1 files changed, 4 insertions, 4 deletions

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ecbdc6b42a9c..7482a950717b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -813,7 +813,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
@@ -847,7 +847,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -1051,7 +1051,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
         struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
 
@@ -1076,7 +1076,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure: