aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/atm/lec.c2
-rw-r--r--net/bluetooth/rfcomm/core.c2
-rw-r--r--net/core/dev.c4
-rw-r--r--net/core/filter.c2
-rw-r--r--net/core/gen_stats.c4
-rw-r--r--net/core/pktgen.c4
-rw-r--r--net/core/skbuff.c35
-rw-r--r--net/core/wireless.c4
-rw-r--r--net/decnet/dn_nsp_out.c6
-rw-r--r--net/decnet/dn_route.c4
-rw-r--r--net/decnet/dn_table.c8
-rw-r--r--net/decnet/netfilter/dn_rtmsg.c2
-rw-r--r--net/econet/af_econet.c2
-rw-r--r--net/ieee80211/ieee80211_rx.c2
-rw-r--r--net/ipv4/esp4.c8
-rw-r--r--net/ipv4/icmp.c3
-rw-r--r--net/ipv4/igmp.c4
-rw-r--r--net/ipv4/inet_diag.c12
-rw-r--r--net/ipv4/ip_sockglue.c2
-rw-r--r--net/ipv4/ipmr.c9
-rw-r--r--net/ipv4/ipvs/ip_vs_ftp.c4
-rw-r--r--net/ipv4/netfilter/arpt_mangle.c8
-rw-r--r--net/ipv4/netfilter/ip_queue.c4
-rw-r--r--net/ipv4/netfilter/nf_nat_helper.c3
-rw-r--r--net/ipv4/tcp.c2
-rw-r--r--net/ipv4/tcp_output.c2
-rw-r--r--net/ipv6/datagram.c2
-rw-r--r--net/ipv6/esp6.c8
-rw-r--r--net/ipv6/exthdrs.c2
-rw-r--r--net/ipv6/icmp.c3
-rw-r--r--net/ipv6/ip6_output.c2
-rw-r--r--net/ipv6/mcast.c6
-rw-r--r--net/ipv6/mip6.c4
-rw-r--r--net/ipv6/ndisc.c19
-rw-r--r--net/ipv6/netfilter/ip6_queue.c4
-rw-r--r--net/ipv6/raw.c2
-rw-r--r--net/irda/ircomm/ircomm_param.c4
-rw-r--r--net/irda/irlan/irlan_common.c2
-rw-r--r--net/irda/qos.c14
-rw-r--r--net/netfilter/nf_conntrack_netlink.c16
-rw-r--r--net/netfilter/nfnetlink_log.c3
-rw-r--r--net/netfilter/nfnetlink_queue.c4
-rw-r--r--net/netlink/af_netlink.c2
-rw-r--r--net/packet/af_packet.c2
-rw-r--r--net/sched/act_api.c52
-rw-r--r--net/sched/act_gact.c2
-rw-r--r--net/sched/act_ipt.c2
-rw-r--r--net/sched/act_mirred.c2
-rw-r--r--net/sched/act_pedit.c2
-rw-r--r--net/sched/act_police.c8
-rw-r--r--net/sched/act_simple.c2
-rw-r--r--net/sched/cls_api.c14
-rw-r--r--net/sched/cls_basic.c4
-rw-r--r--net/sched/cls_fw.c4
-rw-r--r--net/sched/cls_route.c4
-rw-r--r--net/sched/cls_rsvp.h4
-rw-r--r--net/sched/cls_tcindex.c6
-rw-r--r--net/sched/cls_u32.c6
-rw-r--r--net/sched/ematch.c17
-rw-r--r--net/sched/sch_api.c8
-rw-r--r--net/sched/sch_atm.c4
-rw-r--r--net/sched/sch_cbq.c20
-rw-r--r--net/sched/sch_hfsc.c6
-rw-r--r--net/sched/sch_htb.c10
-rw-r--r--net/sched/sch_ingress.c4
-rw-r--r--net/sched/sch_netem.c4
-rw-r--r--net/sched/sch_prio.c2
-rw-r--r--net/sched/sch_sfq.c2
-rw-r--r--net/sched/sch_tbf.c4
-rw-r--r--net/sctp/input.c4
-rw-r--r--net/sctp/inqueue.c8
-rw-r--r--net/sctp/sm_make_chunk.c4
-rw-r--r--net/sctp/sm_statefuns.c4
-rw-r--r--net/tipc/config.c2
-rw-r--r--net/tipc/socket.c2
-rw-r--r--net/xfrm/xfrm_user.c40
76 files changed, 257 insertions, 241 deletions
diff --git a/net/atm/lec.c b/net/atm/lec.c
index d339645dc796..a8c6b285e06c 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -283,7 +283,7 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
283 } 283 }
284 284
285 DPRINTK("skbuff head:%lx data:%lx tail:%lx end:%lx\n", 285 DPRINTK("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
286 (long)skb->head, (long)skb->data, (long)skb->tail, 286 (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
287 (long)skb->end); 287 (long)skb->end);
288#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) 288#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
289 if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0) 289 if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94f457360560..10cc13cfae6c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1567,7 +1567,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1567 1567
1568 /* Trim FCS */ 1568 /* Trim FCS */
1569 skb->len--; skb->tail--; 1569 skb->len--; skb->tail--;
1570 fcs = *(u8 *) skb->tail; 1570 fcs = *(u8 *)skb_tail_pointer(skb);
1571 1571
1572 if (__check_fcs(skb->data, type, fcs)) { 1572 if (__check_fcs(skb->data, type, fcs)) {
1573 BT_ERR("bad checksum in packet"); 1573 BT_ERR("bad checksum in packet");
diff --git a/net/core/dev.c b/net/core/dev.c
index 6562e5736e2f..86dc9f693f66 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1069,7 +1069,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
1069 skb_reset_mac_header(skb2); 1069 skb_reset_mac_header(skb2);
1070 1070
1071 if (skb_network_header(skb2) < skb2->data || 1071 if (skb_network_header(skb2) < skb2->data ||
1072 skb_network_header(skb2) > skb2->tail) { 1072 skb2->network_header > skb2->tail) {
1073 if (net_ratelimit()) 1073 if (net_ratelimit())
1074 printk(KERN_CRIT "protocol %04x is " 1074 printk(KERN_CRIT "protocol %04x is "
1075 "buggy, dev %s\n", 1075 "buggy, dev %s\n",
@@ -1175,7 +1175,7 @@ int skb_checksum_help(struct sk_buff *skb)
1175 BUG_ON(offset > (int)skb->len); 1175 BUG_ON(offset > (int)skb->len);
1176 csum = skb_checksum(skb, offset, skb->len-offset, 0); 1176 csum = skb_checksum(skb, offset, skb->len-offset, 0);
1177 1177
1178 offset = skb->tail - skb_transport_header(skb); 1178 offset = skb->tail - skb->transport_header;
1179 BUG_ON(offset <= 0); 1179 BUG_ON(offset <= 0);
1180 BUG_ON(skb->csum_offset + 2 > offset); 1180 BUG_ON(skb->csum_offset + 2 > offset);
1181 1181
diff --git a/net/core/filter.c b/net/core/filter.c
index d2358a5e6339..bd903aaf7aa7 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -46,7 +46,7 @@ static void *__load_pointer(struct sk_buff *skb, int k)
46 else if (k >= SKF_LL_OFF) 46 else if (k >= SKF_LL_OFF)
47 ptr = skb_mac_header(skb) + k - SKF_LL_OFF; 47 ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
48 48
49 if (ptr >= skb->head && ptr < skb->tail) 49 if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
50 return ptr; 50 return ptr;
51 return NULL; 51 return NULL;
52} 52}
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 259473d0559d..bcc25591d8ac 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -61,7 +61,7 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
61 spin_lock_bh(lock); 61 spin_lock_bh(lock);
62 d->lock = lock; 62 d->lock = lock;
63 if (type) 63 if (type)
64 d->tail = (struct rtattr *) skb->tail; 64 d->tail = (struct rtattr *)skb_tail_pointer(skb);
65 d->skb = skb; 65 d->skb = skb;
66 d->compat_tc_stats = tc_stats_type; 66 d->compat_tc_stats = tc_stats_type;
67 d->compat_xstats = xstats_type; 67 d->compat_xstats = xstats_type;
@@ -212,7 +212,7 @@ int
212gnet_stats_finish_copy(struct gnet_dump *d) 212gnet_stats_finish_copy(struct gnet_dump *d)
213{ 213{
214 if (d->tail) 214 if (d->tail)
215 d->tail->rta_len = d->skb->tail - (u8 *) d->tail; 215 d->tail->rta_len = skb_tail_pointer(d->skb) - (u8 *)d->tail;
216 216
217 if (d->compat_tc_stats) 217 if (d->compat_tc_stats)
218 if (gnet_stats_copy(d, d->compat_tc_stats, &d->tc_stats, 218 if (gnet_stats_copy(d, d->compat_tc_stats, &d->tc_stats,
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 9da8357addcd..f9469ea530cc 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2357,7 +2357,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
2357 *vlan_encapsulated_proto = htons(ETH_P_IP); 2357 *vlan_encapsulated_proto = htons(ETH_P_IP);
2358 } 2358 }
2359 2359
2360 skb_set_network_header(skb, skb->tail - skb->data); 2360 skb->network_header = skb->tail;
2361 skb->transport_header = skb->network_header + sizeof(struct iphdr); 2361 skb->transport_header = skb->network_header + sizeof(struct iphdr);
2362 skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr)); 2362 skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr));
2363 2363
@@ -2696,7 +2696,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
2696 *vlan_encapsulated_proto = htons(ETH_P_IPV6); 2696 *vlan_encapsulated_proto = htons(ETH_P_IPV6);
2697 } 2697 }
2698 2698
2699 skb_set_network_header(skb, skb->tail - skb->data); 2699 skb->network_header = skb->tail;
2700 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); 2700 skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
2701 skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr)); 2701 skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr));
2702 2702
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a48b08681261..ddcbc4d10dab 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -87,8 +87,9 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
87void skb_over_panic(struct sk_buff *skb, int sz, void *here) 87void skb_over_panic(struct sk_buff *skb, int sz, void *here)
88{ 88{
89 printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p " 89 printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p "
90 "data:%p tail:%p end:%p dev:%s\n", 90 "data:%p tail:%#lx end:%p dev:%s\n",
91 here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end, 91 here, skb->len, sz, skb->head, skb->data,
92 (unsigned long)skb->tail, skb->end,
92 skb->dev ? skb->dev->name : "<NULL>"); 93 skb->dev ? skb->dev->name : "<NULL>");
93 BUG(); 94 BUG();
94} 95}
@@ -105,8 +106,9 @@ void skb_over_panic(struct sk_buff *skb, int sz, void *here)
105void skb_under_panic(struct sk_buff *skb, int sz, void *here) 106void skb_under_panic(struct sk_buff *skb, int sz, void *here)
106{ 107{
107 printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p " 108 printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
108 "data:%p tail:%p end:%p dev:%s\n", 109 "data:%p tail:%#lx end:%p dev:%s\n",
109 here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end, 110 here, skb->len, sz, skb->head, skb->data,
111 (unsigned long)skb->tail, skb->end,
110 skb->dev ? skb->dev->name : "<NULL>"); 112 skb->dev ? skb->dev->name : "<NULL>");
111 BUG(); 113 BUG();
112} 114}
@@ -167,7 +169,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
167 atomic_set(&skb->users, 1); 169 atomic_set(&skb->users, 1);
168 skb->head = data; 170 skb->head = data;
169 skb->data = data; 171 skb->data = data;
170 skb->tail = data; 172 skb_reset_tail_pointer(skb);
171 skb->end = data + size; 173 skb->end = data + size;
172 /* make sure we initialize shinfo sequentially */ 174 /* make sure we initialize shinfo sequentially */
173 shinfo = skb_shinfo(skb); 175 shinfo = skb_shinfo(skb);
@@ -629,7 +631,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
629 631
630 /* Copy only real data... and, alas, header. This should be 632 /* Copy only real data... and, alas, header. This should be
631 * optimized for the cases when header is void. */ 633 * optimized for the cases when header is void. */
632 memcpy(data + nhead, skb->head, skb->tail - skb->head); 634 memcpy(data + nhead, skb->head,
635 skb->tail
636#ifndef NET_SKBUFF_DATA_USES_OFFSET
637 - skb->head
638#endif
639 );
633 memcpy(data + size, skb->end, sizeof(struct skb_shared_info)); 640 memcpy(data + size, skb->end, sizeof(struct skb_shared_info));
634 641
635 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) 642 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
@@ -645,9 +652,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
645 skb->head = data; 652 skb->head = data;
646 skb->end = data + size; 653 skb->end = data + size;
647 skb->data += off; 654 skb->data += off;
648 skb->tail += off;
649#ifndef NET_SKBUFF_DATA_USES_OFFSET 655#ifndef NET_SKBUFF_DATA_USES_OFFSET
650 /* {transport,network,mac}_header are relative to skb->head */ 656 /* {transport,network,mac}_header and tail are relative to skb->head */
657 skb->tail += off;
651 skb->transport_header += off; 658 skb->transport_header += off;
652 skb->network_header += off; 659 skb->network_header += off;
653 skb->mac_header += off; 660 skb->mac_header += off;
@@ -762,7 +769,7 @@ int skb_pad(struct sk_buff *skb, int pad)
762 return 0; 769 return 0;
763 } 770 }
764 771
765 ntail = skb->data_len + pad - (skb->end - skb->tail); 772 ntail = skb->data_len + pad - (skb->end - skb_tail_pointer(skb));
766 if (likely(skb_cloned(skb) || ntail > 0)) { 773 if (likely(skb_cloned(skb) || ntail > 0)) {
767 err = pskb_expand_head(skb, 0, ntail, GFP_ATOMIC); 774 err = pskb_expand_head(skb, 0, ntail, GFP_ATOMIC);
768 if (unlikely(err)) 775 if (unlikely(err))
@@ -863,7 +870,7 @@ done:
863 } else { 870 } else {
864 skb->len = len; 871 skb->len = len;
865 skb->data_len = 0; 872 skb->data_len = 0;
866 skb->tail = skb->data + len; 873 skb_set_tail_pointer(skb, len);
867 } 874 }
868 875
869 return 0; 876 return 0;
@@ -900,7 +907,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
900 * plus 128 bytes for future expansions. If we have enough 907 * plus 128 bytes for future expansions. If we have enough
901 * room at tail, reallocate without expansion only if skb is cloned. 908 * room at tail, reallocate without expansion only if skb is cloned.
902 */ 909 */
903 int i, k, eat = (skb->tail + delta) - skb->end; 910 int i, k, eat = (skb_tail_pointer(skb) + delta) - skb->end;
904 911
905 if (eat > 0 || skb_cloned(skb)) { 912 if (eat > 0 || skb_cloned(skb)) {
906 if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0, 913 if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
@@ -908,7 +915,7 @@ unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
908 return NULL; 915 return NULL;
909 } 916 }
910 917
911 if (skb_copy_bits(skb, skb_headlen(skb), skb->tail, delta)) 918 if (skb_copy_bits(skb, skb_headlen(skb), skb_tail_pointer(skb), delta))
912 BUG(); 919 BUG();
913 920
914 /* Optimization: no fragments, no reasons to preestimate 921 /* Optimization: no fragments, no reasons to preestimate
@@ -1004,7 +1011,7 @@ pull_pages:
1004 skb->tail += delta; 1011 skb->tail += delta;
1005 skb->data_len -= delta; 1012 skb->data_len -= delta;
1006 1013
1007 return skb->tail; 1014 return skb_tail_pointer(skb);
1008} 1015}
1009 1016
1010/* Copy some data bits from skb to kernel buffer. */ 1017/* Copy some data bits from skb to kernel buffer. */
@@ -1539,7 +1546,7 @@ static inline void skb_split_inside_header(struct sk_buff *skb,
1539 skb1->len += skb1->data_len; 1546 skb1->len += skb1->data_len;
1540 skb->data_len = 0; 1547 skb->data_len = 0;
1541 skb->len = len; 1548 skb->len = len;
1542 skb->tail = skb->data + len; 1549 skb_set_tail_pointer(skb, len);
1543} 1550}
1544 1551
1545static inline void skb_split_no_header(struct sk_buff *skb, 1552static inline void skb_split_no_header(struct sk_buff *skb,
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 7c6a5db544f1..4a777b68e3bc 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1938,7 +1938,7 @@ static inline int rtnetlink_fill_iwinfo(struct sk_buff * skb,
1938{ 1938{
1939 struct ifinfomsg *r; 1939 struct ifinfomsg *r;
1940 struct nlmsghdr *nlh; 1940 struct nlmsghdr *nlh;
1941 unsigned char *b = skb->tail; 1941 unsigned char *b = skb_tail_pointer(skb);
1942 1942
1943 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(*r)); 1943 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(*r));
1944 r = NLMSG_DATA(nlh); 1944 r = NLMSG_DATA(nlh);
@@ -1952,7 +1952,7 @@ static inline int rtnetlink_fill_iwinfo(struct sk_buff * skb,
1952 /* Add the wireless events in the netlink packet */ 1952 /* Add the wireless events in the netlink packet */
1953 RTA_PUT(skb, IFLA_WIRELESS, event_len, event); 1953 RTA_PUT(skb, IFLA_WIRELESS, event_len, event);
1954 1954
1955 nlh->nlmsg_len = skb->tail - b; 1955 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1956 return skb->len; 1956 return skb->len;
1957 1957
1958nlmsg_failure: 1958nlmsg_failure:
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 84b8c5b45fef..7404653880b0 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -681,8 +681,10 @@ void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
681 if (scp->peer.sdn_objnum) 681 if (scp->peer.sdn_objnum)
682 type = 0; 682 type = 0;
683 683
684 skb_put(skb, dn_sockaddr2username(&scp->peer, skb->tail, type)); 684 skb_put(skb, dn_sockaddr2username(&scp->peer,
685 skb_put(skb, dn_sockaddr2username(&scp->addr, skb->tail, 2)); 685 skb_tail_pointer(skb), type));
686 skb_put(skb, dn_sockaddr2username(&scp->addr,
687 skb_tail_pointer(skb), 2));
686 688
687 menuver = DN_MENUVER_ACC | DN_MENUVER_USR; 689 menuver = DN_MENUVER_ACC | DN_MENUVER_USR;
688 if (scp->peer.sdn_flags & SDF_PROXY) 690 if (scp->peer.sdn_flags & SDF_PROXY)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index bb73bf16630f..9678b096b844 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1468,7 +1468,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1468 struct dn_route *rt = (struct dn_route *)skb->dst; 1468 struct dn_route *rt = (struct dn_route *)skb->dst;
1469 struct rtmsg *r; 1469 struct rtmsg *r;
1470 struct nlmsghdr *nlh; 1470 struct nlmsghdr *nlh;
1471 unsigned char *b = skb->tail; 1471 unsigned char *b = skb_tail_pointer(skb);
1472 long expires; 1472 long expires;
1473 1473
1474 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags); 1474 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
@@ -1509,7 +1509,7 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1509 if (rt->fl.iif) 1509 if (rt->fl.iif)
1510 RTA_PUT(skb, RTA_IIF, sizeof(int), &rt->fl.iif); 1510 RTA_PUT(skb, RTA_IIF, sizeof(int), &rt->fl.iif);
1511 1511
1512 nlh->nlmsg_len = skb->tail - b; 1512 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1513 return skb->len; 1513 return skb->len;
1514 1514
1515nlmsg_failure: 1515nlmsg_failure:
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 780a141f8342..544c45540746 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -295,7 +295,7 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
295{ 295{
296 struct rtmsg *rtm; 296 struct rtmsg *rtm;
297 struct nlmsghdr *nlh; 297 struct nlmsghdr *nlh;
298 unsigned char *b = skb->tail; 298 unsigned char *b = skb_tail_pointer(skb);
299 299
300 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*rtm), flags); 300 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*rtm), flags);
301 rtm = NLMSG_DATA(nlh); 301 rtm = NLMSG_DATA(nlh);
@@ -337,13 +337,13 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
337 nhp->rtnh_ifindex = nh->nh_oif; 337 nhp->rtnh_ifindex = nh->nh_oif;
338 if (nh->nh_gw) 338 if (nh->nh_gw)
339 RTA_PUT(skb, RTA_GATEWAY, 2, &nh->nh_gw); 339 RTA_PUT(skb, RTA_GATEWAY, 2, &nh->nh_gw);
340 nhp->rtnh_len = skb->tail - (unsigned char *)nhp; 340 nhp->rtnh_len = skb_tail_pointer(skb) - (unsigned char *)nhp;
341 } endfor_nexthops(fi); 341 } endfor_nexthops(fi);
342 mp_head->rta_type = RTA_MULTIPATH; 342 mp_head->rta_type = RTA_MULTIPATH;
343 mp_head->rta_len = skb->tail - (u8*)mp_head; 343 mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
344 } 344 }
345 345
346 nlh->nlmsg_len = skb->tail - b; 346 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
347 return skb->len; 347 return skb->len;
348 348
349 349
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 0e62def05a58..ceefd9dd0c92 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -33,7 +33,7 @@ static struct sk_buff *dnrmg_build_message(struct sk_buff *rt_skb, int *errp)
33{ 33{
34 struct sk_buff *skb = NULL; 34 struct sk_buff *skb = NULL;
35 size_t size; 35 size_t size;
36 unsigned char *old_tail; 36 sk_buff_data_t old_tail;
37 struct nlmsghdr *nlh; 37 struct nlmsghdr *nlh;
38 unsigned char *ptr; 38 unsigned char *ptr;
39 struct nf_dn_rtmsg *rtm; 39 struct nf_dn_rtmsg *rtm;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 78993dadb53a..b5524f32ac2d 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -366,7 +366,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
366 fh->cb = cb; 366 fh->cb = cb;
367 fh->port = port; 367 fh->port = port;
368 if (sock->type != SOCK_DGRAM) { 368 if (sock->type != SOCK_DGRAM) {
369 skb->tail = skb->data; 369 skb_reset_tail_pointer(skb);
370 skb->len = 0; 370 skb->len = 0;
371 } else if (res < 0) 371 } else if (res < 0)
372 goto out_free; 372 goto out_free;
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 59a765c49cf9..2b854941e06c 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -595,7 +595,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
595 if (frag != 0) 595 if (frag != 0)
596 flen -= hdrlen; 596 flen -= hdrlen;
597 597
598 if (frag_skb->tail + flen > frag_skb->end) { 598 if (skb_tail_pointer(frag_skb) + flen > frag_skb->end) {
599 printk(KERN_WARNING "%s: host decrypted and " 599 printk(KERN_WARNING "%s: host decrypted and "
600 "reassembled frame did not fit skb\n", 600 "reassembled frame did not fit skb\n",
601 dev->name); 601 dev->name);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index de019f9fbfe1..5e5613930ffb 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -21,6 +21,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
21 struct blkcipher_desc desc; 21 struct blkcipher_desc desc;
22 struct esp_data *esp; 22 struct esp_data *esp;
23 struct sk_buff *trailer; 23 struct sk_buff *trailer;
24 u8 *tail;
24 int blksize; 25 int blksize;
25 int clen; 26 int clen;
26 int alen; 27 int alen;
@@ -49,12 +50,13 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
49 goto error; 50 goto error;
50 51
51 /* Fill padding... */ 52 /* Fill padding... */
53 tail = skb_tail_pointer(trailer);
52 do { 54 do {
53 int i; 55 int i;
54 for (i=0; i<clen-skb->len - 2; i++) 56 for (i=0; i<clen-skb->len - 2; i++)
55 *(u8*)(trailer->tail + i) = i+1; 57 tail[i] = i + 1;
56 } while (0); 58 } while (0);
57 *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2; 59 tail[clen - skb->len - 2] = (clen - skb->len) - 2;
58 pskb_put(skb, trailer, clen - skb->len); 60 pskb_put(skb, trailer, clen - skb->len);
59 61
60 __skb_push(skb, skb->data - skb_network_header(skb)); 62 __skb_push(skb, skb->data - skb_network_header(skb));
@@ -62,7 +64,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
62 esph = (struct ip_esp_hdr *)(skb_network_header(skb) + 64 esph = (struct ip_esp_hdr *)(skb_network_header(skb) +
63 top_iph->ihl * 4); 65 top_iph->ihl * 4);
64 top_iph->tot_len = htons(skb->len + alen); 66 top_iph->tot_len = htons(skb->len + alen);
65 *(u8*)(trailer->tail - 1) = top_iph->protocol; 67 *(skb_tail_pointer(skb) - 1) = top_iph->protocol;
66 68
67 /* this is non-NULL only with UDP Encapsulation */ 69 /* this is non-NULL only with UDP Encapsulation */
68 if (x->encap) { 70 if (x->encap) {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 8372f8b8f0cd..d38cbba92a4d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -450,7 +450,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
450 */ 450 */
451 iph = ip_hdr(skb_in); 451 iph = ip_hdr(skb_in);
452 452
453 if ((u8 *)iph < skb_in->head || (u8 *)(iph + 1) > skb_in->tail) 453 if ((u8 *)iph < skb_in->head ||
454 (skb_in->network_header + sizeof(*iph)) > skb_in->tail)
454 goto out; 455 goto out;
455 456
456 /* 457 /*
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fc637fb6750..2506021c2935 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -348,8 +348,8 @@ static int igmpv3_sendpack(struct sk_buff *skb)
348{ 348{
349 struct iphdr *pip = ip_hdr(skb); 349 struct iphdr *pip = ip_hdr(skb);
350 struct igmphdr *pig = igmp_hdr(skb); 350 struct igmphdr *pig = igmp_hdr(skb);
351 const int iplen = skb->tail - skb_network_header(skb); 351 const int iplen = skb->tail - skb->network_header;
352 const int igmplen = skb->tail - skb_transport_header(skb); 352 const int igmplen = skb->tail - skb->transport_header;
353 353
354 pip->tot_len = htons(iplen); 354 pip->tot_len = htons(iplen);
355 ip_send_check(pip); 355 ip_send_check(pip);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 5df71cd08da8..37362cd1d07f 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -60,7 +60,7 @@ static int inet_csk_diag_fill(struct sock *sk,
60 struct nlmsghdr *nlh; 60 struct nlmsghdr *nlh;
61 void *info = NULL; 61 void *info = NULL;
62 struct inet_diag_meminfo *minfo = NULL; 62 struct inet_diag_meminfo *minfo = NULL;
63 unsigned char *b = skb->tail; 63 unsigned char *b = skb_tail_pointer(skb);
64 const struct inet_diag_handler *handler; 64 const struct inet_diag_handler *handler;
65 65
66 handler = inet_diag_table[unlh->nlmsg_type]; 66 handler = inet_diag_table[unlh->nlmsg_type];
@@ -147,7 +147,7 @@ static int inet_csk_diag_fill(struct sock *sk,
147 icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info) 147 icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
148 icsk->icsk_ca_ops->get_info(sk, ext, skb); 148 icsk->icsk_ca_ops->get_info(sk, ext, skb);
149 149
150 nlh->nlmsg_len = skb->tail - b; 150 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
151 return skb->len; 151 return skb->len;
152 152
153rtattr_failure: 153rtattr_failure:
@@ -163,7 +163,7 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
163{ 163{
164 long tmo; 164 long tmo;
165 struct inet_diag_msg *r; 165 struct inet_diag_msg *r;
166 const unsigned char *previous_tail = skb->tail; 166 const unsigned char *previous_tail = skb_tail_pointer(skb);
167 struct nlmsghdr *nlh = NLMSG_PUT(skb, pid, seq, 167 struct nlmsghdr *nlh = NLMSG_PUT(skb, pid, seq,
168 unlh->nlmsg_type, sizeof(*r)); 168 unlh->nlmsg_type, sizeof(*r));
169 169
@@ -205,7 +205,7 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
205 &tw6->tw_v6_daddr); 205 &tw6->tw_v6_daddr);
206 } 206 }
207#endif 207#endif
208 nlh->nlmsg_len = skb->tail - previous_tail; 208 nlh->nlmsg_len = skb_tail_pointer(skb) - previous_tail;
209 return skb->len; 209 return skb->len;
210nlmsg_failure: 210nlmsg_failure:
211 skb_trim(skb, previous_tail - skb->data); 211 skb_trim(skb, previous_tail - skb->data);
@@ -535,7 +535,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
535{ 535{
536 const struct inet_request_sock *ireq = inet_rsk(req); 536 const struct inet_request_sock *ireq = inet_rsk(req);
537 struct inet_sock *inet = inet_sk(sk); 537 struct inet_sock *inet = inet_sk(sk);
538 unsigned char *b = skb->tail; 538 unsigned char *b = skb_tail_pointer(skb);
539 struct inet_diag_msg *r; 539 struct inet_diag_msg *r;
540 struct nlmsghdr *nlh; 540 struct nlmsghdr *nlh;
541 long tmo; 541 long tmo;
@@ -574,7 +574,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
574 &inet6_rsk(req)->rmt_addr); 574 &inet6_rsk(req)->rmt_addr);
575 } 575 }
576#endif 576#endif
577 nlh->nlmsg_len = skb->tail - b; 577 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
578 578
579 return skb->len; 579 return skb->len;
580 580
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fcb35cd5ccfd..c199d2311731 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -316,7 +316,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
316 serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb); 316 serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
317 serr->port = port; 317 serr->port = port;
318 318
319 __skb_pull(skb, skb->tail - skb->data); 319 __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
320 skb_reset_transport_header(skb); 320 skb_reset_transport_header(skb);
321 321
322 if (sock_queue_err_skb(sk, skb)) 322 if (sock_queue_err_skb(sk, skb))
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 50d0b301380e..ea0a491dce92 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -513,7 +513,8 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
513 struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr)); 513 struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
514 514
515 if (ipmr_fill_mroute(skb, c, NLMSG_DATA(nlh)) > 0) { 515 if (ipmr_fill_mroute(skb, c, NLMSG_DATA(nlh)) > 0) {
516 nlh->nlmsg_len = skb->tail - (u8*)nlh; 516 nlh->nlmsg_len = (skb_tail_pointer(skb) -
517 (u8 *)nlh);
517 } else { 518 } else {
518 nlh->nlmsg_type = NLMSG_ERROR; 519 nlh->nlmsg_type = NLMSG_ERROR;
519 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr)); 520 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
@@ -580,7 +581,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
580 * Copy the IP header 581 * Copy the IP header
581 */ 582 */
582 583
583 skb_set_network_header(skb, skb->tail - skb->data); 584 skb->network_header = skb->tail;
584 skb_put(skb, ihl); 585 skb_put(skb, ihl);
585 memcpy(skb->data,pkt->data,ihl); 586 memcpy(skb->data,pkt->data,ihl);
586 ip_hdr(skb)->protocol = 0; /* Flag to the kernel this is a route add */ 587 ip_hdr(skb)->protocol = 0; /* