25 files changed, 98 insertions, 95 deletions

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index cb21617a5670..28326fb1fc4e 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -93,7 +93,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                                 continue;
                         a->priv = p;
                         a->order = n_i;
-                        r = (struct rtattr*) skb->tail;
+                        r = (struct rtattr *)skb_tail_pointer(skb);
                         RTA_PUT(skb, a->order, 0, NULL);
                         err = tcf_action_dump_1(skb, a, 0, 0);
                         if (err < 0) {
@@ -101,7 +101,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                                 skb_trim(skb, (u8*)r - skb->data);
                                 goto done;
                         }
-                        r->rta_len = skb->tail - (u8*)r;
+                        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                         n_i++;
                         if (n_i >= TCA_ACT_MAX_PRIO)
                                 goto done;
@@ -125,7 +125,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
         struct rtattr *r ;
         int i= 0, n_i = 0;
 
-        r = (struct rtattr*) skb->tail;
+        r = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, a->order, 0, NULL);
         RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
         for (i = 0; i < (hinfo->hmask + 1); i++) {
@@ -140,7 +140,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
                 }
         }
         RTA_PUT(skb, TCA_FCNT, 4, &n_i);
-        r->rta_len = skb->tail - (u8*)r;
+        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
 
         return n_i;
 rtattr_failure:
@@ -423,7 +423,7 @@ int
 tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         int err = -EINVAL;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *r;
 
         if (a->ops == NULL || a->ops->dump == NULL)
@@ -432,10 +432,10 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
         RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
         if (tcf_action_copy_stats(skb, a, 0))
                 goto rtattr_failure;
-        r = (struct rtattr*) skb->tail;
+        r = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if ((err = tcf_action_dump_old(skb, a, bind, ref)) > 0) {
-                r->rta_len = skb->tail - (u8*)r;
+                r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                 return err;
         }
 
@@ -449,17 +449,17 @@ tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
 {
         struct tc_action *a;
         int err = -EINVAL;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *r ;
 
         while ((a = act) != NULL) {
-                r = (struct rtattr*) skb->tail;
+                r = (struct rtattr *)skb_tail_pointer(skb);
                 act = a->next;
                 RTA_PUT(skb, a->order, 0, NULL);
                 err = tcf_action_dump_1(skb, a, bind, ref);
                 if (err < 0)
                         goto errout;
-                r->rta_len = skb->tail - (u8*)r;
+                r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
         }
 
         return 0;
@@ -635,7 +635,7 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
 {
         struct tcamsg *t;
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *x;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
@@ -645,15 +645,15 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr*) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         if (tcf_action_dump(skb, a, bind, ref) < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8*)x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -767,7 +767,7 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
                 return -ENOBUFS;
         }
 
-        b = (unsigned char *)skb->tail;
+        b = skb_tail_pointer(skb);
 
         if (rtattr_parse_nested(tb, TCA_ACT_MAX, rta) < 0)
                 goto err_out;
@@ -783,16 +783,16 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr *) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
         if (err < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8 *) x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         nlh->nlmsg_flags |= NLM_F_ROOT;
         module_put(a->ops->owner);
         kfree(a);
@@ -884,7 +884,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
         if (!skb)
                 return -ENOBUFS;
 
-        b = (unsigned char *)skb->tail;
+        b = skb_tail_pointer(skb);
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
         t = NLMSG_DATA(nlh);
@@ -892,15 +892,15 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr*) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         if (tcf_action_dump(skb, a, 0, 0) < 0)
                 goto rtattr_failure;
 
-        x->rta_len = skb->tail - (u8*)x;
+        x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         NETLINK_CB(skb).dst_group = RTNLGRP_TC;
 
         err = rtnetlink_send(skb, pid, RTNLGRP_TC, flags&NLM_F_ECHO);
@@ -1015,7 +1015,7 @@ static int
 tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct nlmsghdr *nlh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *x;
         struct tc_action_ops *a_o;
         struct tc_action a;
@@ -1048,7 +1048,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
-        x = (struct rtattr *) skb->tail;
+        x = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
         ret = a_o->walk(skb, cb, RTM_GETACTION, &a);
@@ -1056,12 +1056,12 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
                 goto rtattr_failure;
 
         if (ret > 0) {
-                x->rta_len = skb->tail - (u8 *) x;
+                x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
                 ret = skb->len;
         } else
                 skb_trim(skb, (u8*)x - skb->data);
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         if (NETLINK_CB(cb->skb).pid && ret)
                 nlh->nlmsg_flags |= NLM_F_MULTI;
         module_put(a_o->owner);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 87d0faf32867..aad748b3b38c 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -155,7 +155,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_gact opt;
         struct tcf_gact *gact = a->priv;
         struct tcf_t t;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 47f0b1324239..2ccfd5b20fab 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -245,7 +245,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
 
 static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_ipt *ipt = a->priv;
         struct ipt_entry_target *t;
         struct tcf_t tm;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 3e93683e9ab3..15f6ecdaf611 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -206,7 +206,7 @@ bad_mirred:
 
 static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_mirred *m = a->priv;
         struct tc_mirred opt;
         struct tcf_t t;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 20813eee8af4..d654cea1a46c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -195,7 +195,7 @@ done:
 static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
                           int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_pedit *p = a->priv;
         struct tc_pedit *opt;
         struct tcf_t t;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 10a5a5c36f76..068b23763665 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -80,7 +80,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
                                 continue;
                         a->priv = p;
                         a->order = index;
-                        r = (struct rtattr*) skb->tail;
+                        r = (struct rtattr *)skb_tail_pointer(skb);
                         RTA_PUT(skb, a->order, 0, NULL);
                         if (type == RTM_DELACTION)
                                 err = tcf_action_dump_1(skb, a, 0, 1);
@@ -91,7 +91,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
                                 skb_trim(skb, (u8*)r - skb->data);
                                 goto done;
                         }
-                        r->rta_len = skb->tail - (u8*)r;
+                        r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
                         n_i++;
                 }
         }
@@ -326,7 +326,7 @@ static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
 static int
 tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_police *police = a->priv;
         struct tc_police opt;
 
@@ -572,7 +572,7 @@ EXPORT_SYMBOL(tcf_police);
 
 int tcf_police_dump(struct sk_buff *skb, struct tcf_police *police)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_police opt;
 
         opt.index = police->tcf_index;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index c7971182af07..ecbcfa59b76c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -155,7 +155,7 @@ static inline int tcf_simp_cleanup(struct tc_action *a, int bind)
 static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
                                 int bind, int ref)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tcf_defact *d = a->priv;
         struct tc_defact opt;
         struct tcf_t t;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 5c6ffdb77d2d..84231baf77d1 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -323,7 +323,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
         tcm = NLMSG_DATA(nlh);
@@ -340,7 +340,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
                 if (tp->ops->dump && tp->ops->dump(tp, fh, skb, tcm) < 0)
                         goto rtattr_failure;
         }
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -563,30 +563,30 @@ tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
                  * to work with both old and new modes of entering
                  * tc data even if iproute2  was newer - jhs
                  */
-                struct rtattr * p_rta = (struct rtattr*) skb->tail;
+                struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
 
                 if (exts->action->type != TCA_OLD_COMPAT) {
                         RTA_PUT(skb, map->action, 0, NULL);
                         if (tcf_action_dump(skb, exts->action, 0, 0) < 0)
                                 goto rtattr_failure;
-                        p_rta->rta_len = skb->tail - (u8*)p_rta;
+                        p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
                 } else if (map->police) {
                         RTA_PUT(skb, map->police, 0, NULL);
                         if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0)
                                 goto rtattr_failure;
-                        p_rta->rta_len = skb->tail - (u8*)p_rta;
+                        p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
                 }
         }
 #elif defined CONFIG_NET_CLS_POLICE
         if (map->police && exts->police) {
-                struct rtattr * p_rta = (struct rtattr*) skb->tail;
+                struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
 
                 RTA_PUT(skb, map->police, 0, NULL);
 
                 if (tcf_police_dump(skb, exts->police) < 0)
                         goto rtattr_failure;
 
-                p_rta->rta_len = skb->tail - (u8*)p_rta;
+                p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
         }
 #endif
         return 0;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 4a91f082a81d..800ec2ac326b 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -245,7 +245,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
                       struct sk_buff *skb, struct tcmsg *t)
 {
         struct basic_filter *f = (struct basic_filter *) fh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (f == NULL)
@@ -263,7 +263,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
             tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = (skb->tail - b);
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 5dbb9d451f73..f5f355852a87 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -348,7 +348,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct fw_head *head = (struct fw_head *)tp->root;
         struct fw_filter *f = (struct fw_filter*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (f == NULL)
@@ -374,7 +374,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &fw_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index abc47cc48ad0..1f94df36239d 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -562,7 +562,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
                        struct sk_buff *skb, struct tcmsg *t)
 {
         struct route4_filter *f = (struct route4_filter*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         u32 id;
 
@@ -591,7 +591,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &route_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 6f373b020eb4..87ed6f3c5070 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -593,7 +593,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct rsvp_filter *f = (struct rsvp_filter*)fh;
         struct rsvp_session *s;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_rsvp_pinfo pinfo;
 
@@ -623,7 +623,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
         if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0)
                 goto rtattr_failure;
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         if (tcf_exts_dump_stats(skb, &f->exts, &rsvp_ext_map) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7563fdcef4b7..0537d6066b43 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -448,7 +448,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
 {
         struct tcindex_data *p = PRIV(tp);
         struct tcindex_filter_result *r = (struct tcindex_filter_result *) fh;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         DPRINTK("tcindex_dump(tp %p,fh 0x%lx,skb %p,t %p),p %p,r %p,b %p\n",
@@ -463,7 +463,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
                 RTA_PUT(skb,TCA_TCINDEX_SHIFT,sizeof(p->shift),&p->shift);
                 RTA_PUT(skb,TCA_TCINDEX_FALL_THROUGH,sizeof(p->fall_through),
                     &p->fall_through);
-                rta->rta_len = skb->tail-b;
+                rta->rta_len = skb_tail_pointer(skb) - b;
         } else {
                 if (p->perfect) {
                         t->tcm_handle = r-p->perfect;
@@ -486,7 +486,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
 
                 if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0)
                         goto rtattr_failure;
-                rta->rta_len = skb->tail-b;
+                rta->rta_len = skb_tail_pointer(skb) - b;
 
                 if (tcf_exts_dump_stats(skb, &r->exts, &tcindex_ext_map) < 0)
                         goto rtattr_failure;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 695b34051b9f..fa11bb750049 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -213,7 +213,7 @@ check_terminal:
                         off2 = 0;
                 }
 
-                if (ptr < skb->tail)
+                if (ptr < skb_tail_pointer(skb))
                         goto next_ht;
         }
 
@@ -718,7 +718,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
                      struct sk_buff *skb, struct tcmsg *t)
 {
         struct tc_u_knode *n = (struct tc_u_knode*)fh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (n == NULL)
@@ -765,7 +765,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
 #endif
         }
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         if (TC_U32_KEY(n->handle))
                 if (tcf_exts_dump_stats(skb, &n->exts, &u32_ext_map) < 0)
                         goto rtattr_failure;
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 959c306c5714..63146d339d81 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -418,17 +418,19 @@ void tcf_em_tree_destroy(struct tcf_proto *tp, struct tcf_ematch_tree *tree)
 int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
 {
         int i;
-        struct rtattr * top_start = (struct rtattr*) skb->tail;
-        struct rtattr * list_start;
+        u8 *tail;
+        struct rtattr *top_start = (struct rtattr *)skb_tail_pointer(skb);
+        struct rtattr *list_start;
 
         RTA_PUT(skb, tlv, 0, NULL);
         RTA_PUT(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr);
 
-        list_start = (struct rtattr *) skb->tail;
+        list_start = (struct rtattr *)skb_tail_pointer(skb);
         RTA_PUT(skb, TCA_EMATCH_TREE_LIST, 0, NULL);
 
+        tail = skb_tail_pointer(skb);
         for (i = 0; i < tree->hdr.nmatches; i++) {
-                struct rtattr *match_start = (struct rtattr*) skb->tail;
+                struct rtattr *match_start = (struct rtattr *)tail;
                 struct tcf_ematch *em = tcf_em_get_match(tree, i);
                 struct tcf_ematch_hdr em_hdr = {
                         .kind = em->ops ? em->ops->kind : TCF_EM_CONTAINER,
@@ -447,11 +449,12 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
                 } else if (em->datalen > 0)
                         RTA_PUT_NOHDR(skb, em->datalen, (void *) em->data);
 
-                match_start->rta_len = skb->tail - (u8*) match_start;
+                tail = skb_tail_pointer(skb);
+                match_start->rta_len = tail - (u8 *)match_start;
         }
 
-        list_start->rta_len = skb->tail - (u8 *) list_start;
-        top_start->rta_len = skb->tail - (u8 *) top_start;
+        list_start->rta_len = tail - (u8 *)list_start;
+        top_start->rta_len = tail - (u8 *)top_start;
 
         return 0;
 
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ecbdc6b42a9c..7482a950717b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -813,7 +813,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
 
         nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
@@ -847,7 +847,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
@@ -1051,7 +1051,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct gnet_dump d;
         struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
 
@@ -1076,7 +1076,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         if (gnet_stats_finish_copy(&d) < 0)
                 goto rtattr_failure;
 
-        nlh->nlmsg_len = skb->tail - b;
+        nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 nlmsg_failure:
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index baca8743c12b..1d7bb1632138 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -631,7 +631,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
 {
         struct atm_qdisc_data *p = PRIV(sch);
         struct atm_flow_data *flow = (struct atm_flow_data *) cl;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         DPRINTK("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
@@ -661,7 +661,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
 
                 RTA_PUT(skb,TCA_ATM_EXCESS,sizeof(zero),&zero);
         }
-        rta->rta_len = skb->tail-b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index d83414d828d8..be98a01253e9 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,7 +1465,7 @@ static int cbq_init(struct Qdisc *sch, struct rtattr *opt)
 
 static __inline__ int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
 
         RTA_PUT(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate);
         return skb->len;
@@ -1477,7 +1477,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_lssopt opt;
 
         opt.flags = 0;
@@ -1502,7 +1502,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
         opt.flags = 0;
@@ -1520,7 +1520,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_ovl opt;
 
         opt.strategy = cl->ovl_strategy;
@@ -1537,7 +1537,7 @@ rtattr_failure:
 
 static __inline__ int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_fopt opt;
 
         if (cl->split || cl->defmap) {
@@ -1556,7 +1556,7 @@ rtattr_failure:
 #ifdef CONFIG_NET_CLS_POLICE
 static __inline__ int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl)
 {
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_police opt;
 
         if (cl->police) {
@@ -1590,14 +1590,14 @@ static int cbq_dump_attr(struct sk_buff *skb, struct cbq_class *cl)
 static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct cbq_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         rta = (struct rtattr*)b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (cbq_dump_attr(skb, &q->link) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
@@ -1619,7 +1619,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
                struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct cbq_class *cl = (struct cbq_class*)arg;
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         if (cl->tparent)
@@ -1633,7 +1633,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (cbq_dump_attr(skb, cl) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 5197b6caaf2d..80e6f811e3bc 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1363,7 +1363,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
                 struct tcmsg *tcm)
 {
         struct hfsc_class *cl = (struct hfsc_class *)arg;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta = (struct rtattr *)b;
 
         tcm->tcm_parent = cl->cl_parent ? cl->cl_parent->classid : TC_H_ROOT;
@@ -1374,7 +1374,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         if (hfsc_dump_curves(skb, cl) < 0)
                 goto rtattr_failure;
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
  rtattr_failure:
@@ -1576,7 +1576,7 @@ static int
 hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct hfsc_sched *q = qdisc_priv(sch);
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
 
         qopt.defcls = q->defcls;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index f76c20c0a109..c687388a8cb6 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1110,7 +1110,7 @@ static int htb_init(struct Qdisc *sch, struct rtattr *opt)
 static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct htb_sched *q = qdisc_priv(sch);
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_htb_glob gopt;
         spin_lock_bh(&sch->dev->queue_lock);
@@ -1123,12 +1123,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
         rta = (struct rtattr *)b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
         RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         spin_unlock_bh(&sch->dev->queue_lock);
         return skb->len;
 rtattr_failure:
         spin_unlock_bh(&sch->dev->queue_lock);
-        skb_trim(skb, skb->tail - skb->data);
+        skb_trim(skb, skb_tail_pointer(skb) - skb->data);
         return -1;
 }
 
@@ -1136,7 +1136,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
                           struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct htb_class *cl = (struct htb_class *)arg;
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_htb_opt opt;
 
@@ -1159,7 +1159,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
         opt.prio = cl->un.leaf.prio;
         opt.level = cl->level;
         RTA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         spin_unlock_bh(&sch->dev->queue_lock);
         return skb->len;
 rtattr_failure:
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index cfe070ee6ee3..d19f4070c237 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -362,12 +362,12 @@ static void ingress_destroy(struct Qdisc *sch)
 
 static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
-        unsigned char *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
 
         rta = (struct rtattr *) b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
         return skb->len;
 
 rtattr_failure:
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 915f82a2cc3d..2a9b1e429ff8 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -583,7 +583,7 @@ static void netem_destroy(struct Qdisc *sch)
 static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         const struct netem_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta = (struct rtattr *) b;
         struct tc_netem_qopt qopt;
         struct tc_netem_corr cor;
@@ -611,7 +611,7 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
         corrupt.correlation = q->corrupt_cor.rho;
         RTA_PUT(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt);
 
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         return skb->len;
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index de889f23f22a..5b371109ec1c 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -271,7 +271,7 @@ static int prio_init(struct Qdisc *sch, struct rtattr *opt)
 static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_prio_qopt opt;
 
         opt.bands = q->bands;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index e3695407afc6..a511ba83e26f 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -461,7 +461,7 @@ static void sfq_destroy(struct Qdisc *sch)
 static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct tc_sfq_qopt opt;
 
         opt.quantum = q->quantum;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index f14692f3a14e..231895562c66 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -387,7 +387,7 @@ static void tbf_destroy(struct Qdisc *sch)
 static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct tbf_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
+        unsigned char *b = skb_tail_pointer(skb);
         struct rtattr *rta;
         struct tc_tbf_qopt opt;
 
@@ -403,7 +403,7 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
         opt.mtu = q->mtu;
         opt.buffer = q->buffer;
         RTA_PUT(skb, TCA_TBF_PARMS, sizeof(opt), &opt);
-        rta->rta_len = skb->tail - b;
+        rta->rta_len = skb_tail_pointer(skb) - b;
 
         return skb->len;