1 files changed, 9 insertions, 16 deletions

diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9647d911f916..a5e3a593e472 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1075,6 +1075,7 @@ static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
         int err = 0;
         unsigned char type;
         long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+        struct dst_entry *dst;
 
         lock_sock(sk);
 
@@ -1102,8 +1103,9 @@ static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
         }
         release_sock(sk);
 
-        dst_release(xchg(&newsk->sk_dst_cache, skb->dst));
-        skb->dst = NULL;
+        dst = skb_dst(skb);
+        dst_release(xchg(&newsk->sk_dst_cache, dst));
+        skb_dst_set(skb, NULL);
 
         DN_SK(newsk)->state        = DN_CR;
         DN_SK(newsk)->addrrem      = cb->src_port;
@@ -1250,14 +1252,8 @@ static int dn_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 if (skb) {
                         amount = skb->len;
                 } else {
-                        skb = sk->sk_receive_queue.next;
-                        for (;;) {
-                                if (skb ==
-                                    (struct sk_buff *)&sk->sk_receive_queue)
-                                        break;
+                        skb_queue_walk(&sk->sk_receive_queue, skb)
                                 amount += skb->len;
-                                skb = skb->next;
-                        }
                 }
                 release_sock(sk);
                 err = put_user(amount, (int __user *)arg);
@@ -1644,13 +1640,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
 
 static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int target)
 {
-        struct sk_buff *skb = q->next;
+        struct sk_buff *skb;
         int len = 0;
 
         if (flags & MSG_OOB)
                 return !skb_queue_empty(q) ? 1 : 0;
 
-        while(skb != (struct sk_buff *)q) {
+        skb_queue_walk(q, skb) {
                 struct dn_skb_cb *cb = DN_SKB_CB(skb);
                 len += skb->len;
 
@@ -1666,8 +1662,6 @@ static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int
                 /* minimum data length for read exceeded */
                 if (len >= target)
                         return 1;
-
-                skb = skb->next;
         }
 
         return 0;
@@ -1683,7 +1677,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
         size_t target = size > 1 ? 1 : 0;
         size_t copied = 0;
         int rv = 0;
-        struct sk_buff *skb, *nskb;
+        struct sk_buff *skb, *n;
         struct dn_skb_cb *cb = NULL;
         unsigned char eor = 0;
         long timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
@@ -1758,7 +1752,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                 finish_wait(sk->sk_sleep, &wait);
         }
 
-        for(skb = queue->next; skb != (struct sk_buff *)queue; skb = nskb) {
+        skb_queue_walk_safe(queue, skb, n) {
                 unsigned int chunk = skb->len;
                 cb = DN_SKB_CB(skb);
 
@@ -1775,7 +1769,6 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                         skb_pull(skb, chunk);
 
                 eor = cb->nsp_flags & 0x40;
-                nskb = skb->next;
 
                 if (skb->len == 0) {
                         skb_unlink(skb, queue);