15 files changed, 96 insertions, 92 deletions

diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index e8d2a340356d..1e9db0156ea7 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -330,7 +330,7 @@ static inline int bfusb_recv_block(struct bfusb *bfusb, int hdr, unsigned char *
                 }
 
                 skb->dev = (void *) bfusb->hdev;
-                skb->pkt_type = pkt_type;
+                bt_cb(skb)->pkt_type = pkt_type;
 
                 bfusb->reassembly = skb;
         } else {
@@ -485,7 +485,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
         unsigned char buf[3];
         int sent = 0, size, count;
 
-        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
+        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
 
         if (!hdev) {
                 BT_ERR("Frame for unknown HCI device (hdev=NULL)");
@@ -497,7 +497,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
 
         bfusb = (struct bfusb *) hdev->driver_data;
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -510,7 +510,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
 
         count = skb->len;
 
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index bd2ec7e284cc..26fe9c0e1d20 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -270,7 +270,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                 if (!(skb = skb_dequeue(&(info->txq))))
                         break;
 
-                if (skb->pkt_type & 0x80) {
+                if (bt_cb(skb)->pkt_type & 0x80) {
                         /* Disable RTS */
                         info->ctrl_reg |= REG_CONTROL_RTS;
                         outb(info->ctrl_reg, iobase + REG_CONTROL);
@@ -288,13 +288,13 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                 /* Mark the buffer as dirty */
                 clear_bit(ready_bit, &(info->tx_state));
 
-                if (skb->pkt_type & 0x80) {
+                if (bt_cb(skb)->pkt_type & 0x80) {
                         DECLARE_WAIT_QUEUE_HEAD(wq);
                         DEFINE_WAIT(wait);
 
                         unsigned char baud_reg;
 
-                        switch (skb->pkt_type) {
+                        switch (bt_cb(skb)->pkt_type) {
                         case PKT_BAUD_RATE_460800:
                                 baud_reg = REG_CONTROL_BAUD_RATE_460800;
                                 break;
@@ -410,9 +410,9 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = buf[i];
+                        bt_cb(info->rx_skb)->pkt_type = buf[i];
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case 0x00:
                                 /* init packet */
@@ -444,7 +444,7 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
 
                         default:
                                 /* unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
 
                                 kfree_skb(info->rx_skb);
@@ -586,21 +586,21 @@ static int bluecard_hci_set_baud_rate(struct hci_dev *hdev, int baud)
         switch (baud) {
         case 460800:
                 cmd[4] = 0x00;
-                skb->pkt_type = PKT_BAUD_RATE_460800;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_460800;
                 break;
         case 230400:
                 cmd[4] = 0x01;
-                skb->pkt_type = PKT_BAUD_RATE_230400;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_230400;
                 break;
         case 115200:
                 cmd[4] = 0x02;
-                skb->pkt_type = PKT_BAUD_RATE_115200;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_115200;
                 break;
         case 57600:
                 /* Fall through... */
         default:
                 cmd[4] = 0x03;
-                skb->pkt_type = PKT_BAUD_RATE_57600;
+                bt_cb(skb)->pkt_type = PKT_BAUD_RATE_57600;
                 break;
         }
 
@@ -680,7 +680,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
 
         info = (bluecard_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -693,7 +693,7 @@ static int bluecard_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         bluecard_write_wakeup(info);
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index d6b81c1535dd..a1bf8f066c88 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -105,7 +105,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_ACLDATA_PKT;
+                                bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -117,7 +117,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_SCODATA_PKT;
+                                bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -129,7 +129,7 @@ static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int c
                         if (skb) {
                                 memcpy(skb_put(skb, len), buf, len);
                                 skb->dev = (void *) data->hdev;
-                                skb->pkt_type = HCI_VENDOR_PKT;
+                                bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
                                 hci_recv_frame(skb);
                         }
                         break;
@@ -190,7 +190,7 @@ static int bpa10x_recv_event(struct bpa10x_data *data, unsigned char *buf, int s
                 }
 
                 skb->dev = (void *) data->hdev;
-                skb->pkt_type = pkt_type;
+                bt_cb(skb)->pkt_type = pkt_type;
 
                 memcpy(skb_put(skb, size), buf, size);
 
@@ -488,7 +488,7 @@ static int bpa10x_send_frame(struct sk_buff *skb)
         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
         struct bpa10x_data *data;
 
-        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
+        BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
 
         if (!hdev) {
                 BT_ERR("Frame for unknown HCI device");
@@ -501,9 +501,9 @@ static int bpa10x_send_frame(struct sk_buff *skb)
         data = hdev->driver_data;
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 skb_queue_tail(&data->cmd_queue, skb);
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index adf1750ea58d..2e0338d80f32 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -259,11 +259,11 @@ static void bt3c_receive(bt3c_info_t *info)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = inb(iobase + DATA_L);
+                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + DATA_L);
                         inb(iobase + DATA_H);
-                        //printk("bt3c: PACKET_TYPE=%02x\n", info->rx_skb->pkt_type);
+                        //printk("bt3c: PACKET_TYPE=%02x\n", bt_cb(info->rx_skb)->pkt_type);
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case HCI_EVENT_PKT:
                                 info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -282,7 +282,7 @@ static void bt3c_receive(bt3c_info_t *info)
 
                         default:
                                 /* Unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
                                 clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -439,7 +439,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
 
         info = (bt3c_info_t *) (hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -452,7 +452,7 @@ static int bt3c_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         spin_lock_irqsave(&(info->lock), flags);
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index e4c59fdc0e12..89486ea7a021 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -211,9 +211,9 @@ static void btuart_receive(btuart_info_t *info)
                 if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
 
                         info->rx_skb->dev = (void *) info->hdev;
-                        info->rx_skb->pkt_type = inb(iobase + UART_RX);
+                        bt_cb(info->rx_skb)->pkt_type = inb(iobase + UART_RX);
 
-                        switch (info->rx_skb->pkt_type) {
+                        switch (bt_cb(info->rx_skb)->pkt_type) {
 
                         case HCI_EVENT_PKT:
                                 info->rx_state = RECV_WAIT_EVENT_HEADER;
@@ -232,7 +232,7 @@ static void btuart_receive(btuart_info_t *info)
 
                         default:
                                 /* Unknown packet */
-                                BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                 info->hdev->stat.err_rx++;
                                 clear_bit(HCI_RUNNING, &(info->hdev->flags));
 
@@ -447,7 +447,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
 
         info = (btuart_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -460,7 +460,7 @@ static int btuart_hci_send_frame(struct sk_buff *skb)
         };
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&(info->txq), skb);
 
         btuart_write_wakeup(info);
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index e39868c3da48..84c1f8839422 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -251,7 +251,7 @@ static void dtl1_receive(dtl1_info_t *info)
                                 info->rx_count = nsh->len + (nsh->len & 0x0001);
                                 break;
                         case RECV_WAIT_DATA:
-                                info->rx_skb->pkt_type = nsh->type;
+                                bt_cb(info->rx_skb)->pkt_type = nsh->type;
 
                                 /* remove PAD byte if it exists */
                                 if (nsh->len & 0x0001) {
@@ -262,7 +262,7 @@ static void dtl1_receive(dtl1_info_t *info)
                                 /* remove NSH */
                                 skb_pull(info->rx_skb, NSHL);
 
-                                switch (info->rx_skb->pkt_type) {
+                                switch (bt_cb(info->rx_skb)->pkt_type) {
                                 case 0x80:
                                         /* control data for the Nokia Card */
                                         dtl1_control(info, info->rx_skb);
@@ -272,12 +272,12 @@ static void dtl1_receive(dtl1_info_t *info)
                                 case 0x84:
                                         /* send frame to the HCI layer */
                                         info->rx_skb->dev = (void *) info->hdev;
-                                        info->rx_skb->pkt_type &= 0x0f;
+                                        bt_cb(info->rx_skb)->pkt_type &= 0x0f;
                                         hci_recv_frame(info->rx_skb);
                                         break;
                                 default:
                                         /* unknown packet */
-                                        BT_ERR("Unknown HCI packet with type 0x%02x received", info->rx_skb->pkt_type);
+                                        BT_ERR("Unknown HCI packet with type 0x%02x received", bt_cb(info->rx_skb)->pkt_type);
                                         kfree_skb(info->rx_skb);
                                         break;
                                 }
@@ -410,7 +410,7 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
 
         info = (dtl1_info_t *)(hdev->driver_data);
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 nsh.type = 0x81;
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 858fddb046de..0ee324e1265d 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -149,7 +149,7 @@ static int bcsp_enqueue(struct hci_uart *hu, struct sk_buff *skb)
                 return 0;
         }
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_ACLDATA_PKT:
         case HCI_COMMAND_PKT:
                 skb_queue_tail(&bcsp->rel, skb);
@@ -227,7 +227,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
         if (!nskb)
                 return NULL;
 
-        nskb->pkt_type = pkt_type;
+        bt_cb(nskb)->pkt_type = pkt_type;
 
         bcsp_slip_msgdelim(nskb);
 
@@ -286,7 +286,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
            since they have priority */
 
         if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
-                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
+                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
                 if (nskb) {
                         kfree_skb(skb);
                         return nskb;
@@ -303,7 +303,7 @@ static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
         spin_lock_irqsave(&bcsp->unack.lock, flags);
 
         if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
-                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
+                struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
                 if (nskb) {
                         __skb_queue_tail(&bcsp->unack, skb);
                         mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
@@ -401,7 +401,7 @@ static void bcsp_handle_le_pkt(struct hci_uart *hu)
                 if (!nskb)
                         return;
                 memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
-                nskb->pkt_type = BCSP_LE_PKT;
+                bt_cb(nskb)->pkt_type = BCSP_LE_PKT;
 
                 skb_queue_head(&bcsp->unrel, nskb);
                 hci_uart_tx_wakeup(hu);
@@ -483,14 +483,14 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
         bcsp_pkt_cull(bcsp);
         if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
                         bcsp->rx_skb->data[0] & 0x80) {
-                bcsp->rx_skb->pkt_type = HCI_ACLDATA_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_ACLDATA_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
                         bcsp->rx_skb->data[0] & 0x80) {
-                bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
-                bcsp->rx_skb->pkt_type = HCI_SCODATA_PKT;
+                bt_cb(bcsp->rx_skb)->pkt_type = HCI_SCODATA_PKT;
                 pass_up = 1;
         } else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
                         !(bcsp->rx_skb->data[0] & 0x80)) {
@@ -512,7 +512,7 @@ static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
                                 hdr.evt = 0xff;
                                 hdr.plen = bcsp->rx_skb->len;
                                 memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
-                                bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
+                                bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
 
                                 hci_recv_frame(bcsp->rx_skb);
                         } else {
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index 533323b60e63..cf8a22d58d96 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -112,7 +112,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
         BT_DBG("hu %p skb %p", hu, skb);
 
         /* Prepend skb with frame type */
-        memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&h4->txq, skb);
         return 0;
 }
@@ -239,7 +239,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                         return 0;
                 }
                 h4->rx_skb->dev = (void *) hu->hdev;
-                h4->rx_skb->pkt_type = type;
+                bt_cb(h4->rx_skb)->pkt_type = type;
         }
         return count;
 }
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 90be2eae52e0..aed80cc22890 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -153,7 +153,7 @@ restart:
                         break;
                 }
         
-                hci_uart_tx_complete(hu, skb->pkt_type);
+                hci_uart_tx_complete(hu, bt_cb(skb)->pkt_type);
                 kfree_skb(skb);
         } 
         
@@ -229,7 +229,7 @@ static int hci_uart_send_frame(struct sk_buff *skb)
         hu = (struct hci_uart *) hdev->driver_data;
         tty = hu->tty;
 
-        BT_DBG("%s: type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         hu->proto->enqueue(hu, skb);
 
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 65740346de36..67d96b5cbb96 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -443,7 +443,7 @@ static int __tx_submit(struct hci_usb *husb, struct _urb *_urb)
 
 static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct usb_ctrlrequest *dr;
         struct urb *urb;
 
@@ -451,7 +451,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
                 _urb = _urb_alloc(0, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
 
                 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
                 if (!dr) {
@@ -479,7 +479,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 
 static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct urb *urb;
         int pipe;
 
@@ -487,7 +487,7 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
                 _urb = _urb_alloc(0, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
         }
 
         urb  = &_urb->urb;
@@ -505,14 +505,14 @@ static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 #ifdef CONFIG_BT_HCIUSB_SCO
 static inline int hci_usb_send_isoc(struct hci_usb *husb, struct sk_buff *skb)
 {
-        struct _urb *_urb = __get_completed(husb, skb->pkt_type);
+        struct _urb *_urb = __get_completed(husb, bt_cb(skb)->pkt_type);
         struct urb *urb;
 
         if (!_urb) {
                 _urb = _urb_alloc(HCI_MAX_ISOC_FRAMES, GFP_ATOMIC);
                 if (!_urb)
                         return -ENOMEM;
-                _urb->type = skb->pkt_type;
+                _urb->type = bt_cb(skb)->pkt_type;
         }
 
         BT_DBG("%s skb %p len %d", husb->hdev->name, skb, skb->len);
@@ -601,11 +601,11 @@ static int hci_usb_send_frame(struct sk_buff *skb)
         if (!test_bit(HCI_RUNNING, &hdev->flags))
                 return -EBUSY;
 
-        BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         husb = (struct hci_usb *) hdev->driver_data;
 
-        switch (skb->pkt_type) {
+        switch (bt_cb(skb)->pkt_type) {
         case HCI_COMMAND_PKT:
                 hdev->stat.cmd_tx++;
                 break;
@@ -627,7 +627,7 @@ static int hci_usb_send_frame(struct sk_buff *skb)
 
         read_lock(&husb->completion_lock);
 
-        skb_queue_tail(__transmit_q(husb, skb->pkt_type), skb);
+        skb_queue_tail(__transmit_q(husb, bt_cb(skb)->pkt_type), skb);
         hci_usb_tx_wakeup(husb);
 
         read_unlock(&husb->completion_lock);
@@ -682,7 +682,7 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
                                 return -ENOMEM;
                         }
                         skb->dev = (void *) husb->hdev;
-                        skb->pkt_type = type;
+                        bt_cb(skb)->pkt_type = type;
         
                         __reassembly(husb, type) = skb;
 
@@ -702,6 +702,7 @@ static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int c
                 if (!scb->expect) {
                         /* Complete frame */
                         __reassembly(husb, type) = NULL;
+                        bt_cb(skb)->pkt_type = type;
                         hci_recv_frame(skb);
                 }
 
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 4aa5dfff12be..52cbd45c308f 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -107,7 +107,7 @@ static int vhci_send_frame(struct sk_buff *skb)
 
         vhci = hdev->driver_data;
 
-        memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
+        memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
         skb_queue_tail(&vhci->readq, skb);
 
         if (vhci->flags & VHCI_FASYNC)
@@ -141,7 +141,7 @@ static inline ssize_t vhci_get_user(struct vhci_data *vhci,
         }
 
         skb->dev = (void *) vhci->hdev;
-        skb->pkt_type = *((__u8 *) skb->data);
+        bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
         skb_pull(skb, 1);
 
         hci_recv_frame(skb);
@@ -164,18 +164,18 @@ static inline ssize_t vhci_put_user(struct vhci_data *vhci,
 
         vhci->hdev->stat.byte_tx += len;
 
-        switch (skb->pkt_type) {
-                case HCI_COMMAND_PKT:
-                        vhci->hdev->stat.cmd_tx++;
-                        break;
+        switch (bt_cb(skb)->pkt_type) {
+        case HCI_COMMAND_PKT:
+                vhci->hdev->stat.cmd_tx++;
+                break;
 
-                case HCI_ACLDATA_PKT:
-                        vhci->hdev->stat.acl_tx++;
-                        break;
+        case HCI_ACLDATA_PKT:
+                vhci->hdev->stat.acl_tx++;
+                break;
 
-                case HCI_SCODATA_PKT:
-                        vhci->hdev->stat.cmd_tx++;
-                        break;
+        case HCI_SCODATA_PKT:
+                vhci->hdev->stat.cmd_tx++;
+                break;
         };
 
         return total;
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 5309b6fa6690..6dfa4a61ffd0 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -131,7 +131,8 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
 struct bt_skb_cb {
-        int incoming;
+        __u8 pkt_type;
+        __u8 incoming;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)(skb->cb)) 
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ffa26c10bfe8..4f9e11b533a3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -191,7 +191,7 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 
         /* Special commands */
         while ((skb = skb_dequeue(&hdev->driver_init))) {
-                skb->pkt_type = HCI_COMMAND_PKT;
+                bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
                 skb->dev = (void *) hdev;
                 skb_queue_tail(&hdev->cmd_q, skb);
                 hci_sched_cmd(hdev);
@@ -995,7 +995,7 @@ static int hci_send_frame(struct sk_buff *skb)
                 return -ENODEV;
         }
 
-        BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         if (atomic_read(&hdev->promisc)) {
                 /* Time stamp */
@@ -1034,7 +1034,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 
         BT_DBG("skb len %d", skb->len);
 
-        skb->pkt_type = HCI_COMMAND_PKT;
+        bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
         skb_queue_tail(&hdev->cmd_q, skb);
         hci_sched_cmd(hdev);
@@ -1081,7 +1081,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
 
         skb->dev = (void *) hdev;
-        skb->pkt_type = HCI_ACLDATA_PKT;
+        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
 
         if (!(list = skb_shinfo(skb)->frag_list)) {
@@ -1103,7 +1103,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
                         skb = list; list = list->next;
                         
                         skb->dev = (void *) hdev;
-                        skb->pkt_type = HCI_ACLDATA_PKT;
+                        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
 
                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
@@ -1139,7 +1139,7 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
         memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
 
         skb->dev = (void *) hdev;
-        skb->pkt_type = HCI_SCODATA_PKT;
+        bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
         skb_queue_tail(&conn->data_q, skb);
         hci_sched_tx(hdev);
         return 0;
@@ -1369,7 +1369,7 @@ void hci_rx_task(unsigned long arg)
 
                 if (test_bit(HCI_INIT, &hdev->flags)) {
                         /* Don't process data packets in this states. */
-                        switch (skb->pkt_type) {
+                        switch (bt_cb(skb)->pkt_type) {
                         case HCI_ACLDATA_PKT:
                         case HCI_SCODATA_PKT:
                                 kfree_skb(skb);
@@ -1378,7 +1378,7 @@ void hci_rx_task(unsigned long arg)
                 }
 
                 /* Process frame */
-                switch (skb->pkt_type) {
+                switch (bt_cb(skb)->pkt_type) {
                 case HCI_EVENT_PKT:
                         hci_event_packet(hdev, skb);
                         break;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a004284c4d98..40b219560bb1 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1089,7 +1089,7 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         bt_cb(skb)->incoming = 1;
         do_gettimeofday(&skb->stamp);
 
-        skb->pkt_type = HCI_EVENT_PKT;
+        bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
         skb->dev = (void *) hdev;
         hci_send_to_sock(hdev, skb);
         kfree_skb(skb);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index ebdcce5e7ca0..eed9090d77f1 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -110,11 +110,11 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 /* Apply filter */
                 flt = &hci_pi(sk)->filter;
 
-                if (!test_bit((skb->pkt_type == HCI_VENDOR_PKT) ?
-                                0 : (skb->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
+                if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
+                                0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
                         continue;
 
-                if (skb->pkt_type == HCI_EVENT_PKT) {
+                if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
                         register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 
                         if (!hci_test_bit(evt, &flt->event_mask))
@@ -131,7 +131,7 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                         continue;
 
                 /* Put type byte before the data */
-                memcpy(skb_push(nskb, 1), &nskb->pkt_type, 1);
+                memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
 
                 if (sock_queue_rcv_skb(sk, nskb))
                         kfree_skb(nskb);
@@ -327,8 +327,10 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
 {
         __u32 mask = hci_pi(sk)->cmsg_mask;
 
-        if (mask & HCI_CMSG_DIR)
-                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(int), &bt_cb(skb)->incoming);
+        if (mask & HCI_CMSG_DIR) {
+                int incoming = bt_cb(skb)->incoming;
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
+        }
 
         if (mask & HCI_CMSG_TSTAMP)
                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
@@ -405,11 +407,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto drop;
         }
 
-        skb->pkt_type = *((unsigned char *) skb->data);
+        bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
         skb_pull(skb, 1);
         skb->dev = (void *) hdev;
 
-        if (skb->pkt_type == HCI_COMMAND_PKT) {
+        if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
                 u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
                 u16 ogf = hci_opcode_ogf(opcode);
                 u16 ocf = hci_opcode_ocf(opcode);