 
         return target;
 }
@@ -1168,7 +1168,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
         /* Adjust the chunk length field.  */
         chunk->chunk_hdr->length =
                 htons(ntohs(chunk->chunk_hdr->length) + len);
-        chunk->chunk_end = chunk->skb->tail;
+        chunk->chunk_end = skb_tail_pointer(chunk->skb);
 
 out:
         return err;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index bf502c499c81..438e5dc5c714 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3115,7 +3115,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                         break;
 
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
-                if (ch_end > skb->tail)
+                if (ch_end > skb_tail_pointer(skb))
                         break;
 
                 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
@@ -3130,7 +3130,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                         return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
                 ch = (sctp_chunkhdr_t *) ch_end;
-        } while (ch_end < skb->tail);
+        } while (ch_end < skb_tail_pointer(skb));
 
         if (ootb_shut_ack)
                 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 14789a82de53..c71337a22d33 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -89,7 +89,7 @@ struct sk_buff *tipc_cfg_reply_alloc(int payload_size)
 int tipc_cfg_append_tlv(struct sk_buff *buf, int tlv_type,
                         void *tlv_data, int tlv_data_size)
 {
-        struct tlv_desc *tlv = (struct tlv_desc *)buf->tail;
+        struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(buf);
         int new_tlv_space = TLV_SPACE(tlv_data_size);
 
         if (skb_tailroom(buf) < new_tlv_space) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b71739fbe2c6..45832fb75ea4 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1020,7 +1020,7 @@ restart:
 
         if (!err) {
                 buf_crs = (unsigned char *)(TIPC_SKB_CB(buf)->handle);
-                sz = buf->tail - buf_crs;
+                sz = skb_tail_pointer(buf) - buf_crs;
 
                 needed = (buf_len - sz_copied);
                 sz_to_copy = (sz <= needed) ? sz : needed;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 816e3690b60f..814bb3125ada 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -576,7 +576,7 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
         struct sk_buff *skb = sp->out_skb;
         struct xfrm_usersa_info *p;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         if (sp->this_idx < sp->start_idx)
                 goto out;
@@ -621,7 +621,7 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
         if (x->lastused)
                 RTA_PUT(skb, XFRMA_LASTUSED, sizeof(x->lastused), &x->lastused);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
 out:
         sp->this_idx++;
         return 0;
@@ -1157,7 +1157,7 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
         struct sk_buff *in_skb = sp->in_skb;
         struct sk_buff *skb = sp->out_skb;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         if (sp->this_idx < sp->start_idx)
                 goto out;
@@ -1176,7 +1176,7 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
 out:
         sp->this_idx++;
         return 0;
@@ -1330,7 +1330,7 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
         struct xfrm_aevent_id *id;
         struct nlmsghdr *nlh;
         struct xfrm_lifetime_cur ltime;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_PUT(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id));
         id = NLMSG_DATA(nlh);
@@ -1362,7 +1362,7 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
                 RTA_PUT(skb,XFRMA_ETIMER_THRESH,sizeof(u32),&etimer);
         }
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -1744,7 +1744,7 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
         struct xfrm_migrate *mp;
         struct xfrm_userpolicy_id *pol_id;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         int i;
 
         nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id));
@@ -1764,7 +1764,7 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
                         goto nlmsg_failure;
         }
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 nlmsg_failure:
         skb_trim(skb, b - skb->data);
@@ -1942,7 +1942,7 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
 {
         struct xfrm_user_expire *ue;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_EXPIRE,
                         sizeof(*ue));
@@ -1952,7 +1952,7 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
         copy_to_user_state(x, &ue->state);
         ue->hard = (c->data.hard != 0) ? 1 : 0;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -1999,7 +1999,7 @@ static int xfrm_notify_sa_flush(struct km_event *c)
         struct xfrm_usersa_flush *p;
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        unsigned char *b;
+        sk_buff_data_t b;
         int len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush));
 
         skb = alloc_skb(len, GFP_ATOMIC);
@@ -2045,7 +2045,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
         struct xfrm_usersa_id *id;
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        unsigned char *b;
+        sk_buff_data_t b;
         int len = xfrm_sa_len(x);
         int headlen;
 
@@ -2129,7 +2129,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 {
         struct xfrm_user_acquire *ua;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         __u32 seq = xfrm_get_acqseq();
 
         nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_ACQUIRE,
@@ -2153,7 +2153,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
         if (copy_to_user_policy_type(xp->type, skb) < 0)
                 goto nlmsg_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -2249,7 +2249,7 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
         struct xfrm_user_polexpire *upe;
         struct nlmsghdr *nlh;
         int hard = c->data.hard;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe));
         upe = NLMSG_DATA(nlh);
@@ -2264,7 +2264,7 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
                 goto nlmsg_failure;
         upe->hard = !!hard;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -2300,7 +2300,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
         struct xfrm_userpolicy_id *id;
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        unsigned char *b;
+        sk_buff_data_t b;
         int len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         int headlen;
 
@@ -2357,7 +2357,7 @@ static int xfrm_notify_policy_flush(struct km_event *c)
 {
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
-        unsigned char *b;
+        sk_buff_data_t b;
         int len = 0;
 #ifdef CONFIG_XFRM_SUB_POLICY
         len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
@@ -2410,7 +2410,7 @@ static int build_report(struct sk_buff *skb, u8 proto,
 {
         struct xfrm_user_report *ur;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur));
         ur = NLMSG_DATA(nlh);
@@ -2422,7 +2422,7 @@ static int build_report(struct sk_buff *skb, u8 proto,
         if (addr)
                 RTA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure: