7 files changed, 54 insertions, 46 deletions

diff --git a/net/tipc/config.c b/net/tipc/config.c
index 14789a82de53..c71337a22d33 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -89,7 +89,7 @@ struct sk_buff *tipc_cfg_reply_alloc(int payload_size)
 int tipc_cfg_append_tlv(struct sk_buff *buf, int tlv_type,
                         void *tlv_data, int tlv_data_size)
 {
-        struct tlv_desc *tlv = (struct tlv_desc *)buf->tail;
+        struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(buf);
         int new_tlv_space = TLV_SPACE(tlv_data_size);
 
         if (skb_tailroom(buf) < new_tlv_space) {
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index 9be4839e32c5..0ee6ded18f3a 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -73,7 +73,7 @@ static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
 
         clone = skb_clone(buf, GFP_ATOMIC);
         if (clone) {
-                clone->nh.raw = clone->data;
+                skb_reset_network_header(clone);
                 dev = ((struct eth_bearer *)(tb_ptr->usr_handle))->dev;
                 clone->dev = dev;
                 dev->hard_header(clone, dev, ETH_P_TIPC,
@@ -99,8 +99,8 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 
         if (likely(eb_ptr->bearer)) {
                if (likely(!dev->promiscuity) ||
-                   !memcmp(buf->mac.raw,dev->dev_addr,ETH_ALEN) ||
-                   !memcmp(buf->mac.raw,dev->broadcast,ETH_ALEN)) {
+                   !memcmp(skb_mac_header(buf), dev->dev_addr, ETH_ALEN) ||
+                   !memcmp(skb_mac_header(buf), dev->broadcast, ETH_ALEN)) {
                         size = msg_size((struct tipc_msg *)buf->data);
                         skb_trim(buf, size);
                         if (likely(buf->len == size)) {
@@ -120,16 +120,18 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
 
 static int enable_bearer(struct tipc_bearer *tb_ptr)
 {
-        struct net_device *dev = dev_base;
+        struct net_device *dev, *pdev;
         struct eth_bearer *eb_ptr = &eth_bearers[0];
         struct eth_bearer *stop = &eth_bearers[MAX_ETH_BEARERS];
         char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
 
         /* Find device with specified name */
-
-        while (dev && dev->name && strncmp(dev->name, driver_name, IFNAMSIZ)) {
-                dev = dev->next;
-        }
+        dev = NULL;
+        for_each_netdev(pdev)
+                if (!strncmp(dev->name, driver_name, IFNAMSIZ)) {
+                        dev = pdev;
+                        break;
+                }
         if (!dev)
                 return -ENODEV;
 
@@ -140,7 +142,7 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
                 return -EDQUOT;
         if (!eb_ptr->dev) {
                 eb_ptr->dev = dev;
-                eb_ptr->tipc_packet_type.type = __constant_htons(ETH_P_TIPC);
+                eb_ptr->tipc_packet_type.type = htons(ETH_P_TIPC);
                 eb_ptr->tipc_packet_type.dev = dev;
                 eb_ptr->tipc_packet_type.func = recv_msg;
                 eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 71c2f2fd405c..2124f32ef29f 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1001,7 +1001,7 @@ static int link_bundle_buf(struct link *l_ptr,
                 return 0;
 
         skb_put(bundler, pad + size);
-        memcpy(bundler->data + to_pos, buf->data, size);
+        skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
         msg_set_size(bundler_msg, to_pos + size);
         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
         dbg("Packed msg # %u(%u octets) into pos %u in buf(#%u)\n",
@@ -1109,8 +1109,8 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf)
                         if (bundler) {
                                 msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
                                          TIPC_OK, INT_H_SIZE, l_ptr->addr);
-                                memcpy(bundler->data, (unchar *)&bundler_hdr,
-                                       INT_H_SIZE);
+                                skb_copy_to_linear_data(bundler, &bundler_hdr,
+                                                        INT_H_SIZE);
                                 skb_trim(bundler, INT_H_SIZE);
                                 link_bundle_buf(l_ptr, bundler, buf);
                                 buf = bundler;
@@ -1383,9 +1383,9 @@ again:
         if (!buf)
                 return -ENOMEM;
         buf->next = NULL;
-        memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE);
+        skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
         hsz = msg_hdr_sz(hdr);
-        memcpy(buf->data + INT_H_SIZE, (unchar *)hdr, hsz);
+        skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
         msg_dbg(buf_msg(buf), ">BUILD>");
 
         /* Chop up message: */
@@ -1416,8 +1416,8 @@ error:
                                 return -EFAULT;
                         }
                 } else
-                        memcpy(buf->data + fragm_crs, sect_crs, sz);
-
+                        skb_copy_to_linear_data_offset(buf, fragm_crs,
+                                                       sect_crs, sz);
                 sect_crs += sz;
                 sect_rest -= sz;
                 fragm_crs += sz;
@@ -1442,7 +1442,7 @@ error:
 
                         buf->next = NULL;
                         prev->next = buf;
-                        memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE);
+                        skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
                         fragm_crs = INT_H_SIZE;
                         fragm_rest = fragm_sz;
                         msg_dbg(buf_msg(buf),"  >BUILD>");
@@ -2130,7 +2130,7 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg,
                 buf = l_ptr->proto_msg_queue;
                 if (!buf)
                         return;
-                memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg));
+                skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
                 return;
         }
         msg_set_timestamp(msg, jiffies_to_msecs(jiffies));
@@ -2143,7 +2143,7 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg,
         if (!buf)
                 return;
 
-        memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg));
+        skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
         msg_set_size(buf_msg(buf), msg_size);
 
         if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
@@ -2319,8 +2319,8 @@ void tipc_link_tunnel(struct link *l_ptr,
                      "unable to send tunnel msg\n");
                 return;
         }
-        memcpy(buf->data, (unchar *)tunnel_hdr, INT_H_SIZE);
-        memcpy(buf->data + INT_H_SIZE, (unchar *)msg, length);
+        skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
+        skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
         dbg("%c->%c:", l_ptr->b_ptr->net_plane, tunnel->b_ptr->net_plane);
         msg_dbg(buf_msg(buf), ">SEND>");
         tipc_link_send_buf(tunnel, buf);
@@ -2361,7 +2361,7 @@ void tipc_link_changeover(struct link *l_ptr)
 
                 buf = buf_acquire(INT_H_SIZE);
                 if (buf) {
-                        memcpy(buf->data, (unchar *)&tunnel_hdr, INT_H_SIZE);
+                        skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
                         dbg("%c->%c:", l_ptr->b_ptr->net_plane,
                             tunnel->b_ptr->net_plane);
@@ -2426,8 +2426,9 @@ void tipc_link_send_duplicate(struct link *l_ptr, struct link *tunnel)
                              "unable to send duplicate msg\n");
                         return;
                 }
-                memcpy(outbuf->data, (unchar *)&tunnel_hdr, INT_H_SIZE);
-                memcpy(outbuf->data + INT_H_SIZE, iter->data, length);
+                skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
+                skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
+                                               length);
                 dbg("%c->%c:", l_ptr->b_ptr->net_plane,
                     tunnel->b_ptr->net_plane);
                 msg_dbg(buf_msg(outbuf), ">SEND>");
@@ -2457,7 +2458,7 @@ static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
 
         eb = buf_acquire(size);
         if (eb)
-                memcpy(eb->data, (unchar *)msg, size);
+                skb_copy_to_linear_data(eb, msg, size);
         return eb;
 }
 
@@ -2569,7 +2570,7 @@ void tipc_link_recv_bundle(struct sk_buff *buf)
                 if (obuf == NULL) {
                         warn("Link unable to unbundle message(s)\n");
                         break;
-                };
+                }
                 pos += align(msg_size(buf_msg(obuf)));
                 msg_dbg(buf_msg(obuf), "     /");
                 tipc_net_route_msg(obuf);
@@ -2631,9 +2632,9 @@ int tipc_link_send_long_buf(struct link *l_ptr, struct sk_buff *buf)
                         goto exit;
                 }
                 msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
-                memcpy(fragm->data, (unchar *)&fragm_hdr, INT_H_SIZE);
-                memcpy(fragm->data + INT_H_SIZE, crs, fragm_sz);
-
+                skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
+                skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
+                                               fragm_sz);
                 /*  Send queued messages first, if any: */
 
                 l_ptr->stats.sent_fragments++;
@@ -2733,8 +2734,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 if (pbuf != NULL) {
                         pbuf->next = *pending;
                         *pending = pbuf;
-                        memcpy(pbuf->data, (unchar *)imsg, msg_data_sz(fragm));
-
+                        skb_copy_to_linear_data(pbuf, imsg,
+                                                msg_data_sz(fragm));
                         /*  Prepare buffer for subsequent fragments. */
 
                         set_long_msg_seqno(pbuf, long_msg_seq_no);
@@ -2750,7 +2751,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 u32 fsz = get_fragm_size(pbuf);
                 u32 crs = ((msg_fragm_no(fragm) - 1) * fsz);
                 u32 exp_frags = get_expected_frags(pbuf) - 1;
-                memcpy(pbuf->data + crs, msg_data(fragm), dsz);
+                skb_copy_to_linear_data_offset(pbuf, crs,
+                                               msg_data(fragm), dsz);
                 buf_discard(fbuf);
 
                 /* Is message complete? */
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 62d549063604..35d5ba1d4f42 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -1,8 +1,8 @@
 /*
  * net/tipc/msg.h: Include file for TIPC message header routines
  *
- * Copyright (c) 2000-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2000-2007, Ericsson AB
+ * Copyright (c) 2005-2007, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -71,8 +71,11 @@ static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val)
 static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                 u32 pos, u32 mask, u32 val)
 {
-        u32 word = msg_word(m,w) & ~(mask << pos);
-        msg_set_word(m, w, (word |= (val << pos)));
+        val = (val & mask) << pos;
+        val = htonl(val);
+        mask = htonl(mask << pos);
+        m->hdr[w] &= ~mask;
+        m->hdr[w] |= val;
 }
 
 /*
@@ -786,15 +789,16 @@ static inline int msg_build(struct tipc_msg *hdr,
         *buf = buf_acquire(sz);
         if (!(*buf))
                 return -ENOMEM;
-        memcpy((*buf)->data, (unchar *)hdr, hsz);
+        skb_copy_to_linear_data(*buf, hdr, hsz);
         for (res = 1, cnt = 0; res && (cnt < num_sect); cnt++) {
                 if (likely(usrmem))
                         res = !copy_from_user((*buf)->data + pos,
                                               msg_sect[cnt].iov_base,
                                               msg_sect[cnt].iov_len);
                 else
-                        memcpy((*buf)->data + pos, msg_sect[cnt].iov_base,
-                               msg_sect[cnt].iov_len);
+                        skb_copy_to_linear_data_offset(*buf, pos,
+                                                       msg_sect[cnt].iov_base,
+                                                       msg_sect[cnt].iov_len);
                 pos += msg_sect[cnt].iov_len;
         }
         if (likely(res))
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index b8e1edc2badc..4cdafa2d1d4d 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -57,7 +57,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
 
         if (rep_buf) {
                 skb_push(rep_buf, hdr_space);
-                rep_nlh = (struct nlmsghdr *)rep_buf->data;
+                rep_nlh = nlmsg_hdr(rep_buf);
                 memcpy(rep_nlh, req_nlh, hdr_space);
                 rep_nlh->nlmsg_len = rep_buf->len;
                 genlmsg_unicast(rep_buf, req_nlh->nlmsg_pid);
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 5f8217d4b452..bcd5da00737b 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -464,7 +464,7 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
         msg_set_size(rmsg, data_sz + hdr_sz);
         msg_set_nametype(rmsg, msg_nametype(msg));
         msg_set_nameinst(rmsg, msg_nameinst(msg));
-        memcpy(rbuf->data + hdr_sz, msg_data(msg), data_sz);
+        skb_copy_to_linear_data_offset(rbuf, hdr_sz, msg_data(msg), data_sz);
 
         /* send self-abort message when rejecting on a connected port */
         if (msg_connected(msg)) {
@@ -1419,7 +1419,7 @@ int tipc_send_buf(u32 ref, struct sk_buff *buf, unsigned int dsz)
                 return -ENOMEM;
 
         skb_push(buf, hsz);
-        memcpy(buf->data, (unchar *)msg, hsz);
+        skb_copy_to_linear_data(buf, msg, hsz);
         destnode = msg_destnode(msg);
         p_ptr->publ.congested = 1;
         if (!tipc_port_congested(p_ptr)) {
@@ -1555,7 +1555,7 @@ int tipc_forward_buf2name(u32 ref,
         if (skb_cow(buf, LONG_H_SIZE))
                 return -ENOMEM;
         skb_push(buf, LONG_H_SIZE);
-        memcpy(buf->data, (unchar *)msg, LONG_H_SIZE);
+        skb_copy_to_linear_data(buf, msg, LONG_H_SIZE);
         msg_dbg(buf_msg(buf),"PREP:");
         if (likely(destport || destnode)) {
                 p_ptr->sent++;
@@ -1679,7 +1679,7 @@ int tipc_forward_buf2port(u32 ref,
                 return -ENOMEM;
 
         skb_push(buf, DIR_MSG_H_SIZE);
-        memcpy(buf->data, (unchar *)msg, DIR_MSG_H_SIZE);
+        skb_copy_to_linear_data(buf, msg, DIR_MSG_H_SIZE);
         msg_dbg(msg, "buf2port: ");
         p_ptr->sent++;
         if (dest->node == tipc_own_addr)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b71739fbe2c6..45832fb75ea4 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1020,7 +1020,7 @@ restart:
 
         if (!err) {
                 buf_crs = (unsigned char *)(TIPC_SKB_CB(buf)->handle);
-                sz = buf->tail - buf_crs;
+                sz = skb_tail_pointer(buf) - buf_crs;
 
                 needed = (buf_len - sz_copied);
                 sz_to_copy = (sz <= needed) ? sz : needed;