7 files changed, 19 insertions, 20 deletions

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7aff380e74ef..35905867ded1 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -42,21 +42,18 @@
 static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
-        int hdr_len;
         struct ipv6hdr *top_iph;
         struct ipv6_esp_hdr *esph;
         struct crypto_blkcipher *tfm;
         struct blkcipher_desc desc;
-        struct esp_data *esp;
         struct sk_buff *trailer;
         int blksize;
         int clen;
         int alen;
         int nfrags;
-
-        esp = x->data;
-        hdr_len = skb->h.raw - skb->data +
-                  sizeof(*esph) + esp->conf.ivlen;
+        struct esp_data *esp = x->data;
+        int hdr_len = (skb_transport_offset(skb) +
+                       sizeof(*esph) + esp->conf.ivlen);
 
         /* Strip IP+ESP header. */
         __skb_pull(skb, hdr_len);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index dab069b0b3f6..1bda0299890e 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -146,7 +146,7 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
         int off = skb->h.raw - skb->nh.raw;
         int len = ((skb->h.raw[1]+1)<<3);
 
-        if ((skb->h.raw + len) - skb->data > skb_headlen(skb))
+        if (skb_transport_offset(skb) + len > skb_headlen(skb))
                 goto bad;
 
         off += 2;
@@ -288,8 +288,9 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 #endif
         struct dst_entry *dst;
 
-        if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
-            !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
+        if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
+            !pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 ((skb->h.raw[1] + 1) << 3)))) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
@@ -387,8 +388,9 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         in6_dev_put(idev);
 
-        if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
-            !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
+        if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
+            !pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 ((skb->h.raw[1] + 1) << 3)))) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 2dd32a2ca056..44275411d1a8 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -160,7 +160,7 @@ static inline int ip6_input_finish(struct sk_buff *skb)
         rcu_read_lock();
 resubmit:
         idev = ip6_dst_idev(skb->dst);
-        if (!pskb_pull(skb, skb->h.raw - skb->data))
+        if (!pskb_pull(skb, skb_transport_offset(skb)))
                 goto discard;
         nhoff = IP6CB(skb)->nhoff;
         nexthdr = skb_network_header(skb)[nhoff];
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index e2404a629680..4a6501695e98 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -124,15 +124,13 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
         struct ipv6hdr *top_iph;
-        int hdr_len;
         struct ipv6_comp_hdr *ipch;
         struct ipcomp_data *ipcd = x->data;
         int plen, dlen;
         u8 *start, *scratch;
         struct crypto_comp *tfm;
         int cpu;
-
-        hdr_len = skb->h.raw - skb->data;
+        int hdr_len = skb_transport_offset(skb);
 
         /* check whether datagram len is larger than threshold */
         if ((skb->len - hdr_len) < ipcd->threshold) {
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 7b5f9d82e801..85202891644e 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -90,8 +90,9 @@ int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
         struct ip6_mh *mh;
 
-        if (!pskb_may_pull(skb, (skb->h.raw - skb->data) + 8) ||
-            !pskb_may_pull(skb, (skb->h.raw - skb->data) + ((skb->h.raw[1] + 1) << 3)))
+        if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
+            !pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 ((skb->h.raw[1] + 1) << 3))))
                 return -1;
 
         mh = (struct ip6_mh *)skb->h.raw;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 0e2b56ce0a56..bb049f1c2679 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -513,7 +513,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                         if (csum_skb)
                                 continue;
 
-                        len = skb->len - (skb->h.raw - skb->data);
+                        len = skb->len - skb_transport_offset(skb);
                         if (offset >= len) {
                                 offset -= len;
                                 continue;
@@ -525,7 +525,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                 skb = csum_skb;
         }
 
-        offset += skb->h.raw - skb->data;
+        offset += skb_transport_offset(skb);
         if (skb_copy_bits(skb, offset, &csum, 2))
                 BUG();
 
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 2594f0fb290d..ef29a7bb97ce 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -718,7 +718,8 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
                 return -1;
         }
-        if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+sizeof(struct frag_hdr))) {
+        if (!pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 sizeof(struct frag_hdr)))) {
                 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
                 return -1;