20 files changed, 161 insertions, 108 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 2ff070417955..7b917f856e1c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -693,7 +693,8 @@ int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
         if (np->rxopt.all) {
                 if ((opt->hop && (np->rxopt.bits.hopopts ||
                                   np->rxopt.bits.ohopopts)) ||
-                    ((IPV6_FLOWINFO_MASK & *(__be32*)skb->nh.raw) &&
+                    ((IPV6_FLOWINFO_MASK &
+                      *(__be32 *)skb_network_header(skb)) &&
                      np->rxopt.bits.rxflow) ||
                     (opt->srcrt && (np->rxopt.bits.srcrt ||
                      np->rxopt.bits.osrcrt)) ||
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index dc68b7269c3c..1c914386982f 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -238,8 +238,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph = (struct ipv6hdr *)skb->data;
         top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
 
-        nexthdr = *skb->nh.raw;
-        *skb->nh.raw = IPPROTO_AH;
+        nexthdr = *skb_network_header(skb);
+        *skb_network_header(skb) = IPPROTO_AH;
 
         /* When there are no extension headers, we only need to save the first
          * 8 bytes of the base IP header.
@@ -341,7 +341,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
             pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                 goto out;
 
-        hdr_len = skb->data - skb->nh.raw;
+        hdr_len = skb->data - skb_network_header(skb);
         ah = (struct ipv6_auth_hdr*)skb->data;
         ahp = x->data;
         nexthdr = ah->nexthdr;
@@ -354,7 +354,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
 
-        tmp_hdr = kmemdup(skb->nh.raw, hdr_len, GFP_ATOMIC);
+        tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC);
         if (!tmp_hdr)
                 goto out;
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
@@ -382,7 +382,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
                 }
         }
 
-        skb->h.raw = memcpy(skb->nh.raw += ah_hlen, tmp_hdr, hdr_len);
+        skb->nh.raw += ah_hlen;
+        memcpy(skb_network_header(skb), tmp_hdr, hdr_len);
+        skb->h.raw = skb->nh.raw;
         __skb_pull(skb, ah_hlen + hdr_len);
 
         kfree(tmp_hdr);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 31a20f17c854..7a86db6163ee 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -227,7 +227,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
         serr->ee.ee_pad = 0;
         serr->ee.ee_info = info;
         serr->ee.ee_data = 0;
-        serr->addr_offset = (u8*)&(((struct ipv6hdr*)(icmph+1))->daddr) - skb->nh.raw;
+        serr->addr_offset = (u8 *)&(((struct ipv6hdr *)(icmph + 1))->daddr) -
+                                  skb_network_header(skb);
         serr->port = port;
 
         skb->h.raw = payload;
@@ -264,7 +265,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         serr->ee.ee_pad = 0;
         serr->ee.ee_info = info;
         serr->ee.ee_data = 0;
-        serr->addr_offset = (u8*)&iph->daddr - skb->nh.raw;
+        serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = fl->fl_ip_dport;
 
         skb->h.raw = skb->tail;
@@ -310,21 +311,24 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
 
         sin = (struct sockaddr_in6 *)msg->msg_name;
         if (sin) {
+                const unsigned char *nh = skb_network_header(skb);
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
                 if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
                         ipv6_addr_copy(&sin->sin6_addr,
-                          (struct in6_addr *)(skb->nh.raw + serr->addr_offset));
+                                  (struct in6_addr *)(nh + serr->addr_offset));
                         if (np->sndflow)
-                                sin->sin6_flowinfo = *(__be32*)(skb->nh.raw + serr->addr_offset - 24) & IPV6_FLOWINFO_MASK;
+                                sin->sin6_flowinfo =
+                                        (*(__be32 *)(nh + serr->addr_offset - 24) &
+                                         IPV6_FLOWINFO_MASK);
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
                         ipv6_addr_set(&sin->sin6_addr, 0, 0,
                                       htonl(0xffff),
-                                      *(__be32*)(skb->nh.raw + serr->addr_offset));
+                                      *(__be32 *)(nh + serr->addr_offset));
                 }
         }
 
@@ -382,6 +386,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet6_skb_parm *opt = IP6CB(skb);
+        unsigned char *nh = skb_network_header(skb);
 
         if (np->rxopt.bits.rxinfo) {
                 struct in6_pktinfo src_info;
@@ -401,14 +406,14 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
         }
 
-        if (np->rxopt.bits.rxflow && (*(__be32*)skb->nh.raw & IPV6_FLOWINFO_MASK)) {
-                __be32 flowinfo = *(__be32*)skb->nh.raw & IPV6_FLOWINFO_MASK;
+        if (np->rxopt.bits.rxflow && (*(__be32 *)nh & IPV6_FLOWINFO_MASK)) {
+                __be32 flowinfo = *(__be32 *)nh & IPV6_FLOWINFO_MASK;
                 put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
         }
 
         /* HbH is allowed only once */
         if (np->rxopt.bits.hopopts && opt->hop) {
-                u8 *ptr = skb->nh.raw + opt->hop;
+                u8 *ptr = nh + opt->hop;
                 put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr);
         }
 
@@ -428,7 +433,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
 
                 while (off <= opt->lastopt) {
                         unsigned len;
-                        u8 *ptr = skb->nh.raw + off;
+                        u8 *ptr = nh + off;
 
                         switch(nexthdr) {
                         case IPPROTO_DSTOPTS:
@@ -470,19 +475,19 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 put_cmsg(msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
         }
         if (np->rxopt.bits.ohopopts && opt->hop) {
-                u8 *ptr = skb->nh.raw + opt->hop;
+                u8 *ptr = nh + opt->hop;
                 put_cmsg(msg, SOL_IPV6, IPV6_2292HOPOPTS, (ptr[1]+1)<<3, ptr);
         }
         if (np->rxopt.bits.odstopts && opt->dst0) {
-                u8 *ptr = skb->nh.raw + opt->dst0;
+                u8 *ptr = nh + opt->dst0;
                 put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
         }
         if (np->rxopt.bits.osrcrt && opt->srcrt) {
-                struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(skb->nh.raw + opt->srcrt);
+                struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(nh + opt->srcrt);
                 put_cmsg(msg, SOL_IPV6, IPV6_2292RTHDR, (rthdr->hdrlen+1) << 3, rthdr);
         }
         if (np->rxopt.bits.odstopts && opt->dst1) {
-                u8 *ptr = skb->nh.raw + opt->dst1;
+                u8 *ptr = nh + opt->dst1;
                 put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
         }
         return 0;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 363e63ffecca..6e6b57ac8013 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -92,8 +92,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
         esph = (struct ipv6_esp_hdr *)skb->h.raw;
         top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
-        *(u8*)(trailer->tail - 1) = *skb->nh.raw;
-        *skb->nh.raw = IPPROTO_ESP;
+        *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
+        *skb_network_header(skb) = IPPROTO_ESP;
 
         esph->spi = x->id.spi;
         esph->seq_no = htonl(++x->replay.oseq);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index fce5abde554f..9ebf120ba6d3 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -50,13 +50,14 @@
 
 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
 {
-        int packet_len = skb->tail - skb->nh.raw;
+        const unsigned char *nh = skb_network_header(skb);
+        int packet_len = skb->tail - nh;
         struct ipv6_opt_hdr *hdr;
         int len;
 
         if (offset + 2 > packet_len)
                 goto bad;
-        hdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        hdr = (struct ipv6_opt_hdr *)(nh + offset);
         len = ((hdr->hdrlen + 1) << 3);
 
         if (offset + len > packet_len)
@@ -66,7 +67,7 @@ int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
         len -= 2;
 
         while (len > 0) {
-                int opttype = skb->nh.raw[offset];
+                int opttype = nh[offset];
                 int optlen;
 
                 if (opttype == type)
@@ -77,7 +78,7 @@ int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
                         optlen = 1;
                         break;
                 default:
-                        optlen = skb->nh.raw[offset + 1] + 2;
+                        optlen = nh[offset + 1] + 2;
                         if (optlen > len)
                                 goto bad;
                         break;
@@ -113,7 +114,7 @@ static int ip6_tlvopt_unknown(struct sk_buff **skbp, int optoff)
 {
         struct sk_buff *skb = *skbp;
 
-        switch ((skb->nh.raw[optoff] & 0xC0) >> 6) {
+        switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
         case 0: /* ignore */
                 return 1;
 
@@ -141,6 +142,7 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
 {
         struct sk_buff *skb = *skbp;
         struct tlvtype_proc *curr;
+        const unsigned char *nh = skb_network_header(skb);
         int off = skb->h.raw - skb->nh.raw;
         int len = ((skb->h.raw[1]+1)<<3);
 
@@ -151,9 +153,9 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
         len -= 2;
 
         while (len > 0) {
-                int optlen = skb->nh.raw[off+1]+2;
+                int optlen = nh[off + 1] + 2;
 
-                switch (skb->nh.raw[off]) {
+                switch (nh[off]) {
                 case IPV6_TLV_PAD0:
                         optlen = 1;
                         break;
@@ -165,7 +167,7 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
                         if (optlen > len)
                                 goto bad;
                         for (curr=procs; curr->type >= 0; curr++) {
-                                if (curr->type == skb->nh.raw[off]) {
+                                if (curr->type == nh[off]) {
                                         /* type specific length/alignment
                                            checks will be performed in the
                                            func(). */
@@ -211,7 +213,7 @@ static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
         opt->dsthao = opt->dst1;
         opt->dst1 = 0;
 
-        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + optoff);
+        hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 
         if (hao->length != 16) {
                 LIMIT_NETDEBUG(
@@ -244,8 +246,9 @@ static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
 
                 /* update all variable using below by copied skbuff */
                 *skbp = skb = skb2;
-                hao = (struct ipv6_destopt_hao *)(skb2->nh.raw + optoff);
-                ipv6h = (struct ipv6hdr *)skb2->nh.raw;
+                hao = (struct ipv6_destopt_hao *)(skb_network_header(skb2) +
+                                                  optoff);
+                ipv6h = skb2->nh.ipv6h;
         }
 
         if (skb->ip_summed == CHECKSUM_COMPLETE)
@@ -406,7 +409,8 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
         default:
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
+                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+                                  (&hdr->type) - skb_network_header(skb));
                 return -1;
         }
 
@@ -443,7 +447,7 @@ looped_back:
                 skb->h.raw += (hdr->hdrlen + 1) << 3;
                 opt->dst0 = opt->dst1;
                 opt->dst1 = 0;
-                opt->nhoff = (&hdr->nexthdr) - skb->nh.raw;
+                opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
                 return 1;
         }
 
@@ -452,7 +456,9 @@ looped_back:
                 if (hdr->hdrlen & 0x01) {
                         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                          IPSTATS_MIB_INHDRERRORS);
-                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
+                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+                                          ((&hdr->hdrlen) -
+                                           skb_network_header(skb)));
                         return -1;
                 }
                 break;
@@ -479,7 +485,9 @@ looped_back:
         if (hdr->segments_left > n) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->segments_left) - skb->nh.raw);
+                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+                                  ((&hdr->segments_left) -
+                                   skb_network_header(skb)));
                 return -1;
         }
 
@@ -547,7 +555,7 @@ looped_back:
         dst_release(xchg(&skb->dst, NULL));
         ip6_route_input(skb);
         if (skb->dst->error) {
-                skb_push(skb, skb->data - skb->nh.raw);
+                skb_push(skb, skb->data - skb_network_header(skb));
                 dst_input(skb);
                 return -1;
         }
@@ -565,7 +573,7 @@ looped_back:
                 goto looped_back;
         }
 
-        skb_push(skb, skb->data - skb->nh.raw);
+        skb_push(skb, skb->data - skb_network_header(skb));
         dst_input(skb);
         return -1;
 }
@@ -656,13 +664,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
 static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
 {
         struct sk_buff *skb = *skbp;
+        const unsigned char *nh = skb_network_header(skb);
 
-        if (skb->nh.raw[optoff+1] == 2) {
+        if (nh[optoff + 1] == 2) {
                 IP6CB(skb)->ra = optoff;
                 return 1;
         }
         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
-                       skb->nh.raw[optoff+1]);
+                       nh[optoff + 1]);
         kfree_skb(skb);
         return 0;
 }
@@ -672,17 +681,18 @@ static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
 static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
 {
         struct sk_buff *skb = *skbp;
+        const unsigned char *nh = skb_network_header(skb);
         u32 pkt_len;
 
-        if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
+        if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
-                               skb->nh.raw[optoff+1]);
+                               nh[optoff+1]);
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 goto drop;
         }
 
-        pkt_len = ntohl(*(__be32*)(skb->nh.raw+optoff+2));
+        pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
         if (pkt_len <= IPV6_MAXPLEN) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
@@ -727,7 +737,7 @@ int ipv6_parse_hopopts(struct sk_buff **skbp)
         struct inet6_skb_parm *opt = IP6CB(skb);
 
         /*
-         * skb->nh.raw is equal to skb->data, and
+         * skb_network_header(skb) is equal to skb->data, and
          * skb->h.raw - skb->nh.raw is always equal to
          * sizeof(struct ipv6hdr) by definition of
          * hop-by-hop options.
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index aa4a0a59ffac..e5293b34229f 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -284,7 +284,8 @@ static void mip6_addr_swap(struct sk_buff *skb)
         if (opt->dsthao) {
                 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
                 if (likely(off >= 0)) {
-                        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + off);
+                        hao = (struct ipv6_destopt_hao *)
+                                        (skb_network_header(skb) + off);
                         ipv6_addr_copy(&tmp, &iph->saddr);
                         ipv6_addr_copy(&iph->saddr, &hao->addr);
                         ipv6_addr_copy(&hao->addr, &tmp);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 61e7a6c8141d..aecc74da0721 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -163,7 +163,7 @@ resubmit:
         if (!pskb_pull(skb, skb->h.raw - skb->data))
                 goto discard;
         nhoff = IP6CB(skb)->nhoff;
-        nexthdr = skb->nh.raw[nhoff];
+        nexthdr = skb_network_header(skb)[nhoff];
 
         raw_sk = sk_head(&raw_v6_htable[nexthdr & (MAX_INET_PROTOS - 1)]);
         if (raw_sk && !ipv6_raw_deliver(skb, nexthdr))
@@ -181,7 +181,7 @@ resubmit:
                            indefinitely. */
                         nf_reset(skb);
 
-                        skb_postpull_rcsum(skb, skb->nh.raw,
+                        skb_postpull_rcsum(skb, skb_network_header(skb),
                                            skb->h.raw - skb->nh.raw);
                         hdr = skb->nh.ipv6h;
                         if (ipv6_addr_is_multicast(&hdr->daddr) &&
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 47d00210cba1..f1dfcc319717 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -323,10 +323,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
         if (nexthdr == IPPROTO_ICMPV6) {
                 struct icmp6hdr *icmp6;
 
-                if (!pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data))
+                if (!pskb_may_pull(skb, (skb_network_header(skb) +
+                                         offset + 1 - skb->data)))
                         return 0;
 
-                icmp6 = (struct icmp6hdr *)(skb->nh.raw + offset);
+                icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 
                 switch (icmp6->icmp6_type) {
                 case NDISC_ROUTER_SOLICITATION:
@@ -392,7 +393,7 @@ int ip6_forward(struct sk_buff *skb)
          *      that different fragments will go along one path. --ANK
          */
         if (opt->ra) {
-                u8 *ptr = skb->nh.raw + opt->ra;
+                u8 *ptr = skb_network_header(skb) + opt->ra;
                 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
                         return 0;
         }
@@ -527,7 +528,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
-        unsigned int packet_len = skb->tail - skb->nh.raw;
+        unsigned int packet_len = skb->tail - skb_network_header(skb);
         int found_rhdr = 0;
         *nexthdr = &skb->nh.ipv6h->nexthdr;
 
@@ -554,7 +555,8 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
                 offset += ipv6_optlen(exthdr);
                 *nexthdr = &exthdr->nexthdr;
-                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
+                                                 offset);
         }
 
         return offset;
@@ -620,7 +622,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 /* BUILD HEADER */
 
                 *prevhdr = NEXTHDR_FRAGMENT;
-                tmp_hdr = kmemdup(skb->nh.raw, hlen, GFP_ATOMIC);
+                tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
                         IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
                         return -ENOMEM;
@@ -630,7 +632,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
                 __skb_push(skb, hlen);
                 skb_reset_network_header(skb);
-                memcpy(skb->nh.raw, tmp_hdr, hlen);
+                memcpy(skb_network_header(skb), tmp_hdr, hlen);
 
                 ipv6_select_ident(skb, fh);
                 fh->nexthdr = nexthdr;
@@ -654,7 +656,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
                                 __skb_push(frag, hlen);
                                 skb_reset_network_header(frag);
-                                memcpy(frag->nh.raw, tmp_hdr, hlen);
+                                memcpy(skb_network_header(frag), tmp_hdr,
+                                       hlen);
                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
                                 fh->nexthdr = nexthdr;
                                 fh->reserved = 0;
@@ -753,7 +756,7 @@ slow_path:
                 /*
                  *      Copy the packet header into the new buffer.
                  */
-                memcpy(frag->nh.raw, skb->data, hlen);
+                memcpy(skb_network_header(frag), skb->data, hlen);
 
                 /*
                  *      Build fragment header.
@@ -1329,7 +1332,7 @@ int ip6_push_pending_frames(struct sock *sk)
         tail_skb = &(skb_shinfo(skb)->frag_list);
 
         /* move skb->data to ip header from ext header */
-        if (skb->data < skb->nh.raw)
+        if (skb->data < skb_network_header(skb))
                 __skb_pull(skb, skb_network_offset(skb));
         while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
                 __skb_pull(tmp_skb, skb->h.raw - skb->nh.raw);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a1e4f39c6793..aafbdfa8d785 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -995,9 +995,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        if ((offset = parse_tlv_tnl_enc_lim(skb, skb->nh.raw)) > 0) {
+        offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
+        if (offset > 0) {
                 struct ipv6_tlv_tnl_enc_lim *tel;
-                tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->nh.raw[offset];
+                tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
                 if (tel->encap_limit == 0) {
                         icmpv6_send(skb, ICMPV6_PARAMPROB,
                                     ICMPV6_HDR_FIELD, offset + 2, skb->dev);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 5724ba9f75de..3e71d1691b7d 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -166,10 +166,10 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 
         ipch = (struct ipv6_comp_hdr *)start;
-        ipch->nexthdr = *skb->nh.raw;
+        ipch->nexthdr = *skb_network_header(skb);
         ipch->flags = 0;
         ipch->cpi = htons((u16 )ntohl(x->id.spi));
-        *skb->nh.raw = IPPROTO_COMP;
+        *skb_network_header(skb) = IPPROTO_COMP;
 
 out_ok:
         return 0;
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 0afcabdd8ed6..bb4033553f3b 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -99,14 +99,16 @@ int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
                                mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
-                mip6_param_prob(skb, 0, (&mh->ip6mh_hdrlen) - skb->nh.raw);
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_hdrlen) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
                                mh->ip6mh_proto);
-                mip6_param_prob(skb, 0, (&mh->ip6mh_proto) - skb->nh.raw);
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_proto) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
@@ -152,8 +154,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = (struct ipv6hdr *)skb->data;
         iph->payload_len = htons(skb->len - sizeof(*iph));
 
-        nexthdr = *skb->nh.raw;
-        *skb->nh.raw = IPPROTO_DSTOPTS;
+        nexthdr = *skb_network_header(skb);
+        *skb_network_header(skb) = IPPROTO_DSTOPTS;
 
         dstopt = (struct ipv6_destopt_hdr *)skb->h.raw;
         dstopt->nexthdr = nexthdr;
@@ -215,7 +217,8 @@ static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct
         if (likely(opt->dsthao)) {
                 offset = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
                 if (likely(offset >= 0))
-                        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + offset);
+                        hao = (struct ipv6_destopt_hao *)
+                                        (skb_network_header(skb) + offset);
         }
 
         skb_get_timestamp(skb, &stamp);
@@ -254,7 +257,8 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
 {
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
-        unsigned int packet_len = skb->tail - skb->nh.raw;
+        const unsigned char *nh = skb_network_header(skb);
+        unsigned int packet_len = skb->tail - nh;
         int found_rhdr = 0;
 
         *nexthdr = &skb->nh.ipv6h->nexthdr;
@@ -288,7 +292,7 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
 
                 offset += ipv6_optlen(exthdr);
                 *nexthdr = &exthdr->nexthdr;
-                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+                exthdr = (struct ipv6_opt_hdr *)(nh + offset);
         }
 
         return offset;
@@ -361,8 +365,8 @@ static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = (struct ipv6hdr *)skb->data;
         iph->payload_len = htons(skb->len - sizeof(*iph));
 
-        nexthdr = *skb->nh.raw;
-        *skb->nh.raw = IPPROTO_ROUTING;
+        nexthdr = *skb_network_header(skb);
+        *skb_network_header(skb) = IPPROTO_ROUTING;
 
         rt2 = (struct rt2_hdr *)skb->h.raw;
         rt2->rt_hdr.nexthdr = nexthdr;
@@ -384,7 +388,8 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
 {
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
-        unsigned int packet_len = skb->tail - skb->nh.raw;
+        const unsigned char *nh = skb_network_header(skb);
+        unsigned int packet_len = skb->tail - nh;
         int found_rhdr = 0;
 
         *nexthdr = &skb->nh.ipv6h->nexthdr;
@@ -397,7 +402,7 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
                 case NEXTHDR_ROUTING:
                         if (offset + 3 <= packet_len) {
                                 struct ipv6_rt_hdr *rt;
-                                rt = (struct ipv6_rt_hdr *)(skb->nh.raw + offset);
+                                rt = (struct ipv6_rt_hdr *)(nh + offset);
                                 if (rt->type != 0)
                                         return offset;
                         }
@@ -417,7 +422,7 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
 
                 offset += ipv6_optlen(exthdr);
                 *nexthdr = &exthdr->nexthdr;
-                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+                exthdr = (struct ipv6_opt_hdr *)(nh + offset);
         }
 
         return offset;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index c311b9a12ca6..bc1d09584008 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -408,11 +408,12 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                 return -1;
         }
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
+                const unsigned char *nh = skb_network_header(skb);
                 skb->csum = csum_sub(skb->csum,
-                                     csum_partial(skb->nh.raw,
-                                                  (u8*)(fhdr + 1) - skb->nh.raw,
+                                     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
                                                   0));
+        }
 
         /* Is this the final fragment? */
         if (!(fhdr->frag_off & htons(IP6_MF))) {
@@ -583,7 +584,9 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         BUG_TRAP(NFCT_FRAG6_CB(head)->offset == 0);
 
         /* Unfragmented part is taken from the first segment. */
-        payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - sizeof(struct frag_hdr);
+        payload_len = ((head->data - skb_network_header(head)) -
+                       sizeof(struct ipv6hdr) + fq->len -
+                       sizeof(struct frag_hdr));
         if (payload_len > IPV6_MAXPLEN) {
                 DEBUGP("payload len is too large.\n");
                 goto out_oversize;
@@ -624,7 +627,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         /* We have to remove fragment header from datagram and to relocate
          * header in order to calculate ICV correctly. */
-        head->nh.raw[fq->nhoffset] = head->h.raw[0];
+        skb_network_header(head)[fq->nhoffset] = head->h.raw[0];
         memmove(head->head + sizeof(struct frag_hdr), head->head,
                 (head->data - head->head) - sizeof(struct frag_hdr));
         head->mac.raw += sizeof(struct frag_hdr);
@@ -632,7 +635,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         skb_shinfo(head)->frag_list = head->next;
         head->h.raw = head->data;
-        skb_push(head, head->data - head->nh.raw);
+        skb_push(head, head->data - skb_network_header(head));
         atomic_sub(head->truesize, &nf_ct_frag6_mem);
 
         for (fp=head->next; fp; fp = fp->next) {
@@ -653,7 +656,9 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
-                head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
+                head->csum = csum_partial(skb_network_header(head),
+                                          head->h.raw - head->nh.raw,
+                                          head->csum);
 
         fq->fragments = NULL;
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 5f26645195dc..9b2bcde73f19 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -361,7 +361,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (skb->ip_summed == CHECKSUM_COMPLETE) {
-                skb_postpull_rcsum(skb, skb->nh.raw,
+                skb_postpull_rcsum(skb, skb_network_header(skb),
                                    skb->h.raw - skb->nh.raw);
                 if (!csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                      &skb->nh.ipv6h->daddr,
@@ -488,7 +488,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                 goto out;
 
         offset = rp->offset;
-        total_len = inet_sk(sk)->cork.length - (skb->nh.raw - skb->data);
+        total_len = inet_sk(sk)->cork.length - (skb_network_header(skb) -
+                                                skb->data);
         if (offset >= total_len - 1) {
                 err = -EINVAL;
                 ip6_flush_pending_frames(sk);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 1dde449379fb..f85e49acb91a 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -436,13 +436,18 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         if ((unsigned int)end > IPV6_MAXPLEN) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
+                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+                                  ((u8 *)&fhdr->frag_off -
+                                   skb_network_header(skb)));
                 return;
         }
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
+                const unsigned char *nh = skb_network_header(skb);
                 skb->csum = csum_sub(skb->csum,
-                                     csum_partial(skb->nh.raw, (u8*)(fhdr+1)-skb->nh.raw, 0));
+                                     csum_partial(nh, (u8 *)(fhdr + 1) - nh,
+                                                  0));
+        }
 
         /* Is this the final fragment? */
         if (!(fhdr->frag_off & htons(IP6_MF))) {
@@ -605,7 +610,9 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
         BUG_TRAP(FRAG6_CB(head)->offset == 0);
 
         /* Unfragmented part is taken from the first segment. */
-        payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - sizeof(struct frag_hdr);
+        payload_len = ((head->data - skb_network_header(head)) -
+                       sizeof(struct ipv6hdr) + fq->len -
+                       sizeof(struct frag_hdr));
         if (payload_len > IPV6_MAXPLEN)
                 goto out_oversize;
 
@@ -639,7 +646,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
         /* We have to remove fragment header from datagram and to relocate
          * header in order to calculate ICV correctly. */
         nhoff = fq->nhoffset;
-        head->nh.raw[nhoff] = head->h.raw[0];
+        skb_network_header(head)[nhoff] = head->h.raw[0];
         memmove(head->head + sizeof(struct frag_hdr), head->head,
                 (head->data - head->head) - sizeof(struct frag_hdr));
         head->mac.raw += sizeof(struct frag_hdr);
@@ -647,7 +654,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
 
         skb_shinfo(head)->frag_list = head->next;
         head->h.raw = head->data;
-        skb_push(head, head->data - head->nh.raw);
+        skb_push(head, head->data - skb_network_header(head));
         atomic_sub(head->truesize, &ip6_frag_mem);
 
         for (fp=head->next; fp; fp = fp->next) {
@@ -671,7 +678,9 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
-                head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
+                head->csum = csum_partial(skb_network_header(head),
+                                          head->h.raw - head->nh.raw,
+                                          head->csum);
 
         rcu_read_lock();
         IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
@@ -725,7 +734,7 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
                 skb->h.raw += sizeof(struct frag_hdr);
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
 
-                IP6CB(skb)->nhoff = (u8*)fhdr - skb->nh.raw;
+                IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
                 return 1;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 92f99927d12d..80a52ab1e384 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -486,7 +486,9 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
                         struct sk_buff *pktopts = treq->pktopts;
                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
                         if (rxopt->srcrt)
-                                opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
+                                opt = ipv6_invert_rthdr(sk,
+                          (struct ipv6_rt_hdr *)(skb_network_header(pktopts) +
+                                                 rxopt->srcrt));
                 }
 
                 if (opt && opt->srcrt) {
@@ -1389,7 +1391,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
             opt == NULL && treq->pktopts) {
                 struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
                 if (rxopt->srcrt)
-                        opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr *)(treq->pktopts->nh.raw + rxopt->srcrt));
+                        opt = ipv6_invert_rthdr(sk,
+                   (struct ipv6_rt_hdr *)(skb_network_header(treq->pktopts) +
+                                          rxopt->srcrt));
         }
 
         if (dst == NULL) {
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 33a1b9200431..5c929f886129 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -28,7 +28,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
         unsigned int nhoff;
 
         nhoff = IP6CB(skb)->nhoff;
-        nexthdr = skb->nh.raw[nhoff];
+        nexthdr = skb_network_header(skb)[nhoff];
 
         seq = 0;
         if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
@@ -58,7 +58,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
                 if (nexthdr <= 0)
                         goto drop_unlock;
 
-                skb->nh.raw[nhoff] = nexthdr;
+                skb_network_header(skb)[nhoff] = nexthdr;
 
                 if (x->props.replay_window)
                         xfrm_replay_advance(x, seq);
@@ -113,7 +113,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
         } else {
 #ifdef CONFIG_NETFILTER
                 skb->nh.ipv6h->payload_len = htons(skb->len);
-                __skb_push(skb, skb->data - skb->nh.raw);
+                __skb_push(skb, skb->data - skb_network_header(skb));
 
                 NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
                         ip6_rcv_finish);
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index c015bfde2b1c..247e2d5d2acf 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -67,7 +67,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
                 goto out;
 
         skb_push(skb, size);
-        memmove(skb->data, skb->nh.raw, size);
+        memmove(skb->data, skb_network_header(skb), size);
         skb_reset_network_header(skb);
 
         old_mac = skb_mac_header(skb);
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 3a4b39b12bad..ace0bbf4f25d 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -53,8 +53,10 @@ static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ihl = skb->data - skb->h.raw;
 
-        if (skb->h.raw != skb->nh.raw)
-                skb->nh.raw = memmove(skb->h.raw, skb->nh.raw, ihl);
+        if (skb->h.raw != skb->nh.raw) {
+                memmove(skb->h.raw, skb_network_header(skb), ihl);
+                skb->nh.raw = skb->h.raw;
+        }
         skb->nh.ipv6h->payload_len = htons(skb->len + ihl -
                                            sizeof(struct ipv6hdr));
         skb->h.raw = skb->data;
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 8ce5ef2d0b1c..498f17b5c42f 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -87,9 +87,10 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
         const unsigned char *old_mac;
+        const unsigned char *nh = skb_network_header(skb);
 
-        if (skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPV6
-            && skb->nh.raw[IP6CB(skb)->nhoff] != IPPROTO_IPIP)
+        if (nh[IP6CB(skb)->nhoff] != IPPROTO_IPV6 &&
+            nh[IP6CB(skb)->nhoff] != IPPROTO_IPIP)
                 goto out;
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto out;
@@ -98,7 +99,8 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
             (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                 goto out;
 
-        if (skb->nh.raw[IP6CB(skb)->nhoff] == IPPROTO_IPV6) {
+        nh = skb_network_header(skb);
+        if (nh[IP6CB(skb)->nhoff] == IPPROTO_IPV6) {
                 if (x->props.flags & XFRM_STATE_DECAP_DSCP)
                         ipv6_copy_dscp(skb->nh.ipv6h, skb->h.ipv6h);
                 if (!(x->props.flags & XFRM_STATE_NOECN))
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index d8a585bd2cb4..cb5a723d4cb4 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -273,14 +273,16 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
         u16 offset = skb->h.raw - skb->nh.raw;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
         struct ipv6_opt_hdr *exthdr;
-        u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
+        const unsigned char *nh = skb_network_header(skb);
+        u8 nexthdr = nh[IP6CB(skb)->nhoff];
 
         memset(fl, 0, sizeof(struct flowi));
         ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
 
-        while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
-                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+                nh = skb_network_header(skb);
+                exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
                 switch (nexthdr) {
                 case NEXTHDR_ROUTING:
@@ -288,7 +290,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                 case NEXTHDR_DEST:
                         offset += ipv6_optlen(exthdr);
                         nexthdr = exthdr->nexthdr;
-                        exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+                        exthdr = (struct ipv6_opt_hdr *)(nh + offset);
                         break;
 
                 case IPPROTO_UDP:
@@ -296,7 +298,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
+                        if (pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
                                 __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[0];
@@ -306,7 +308,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                         return;
 
                 case IPPROTO_ICMPV6:
-                        if (pskb_may_pull(skb, skb->nh.raw + offset + 2 - skb->data)) {
+                        if (pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
                                 u8 *icmp = (u8 *)exthdr;
 
                                 fl->fl_icmp_type = icmp[0];
@@ -317,7 +319,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
 
 #ifdef CONFIG_IPV6_MIP6
                 case IPPROTO_MH:
-                        if (pskb_may_pull(skb, skb->nh.raw + offset + 3 - skb->data)) {
+                        if (pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
                                 mh = (struct ip6_mh *)exthdr;