24 files changed, 71 insertions, 51 deletions

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 8510026b690a..d33aba6864c2 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1901,13 +1901,13 @@ he_service_rbrq(struct he_dev *he_dev, int group)
                         case ATM_AAL0:
                                 /* 2.10.1.5 raw cell receive */
                                 skb->len = ATM_AAL0_SDU;
-                                skb->tail = skb->data + skb->len;
+                                skb_set_tail_pointer(skb, skb->len);
                                 break;
                         case ATM_AAL5:
                                 /* 2.10.1.2 aal5 receive */
 
                                 skb->len = AAL5_LEN(skb->data, he_vcc->pdu_len);
-                                skb->tail = skb->data + skb->len;
+                                skb_set_tail_pointer(skb, skb->len);
 #ifdef USE_CHECKSUM_HW
                                 if (vcc->vpi == 0 && vcc->vci >= ATM_NOT_RSV_VCI) {
                                         skb->ip_summed = CHECKSUM_COMPLETE;
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index b4b80140c398..1e49799cd6cf 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1816,7 +1816,8 @@ push_rx_skb(struct idt77252_dev *card, struct sk_buff *skb, int queue)
         u32 handle;
         u32 addr;
 
-        skb->data = skb->tail = skb->head;
+        skb->data = skb->head;
+        skb_reset_tail_pointer(skb);
         skb->len = 0;
 
         skb_reserve(skb, 16);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index aab9b3733d52..26f4b7033494 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -2208,7 +2208,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          if (i == 1 && ns_rsqe_eopdu(rsqe))
             *((u32 *) sb->data) |= 0x00000002;
          skb_put(sb, NS_AAL0_HEADER);
-         memcpy(sb->tail, cell, ATM_CELL_PAYLOAD);
+         memcpy(skb_tail_pointer(sb), cell, ATM_CELL_PAYLOAD);
          skb_put(sb, ATM_CELL_PAYLOAD);
          ATM_SKB(sb)->vcc = vcc;
          __net_timestamp(sb);
@@ -2252,7 +2252,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
       vc->rx_iov = iovb;
       NS_SKB(iovb)->iovcnt = 0;
       iovb->len = 0;
-      iovb->tail = iovb->data = iovb->head;
+      iovb->data = iovb->head;
+      skb_reset_tail_pointer(iovb);
       NS_SKB(iovb)->vcc = vcc;
       /* IMPORTANT: a pointer to the sk_buff containing the small or large
                     buffer is stored as iovec base, NOT a pointer to the 
@@ -2265,7 +2266,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
       NS_SKB(iovb)->iovcnt = 0;
       iovb->len = 0;
-      iovb->tail = iovb->data = iovb->head;
+      iovb->data = iovb->head;
+      skb_reset_tail_pointer(iovb);
       NS_SKB(iovb)->vcc = vcc;
    }
    iov = &((struct iovec *) iovb->data)[NS_SKB(iovb)->iovcnt++];
@@ -2489,7 +2491,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             {
                lb = (struct sk_buff *) iov->iov_base;
                tocopy = min_t(int, remaining, iov->iov_len);
-               memcpy(hb->tail, lb->data, tocopy);
+               memcpy(skb_tail_pointer(hb), lb->data, tocopy);
                skb_put(hb, tocopy);
                iov++;
                remaining -= tocopy;
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 7698feafa6a7..58bc272bd407 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -439,7 +439,8 @@ static void c2_rx_error(struct c2_port *c2_port, struct c2_element *elem)
         }
 
         /* Setup the skb for reuse since we're dropping this pkt */
-        elem->skb->tail = elem->skb->data = elem->skb->head;
+        elem->skb->data = elem->skb->head;
+        skb_reset_tail_pointer(elem->skb);
 
         /* Zero out the rxp hdr in the sk_buff */
         memset(elem->skb->data, 0, sizeof(*rxp_hdr));
@@ -521,7 +522,7 @@ static void c2_rx_interrupt(struct net_device *netdev)
                  * "sizeof(struct c2_rxp_hdr)".
                  */
                 skb->data += sizeof(*rxp_hdr);
-                skb->tail = skb->data + buflen;
+                skb_set_tail_pointer(skb, buflen);
                 skb->len = buflen;
                 skb->protocol = eth_type_trans(skb, netdev);
 
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index cd3b1fa4a414..aa83277aba74 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -881,7 +881,7 @@ isdn_net_log_skb(struct sk_buff * skb, isdn_net_local * lp)
 
         addinfo[0] = '\0';
         /* This check stolen from 2.1.72 dev_queue_xmit_nit() */
-        if (p < skb->data || p >= skb->tail) {
+        if (p < skb->data || skb->network_header >= skb->tail) {
                 /* fall back to old isdn_net_log_packet method() */
                 char * buf = skb->data;
 
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index c6b004182d91..9de177a5b9f1 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -600,6 +600,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                         /* Check CRC32, we've got it in our skb already. */
                         unsigned short ulen = htons(priv->ule_sndu_len);
                         unsigned short utype = htons(priv->ule_sndu_type);
+                        const u8 *tail;
                         struct kvec iov[3] = {
                                 { &ulen, sizeof ulen },
                                 { &utype, sizeof utype },
@@ -613,10 +614,11 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                         }
 
                         ule_crc = iov_crc32(ule_crc, iov, 3);
-                        expected_crc = *((u8 *)priv->ule_skb->tail - 4) << 24 |
-                                       *((u8 *)priv->ule_skb->tail - 3) << 16 |
-                                       *((u8 *)priv->ule_skb->tail - 2) << 8 |
-                                       *((u8 *)priv->ule_skb->tail - 1);
+                        tail = skb_tail_pointer(priv->ule_skb);
+                        expected_crc = *(tail - 4) << 24 |
+                                       *(tail - 3) << 16 |
+                                       *(tail - 2) << 8 |
+                                       *(tail - 1);
                         if (ule_crc != expected_crc) {
                                 printk(KERN_WARNING "%lu: CRC32 check FAILED: %08x / %08x, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
                                        priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0);
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 98643801a3b0..7feb9c561147 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -1348,7 +1348,7 @@ e100_rx(struct net_device *dev)
 
 #ifdef ETHDEBUG
                 printk("head = 0x%x, data = 0x%x, tail = 0x%x, end = 0x%x\n",
-                  skb->head, skb->data, skb->tail, skb->end);
+                  skb->head, skb->data, skb_tail_pointer(skb), skb->end);
                 printk("copying packet to 0x%x.\n", skb_data_ptr);
 #endif
 
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 610e4769efa4..c5faf1380e15 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -1325,13 +1325,13 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
         flits = skb_transport_offset(skb) / 8;
         sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
         sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
-                             skb->tail - skb_transport_header(skb),
+                             skb->tail - skb->transport_header,
                              adap->pdev);
         if (need_skb_unmap()) {
                 setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
                 skb->destructor = deferred_unmap_destructor;
                 ((struct unmap_info *)skb->cb)->len = (skb->tail -
-                                                       skb_transport_header(skb));
+                                                       skb->transport_header);
         }
 
         write_wr_hdr_sgl(ndesc, skb, d, pidx, q, sgl, flits, sgl_flits,
@@ -1353,7 +1353,7 @@ static inline unsigned int calc_tx_descs_ofld(const struct sk_buff *skb)
                 return 1;       /* packet fits as immediate data */
 
         flits = skb_transport_offset(skb) / 8;  /* headers */
-        if (skb->tail != skb_transport_header(skb))
+        if (skb->tail != skb->transport_header)
                 cnt++;
         return flits_to_desc(flits + sgl_len(cnt));
 }
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index e86deb2ef823..e7c93f44f810 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3304,7 +3304,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                                  * NOTE: this is a TSO only workaround
                                  * if end byte alignment not correct move us
                                  * into the next dword */
-                                if ((unsigned long)(skb->tail - 1) & 4)
+                                if ((unsigned long)(skb_tail_pointer(skb) - 1) & 4)
                                         break;
                                 /* fall through */
                         case e1000_82571:
@@ -4388,7 +4388,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                                 PCI_DMA_FROMDEVICE);
                         vaddr = kmap_atomic(ps_page->ps_page[0],
                                             KM_SKB_DATA_SOFTIRQ);
-                        memcpy(skb->tail, vaddr, l1);
+                        memcpy(skb_tail_pointer(skb), vaddr, l1);
                         kunmap_atomic(vaddr, KM_SKB_DATA_SOFTIRQ);
                         pci_dma_sync_single_for_device(pdev,
                                 ps_page_dma->ps_page_dma[0],
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index b1ad62d89eb9..3d82d46f4998 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1338,7 +1338,7 @@ static inline int emac_rx_sg_append(struct ocp_enet_private *dev, int slot)
                         dev_kfree_skb(dev->rx_sg_skb);
                         dev->rx_sg_skb = NULL;
                 } else {
-                        cacheable_memcpy(dev->rx_sg_skb->tail,
+                        cacheable_memcpy(skb_tail_pointer(dev->rx_sg_skb),
                                          dev->rx_skb[slot]->data, len);
                         skb_put(dev->rx_sg_skb, len);
                         emac_recycle_rx_skb(dev, slot, len);
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 0c3649be0d05..98bf51afcee7 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -575,7 +575,8 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         int i;
         dev_dbg(&bp->pdev->dev,
                 "start_xmit: len %u head %p data %p tail %p end %p\n",
-                skb->len, skb->head, skb->data, skb->tail, skb->end);
+                skb->len, skb->head, skb->data,
+                skb_tail_pointer(skb), skb->end);
         dev_dbg(&bp->pdev->dev,
                 "data:");
         for (i = 0; i < 16; i++)
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index ec0af65cd5d7..73da611fd536 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -1185,7 +1185,7 @@ static int mace_rx(struct net_device *dev, unsigned char RxCnt)
         skb_reserve(skb, 2);
         insw(ioaddr + AM2150_RCV, skb_put(skb, pkt_len), pkt_len>>1);
         if (pkt_len & 1)
-            *(skb->tail-1) = inb(ioaddr + AM2150_RCV);
+            *(skb_tail_pointer(skb) - 1) = inb(ioaddr + AM2150_RCV);
         skb->protocol = eth_type_trans(skb, dev);
         
         netif_rx(skb); /* Send the packet to the upper (protocol) layers. */
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 46ebf141ee5a..600d3ff347fc 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2195,7 +2195,7 @@ static int fill_rxd_3buf(struct s2io_nic *nic, struct RxD_t *rxdp, struct \
         frag_list->next = NULL;
         tmp = (void *)ALIGN((long)frag_list->data, ALIGN_SIZE + 1);
         frag_list->data = tmp;
-        frag_list->tail = tmp;
+        skb_reset_tail_pointer(frag_list);
 
         /* Buffer-2 receives L4 data payload */
         ((struct RxD3*)rxdp)->Buffer2_ptr = pci_map_single(nic->pdev,
@@ -2349,7 +2349,7 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                         tmp += ALIGN_SIZE;
                         tmp &= ~ALIGN_SIZE;
                         skb->data = (void *) (unsigned long)tmp;
-                        skb->tail = (void *) (unsigned long)tmp;
+                        skb_reset_tail_pointer(skb);
 
