10 files changed, 28 insertions, 24 deletions

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f16f4f0c5814..4a355fea4098 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -268,7 +268,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
         serr->port = fl->fl_ip_dport;
 
-        __skb_pull(skb, skb->tail - skb->data);
+        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
         skb_reset_transport_header(skb);
 
         if (sock_queue_err_skb(sk, skb))
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7fdf84dee73f..b8e8914cc002 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -51,6 +51,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         int clen;
         int alen;
         int nfrags;
+        u8 *tail;
         struct esp_data *esp = x->data;
         int hdr_len = (skb_transport_offset(skb) +
                        sizeof(*esph) + esp->conf.ivlen);
@@ -78,18 +79,19 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         /* Fill padding... */
+        tail = skb_tail_pointer(trailer);
         do {
                 int i;
                 for (i=0; i<clen-skb->len - 2; i++)
-                        *(u8*)(trailer->tail + i) = i+1;
+                        tail[i] = i + 1;
         } while (0);
-        *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2;
+        tail[clen-skb->len - 2] = (clen - skb->len) - 2;
         pskb_put(skb, trailer, clen - skb->len);
 
         top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
         esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);
         top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
-        *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
+        *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);
         *skb_network_header(skb) = IPPROTO_ESP;
 
         esph->spi = x->id.spi;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index a6a275db88cd..275d2e812a44 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -51,7 +51,7 @@
 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
 {
         const unsigned char *nh = skb_network_header(skb);
-        int packet_len = skb->tail - nh;
+        int packet_len = skb->tail - skb->network_header;
         struct ipv6_opt_hdr *hdr;
         int len;
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d3edc3cf1ce9..e94992ab92e6 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -317,7 +317,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         int hlimit, tclass;
         int err = 0;
 
-        if ((u8*)hdr < skb->head || (u8*)(hdr+1) > skb->tail)
+        if ((u8 *)hdr < skb->head ||
+            (skb->network_header + sizeof(*hdr)) > skb->tail)
                 return;
 
         /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b2c092c6b9dc..e2b8db6b9aef 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -514,7 +514,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
         u16 offset = sizeof(struct ipv6hdr);
         struct ipv6_opt_hdr *exthdr =
                                 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
-        unsigned int packet_len = skb->tail - skb_network_header(skb);
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4c45bcce75e8..6c2758951d60 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1423,7 +1423,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
 
         memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
         skb_put(skb, sizeof(*pmr));
         pmr = (struct mld2_report *)skb_transport_header(skb);
         pmr->type = ICMPV6_MLD2_REPORT;
@@ -1468,8 +1468,8 @@ static void mld_sendpack(struct sk_buff *skb)
         int err;
 
         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
-        payload_len = skb->tail - skb_network_header(skb) - sizeof(*pip6);
-        mldlen = skb->tail - skb_transport_header(skb);
+        payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
+        mldlen = skb->tail - skb->transport_header;
         pip6->payload_len = htons(payload_len);
 
         pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index f0288e92fb52..6ed763ee6785 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -260,7 +260,7 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - nh;
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
@@ -392,7 +392,7 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
         struct ipv6_opt_hdr *exthdr =
                                    (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - nh;
+        unsigned int packet_len = skb->tail - skb->network_header;
         int found_rhdr = 0;
 
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f8e619772fb4..b1cf70816477 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -492,7 +492,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, src_addr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         msg = (struct nd_msg *)skb_transport_header(skb);
 
@@ -584,7 +584,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         msg = (struct nd_msg *)skb_transport_header(skb);
         msg->icmph.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION;
@@ -685,7 +685,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(skb, skb->tail - skb->data);
+        skb->transport_header = skb->tail;
         skb_put(skb, len);
         hdr = icmp6_hdr(skb);
         hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
@@ -767,7 +767,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - msg->opt;
+        u32 ndoptlen = skb->tail - (skb->transport_header +
+                                    offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
         struct inet6_ifaddr *ifp;
@@ -945,7 +946,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - msg->opt;
+        u32 ndoptlen = skb->tail - (skb->transport_header +
+                                    offsetof(struct nd_msg, opt));
         struct ndisc_options ndopts;
         struct net_device *dev = skb->dev;
         struct inet6_ifaddr *ifp;
@@ -1111,8 +1113,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         __u8 * opt = (__u8 *)(ra_msg + 1);
 
-        optlen = (skb->tail - skb_transport_header(skb)) -
-                  sizeof(struct ra_msg);
+        optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK2(KERN_WARNING
@@ -1361,7 +1362,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 return;
         }
 
-        optlen = skb->tail - skb_transport_header(skb);
+        optlen = skb->tail - skb->transport_header;
         optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
 
         if (optlen < 0) {
@@ -1522,7 +1523,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
                    IPPROTO_ICMPV6, len);
 
-        skb_set_transport_header(buff, buff->tail - buff->data);
+        skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
         skb_put(buff, len);
         icmph = icmp6_hdr(buff);
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 66a2c4135251..5cfce218c5e1 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -189,7 +189,7 @@ ipq_flush(int verdict)
 static struct sk_buff *
 ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 {
-        unsigned char *old_tail;
+        sk_buff_data_t old_tail;
         size_t size = 0;
         size_t data_len = 0;
         struct sk_buff *skb;
@@ -233,7 +233,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         if (!skb)
                 goto nlmsg_failure;
 
-        old_tail= skb->tail;
+        old_tail = skb->tail;
         nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
         pmsg = NLMSG_DATA(nlh);
         memset(pmsg, 0, sizeof(*pmsg));
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8705f6a502d9..2b3be68b70a7 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1077,7 +1077,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL)
-                                amount = skb->tail - skb_transport_header(skb);
+                                amount = skb->tail - skb->transport_header;
                         spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }