5 files changed, 15 insertions, 6 deletions

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 31c59387a6fc..0ddaff0df217 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -66,7 +66,9 @@ static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
 
                                         /* Copy data from the fragments */
                                         while ((skbo = skb_dequeue(&ax25->frag_queue)) != NULL) {
-                                                memcpy(skb_put(skbn, skbo->len), skbo->data, skbo->len);
+                                                skb_copy_from_linear_data(skbo,
+                                                          skb_put(skbn, skbo->len),
+                                                                          skbo->len);
                                                 kfree_skb(skbo);
                                         }
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 9e8256a2361e..2ee47bab6938 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -48,7 +48,7 @@ static struct sk_buff *dnrmg_build_message(struct sk_buff *rt_skb, int *errp)
         rtm = (struct nf_dn_rtmsg *)NLMSG_DATA(nlh);
         rtm->nfdn_ifindex = rt_skb->dev->ifindex;
         ptr = NFDN_RTMSG(rtm);
-        memcpy(ptr, rt_skb->data, rt_skb->len);
+        skb_copy_from_linear_data(rt_skb, ptr, rt_skb->len);
         nlh->nlmsg_len = skb->tail - old_tail;
         return skb;
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c22cdcd84320..94d9f0c63682 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1645,7 +1645,9 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
                 /* Ok.  We will be able to collapse the packet. */
                 tcp_unlink_write_queue(next_skb, sk);
 
-                memcpy(skb_put(skb, next_skb_size), next_skb->data, next_skb_size);
+                skb_copy_from_linear_data(next_skb,
+                                          skb_put(skb, next_skb_size),
+                                          next_skb_size);
 
                 if (next_skb->ip_summed == CHECKSUM_PARTIAL)
                         skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index e6dc749e14be..68176483617f 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -54,7 +54,9 @@ static int nr_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
                 skb_reset_transport_header(skbn);
 
                 while ((skbo = skb_dequeue(&nr->frag_queue)) != NULL) {
-                        memcpy(skb_put(skbn, skbo->len), skbo->data, skbo->len);
+                        skb_copy_from_linear_data(skbo,
+                                                  skb_put(skbn, skbo->len),
+                                                  skbo->len);
                         kfree_skb(skbo);
                 }
 
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index ba13248aa1c3..1c88762c2794 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -56,14 +56,17 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
                 skb_reset_transport_header(skbn);
 
                 skbo = skb_dequeue(&x25->fragment_queue);
-                memcpy(skb_put(skbn, skbo->len), skbo->data, skbo->len);
+                skb_copy_from_linear_data(skbo, skb_put(skbn, skbo->len),
+                                          skbo->len);
                 kfree_skb(skbo);
 
                 while ((skbo =
                         skb_dequeue(&x25->fragment_queue)) != NULL) {
                         skb_pull(skbo, (x25->neighbour->extended) ?
                                         X25_EXT_MIN_LEN : X25_STD_MIN_LEN);
-                        memcpy(skb_put(skbn, skbo->len), skbo->data, skbo->len);
+                        skb_copy_from_linear_data(skbo,
+                                                  skb_put(skbn, skbo->len),
+                                                  skbo->len);
                         kfree_skb(skbo);
                 }