                         if (!(((struct RxD3*)rxdp)->Buffer0_ptr))
                                 ((struct RxD3*)rxdp)->Buffer0_ptr =
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 9a5850fa644a..e46f4cb02c15 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -829,7 +829,9 @@ static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info
                                         != NULL) ) {
                                         /* size less than COPY_SIZE, allocate a rxlen SKB */
                                         skb_reserve(skb, 2); /* 16byte align */
-                                        memcpy(skb_put(skb, rxlen), rxptr->rx_skb_ptr->tail, rxlen);
+                                        memcpy(skb_put(skb, rxlen),
+                                               skb_tail_pointer(rxptr->rx_skb_ptr),
+                                               rxlen);
                                         uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
                                 } else
                                         skb_put(skb, rxlen);
@@ -1175,7 +1177,10 @@ static void uli526x_reuse_skb(struct uli526x_board_info *db, struct sk_buff * sk
 
         if (!(rxptr->rdes0 & cpu_to_le32(0x80000000))) {
                 rxptr->rx_skb_ptr = skb;
-                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                rxptr->rdes2 = cpu_to_le32(pci_map_single(db->pdev,
+                                                          skb_tail_pointer(skb),
+                                                          RX_ALLOC_SIZE,
+                                                          PCI_DMA_FROMDEVICE));
                 wmb();
                 rxptr->rdes0 = cpu_to_le32(0x80000000);
                 db->rx_avail_cnt++;
@@ -1339,7 +1344,10 @@ static void allocate_rx_buffer(struct uli526x_board_info *db)
                 if ( ( skb = dev_alloc_skb(RX_ALLOC_SIZE) ) == NULL )
                         break;
                 rxptr->rx_skb_ptr = skb; /* FIXME (?) */
-                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                rxptr->rdes2 = cpu_to_le32(pci_map_single(db->pdev,
+                                                          skb_tail_pointer(skb),
+                                                          RX_ALLOC_SIZE,
+                                                          PCI_DMA_FROMDEVICE));
                 wmb();
                 rxptr->rdes0 = cpu_to_le32(0x80000000);
                 rxptr = rxptr->next_rx_desc;
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index b747228c7198..aeb2789adf26 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -533,7 +533,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
                 skb->protocol = __constant_htons(NLPID_CCITT_ANSI_LMI);
                 fr_hard_header(&skb, LMI_CCITT_ANSI_DLCI);
         }
-        data = skb->tail;
+        data = skb_tail_pointer(skb);
         data[i++] = LMI_CALLREF;
         data[i++] = dce ? LMI_STATUS : LMI_STATUS_ENQUIRY;
         if (lmi == LMI_ANSI)
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index d4851465c83b..b731f3aae0df 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1636,7 +1636,7 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             if (nsb) {
                 sc->lmc_rxq[i] = nsb;
                 nsb->dev = dev;
-                sc->lmc_rxring[i].buffer1 = virt_to_bus (nsb->tail);
+                sc->lmc_rxring[i].buffer1 = virt_to_bus(skb_tail_pointer(nsb));
             }
             sc->failed_recv_alloc = 1;
             goto skip_packet;
@@ -1679,7 +1679,7 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             if (nsb) {
                 sc->lmc_rxq[i] = nsb;
                 nsb->dev = dev;
-                sc->lmc_rxring[i].buffer1 = virt_to_bus (nsb->tail);
+                sc->lmc_rxring[i].buffer1 = virt_to_bus(skb_tail_pointer(nsb));
                 /* Transferred to 21140 below */
             }
             else {
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 35a3a50724fe..5e3e9e262706 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -922,7 +922,7 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                 if (frag != 0)
                         flen -= hdrlen;
 
-                if (frag_skb->tail + flen > frag_skb->end) {
+                if (skb_tail_pointer(frag_skb) + flen > frag_skb->end) {
                         printk(KERN_WARNING "%s: host decrypted and "
                                "reassembled frame did not fit skb\n",
                                dev->name);
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 787c01317042..54e3f806cd52 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -706,7 +706,8 @@ ch_action_txdone(fsm_instance * fi, int event, void *arg)
                         spin_unlock(&ch->collect_lock);
                         return;
                 }
-                ch->trans_skb->tail = ch->trans_skb->data = ch->trans_skb_data;
+                ch->trans_skb->data = ch->trans_skb_data;
+                skb_reset_tail_pointer(ch->trans_skb);
                 ch->trans_skb->len = 0;
                 if (ch->prof.maxmulti < (ch->collect_len + 2))
                         ch->prof.maxmulti = ch->collect_len + 2;
@@ -831,7 +832,8 @@ ch_action_rx(fsm_instance * fi, int event, void *arg)
                 ctc_unpack_skb(ch, skb);
         }
  again:
-        skb->data = skb->tail = ch->trans_skb_data;
+        skb->data = ch->trans_skb_data;
+        skb_reset_tail_pointer(skb);
         skb->len = 0;
         if (ctc_checkalloc_buffer(ch, 1))
                 return;
@@ -2226,7 +2228,8 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                  * IDAL support in CTC is broken, so we have to
                  * care about skb's above 2G ourselves.
                  */
-                hi = ((unsigned long) skb->tail + LL_HEADER_LENGTH) >> 31;
+                hi = ((unsigned long)skb_tail_pointer(skb) +
+                      LL_HEADER_LENGTH) >> 31;
                 if (hi) {
                         nskb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                         if (!nskb) {
@@ -2262,7 +2265,7 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                                 return -EBUSY;
                         }
 
-                        ch->trans_skb->tail = ch->trans_skb->data;
+                        skb_reset_tail_pointer(ch->trans_skb);
                         ch->trans_skb->len = 0;
                         ch->ccw[1].count = skb->len;
                         memcpy(skb_put(ch->trans_skb, skb->len), skb->data,
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 82edf2014402..cd42bd54988c 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -689,7 +689,8 @@ static void conn_action_rx(fsm_instance *fi, int event, void *arg)
                                msg->length, conn->max_buffsize);
                 return;
         }
-        conn->rx_buff->data = conn->rx_buff->tail = conn->rx_buff->head;
+        conn->rx_buff->data = conn->rx_buff->head;
+        skb_reset_tail_pointer(conn->rx_buff);
         conn->rx_buff->len = 0;
         rc = iucv_message_receive(conn->path, msg, 0, conn->rx_buff->data,
                                   msg->length, NULL);
@@ -735,7 +736,8 @@ static void conn_action_txdone(fsm_instance *fi, int event, void *arg)
                         }
                 }
         }
-        conn->tx_buff->data = conn->tx_buff->tail = conn->tx_buff->head;
+        conn->tx_buff->data = conn->tx_buff->head;
+        skb_reset_tail_pointer(conn->tx_buff);
         conn->tx_buff->len = 0;
         spin_lock_irqsave(&conn->collect_lock, saveflags);
         while ((skb = skb_dequeue(&conn->collect_queue))) {
@@ -1164,8 +1166,8 @@ static int netiucv_transmit_skb(struct iucv_connection *conn,
                  * Copy the skb to a new allocated skb in lowmem only if the
                  * data is located above 2G in memory or tailroom is < 2.
                  */
-                unsigned long hi =
-                        ((unsigned long)(skb->tail + NETIUCV_HDRLEN)) >> 31;
+                unsigned long hi = ((unsigned long)(skb_tail_pointer(skb) +
+                                    NETIUCV_HDRLEN)) >> 31;
                 int copied = 0;
                 if (hi || (skb_tailroom(skb) < 2)) {
                         nskb = alloc_skb(skb->len + NETIUCV_HDRLEN +
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index ec63b0ee0743..4d8f282b23d1 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -335,15 +335,15 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
 
         sarb = instance->cached_vcc->sarb;
 
-        if (sarb->tail + ATM_CELL_PAYLOAD > sarb->end) {
+        if (skb_tail_pointer(sarb) + ATM_CELL_PAYLOAD > sarb->end) {
                 atm_rldbg(instance, "%s: buffer overrun (sarb->len %u, vcc: 0x%p)!\n",
                                 __func__, sarb->len, vcc);
                 /* discard cells already received */
                 skb_trim(sarb, 0);
-                UDSL_ASSERT(sarb->tail + ATM_CELL_PAYLOAD <= sarb->end);
+                UDSL_ASSERT(skb_tail_pointer(sarb) + ATM_CELL_PAYLOAD <= sarb->end);
         }
 
-        memcpy(sarb->tail, source + ATM_CELL_HEADER, ATM_CELL_PAYLOAD);
+        memcpy(skb_tail_pointer(sarb), source + ATM_CELL_HEADER, ATM_CELL_PAYLOAD);
         __skb_put(sarb, ATM_CELL_PAYLOAD);
 
         if (pti & 1) {
@@ -370,7 +370,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
                         goto out;
                 }
 
-                if (crc32_be(~0, sarb->tail - pdu_length, pdu_length) != 0xc704dd7b) {
+                if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
                         atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
                                   __func__, vcc);
                         atomic_inc(&vcc->stats->rx_err);
@@ -396,7 +396,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
                         goto out;       /* atm_charge increments rx_drop */
                 }
 
-                memcpy(skb->data, sarb->tail - pdu_length, length);
+                memcpy(skb->data, skb_tail_pointer(sarb) - pdu_length, length);
                 __skb_put(skb, length);
 
                 vdbg("%s: sending skb 0x%p, skb->len %u, skb->truesize %u",
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index 5808ea082459..f56e2dab3712 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -298,7 +298,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 if (ax_skb) {
                         ax_skb->len = size;
                         ax_skb->data = packet;
-                        ax_skb->tail = packet + size;
+                        skb_set_tail_pointer(ax_skb, size);
                         usbnet_skb_return(dev, ax_skb);
                 } else {
                         return 0;
@@ -338,7 +338,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
             && ((headroom + tailroom) >= (4 + padlen))) {
                 if ((headroom < 4) || (tailroom < padlen)) {
                         skb->data = memmove(skb->head + 4, skb->data, skb->len);
-                        skb->tail = skb->data + skb->len;
+                        skb_set_tail_pointer(skb, skb->len);
                 }
         } else {
                 struct sk_buff *skb2;
@@ -356,7 +356,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 
         if ((skb->len % 512) == 0) {
                 cpu_to_le32s(&padbytes);
-                memcpy( skb->tail, &padbytes, sizeof(padbytes));
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                 skb_put(skb, sizeof(padbytes));
         }
         return skb;
diff --git a/drivers/usb/net/gl620a.c b/drivers/usb/net/gl620a.c
index d257a8e026d6..031cf5ca4dbb 100644
--- a/drivers/usb/net/gl620a.c
+++ b/drivers/usb/net/gl620a.c
@@ -157,7 +157,7 @@ genelink_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                 if ((headroom < (4 + 4*1)) || (tailroom < padlen)) {
                         skb->data = memmove(skb->head + (4 + 4*1),
                                              skb->data, skb->len);
-                        skb->tail = skb->data + skb->len;
+                        skb_set_tail_pointer(skb, skb->len);
                 }
         } else {
                 struct sk_buff  *skb2;
diff --git a/drivers/usb/net/net1080.c b/drivers/usb/net/net1080.c
index ccebfdef4751..19bf8dae70c9 100644
--- a/drivers/usb/net/net1080.c
+++ b/drivers/usb/net/net1080.c
@@ -520,7 +520,7 @@ net1080_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                         skb->data = memmove(skb->head
                                                 + sizeof (struct nc_header),
                                             skb->data, skb->len);
-                        skb->tail = skb->data + len;
+                        skb_set_tail_pointer(skb, len);
                         goto encapsulate;
                 }
         }
diff --git a/drivers/usb/net/rndis_host.c b/drivers/usb/net/rndis_host.c
index 39a21c74fdf4..1d36772ba6e1 100644
--- a/drivers/usb/net/rndis_host.c
+++ b/drivers/usb/net/rndis_host.c
@@ -588,7 +588,7 @@ rndis_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                 if (likely((sizeof *hdr) <= room)) {
                         skb->data = memmove(skb->head + sizeof *hdr,
                                             skb->data, len);
-                        skb->tail = skb->data + len;
+                        skb_set_tail_pointer(skb, len);
                         goto fill;
                 }
         }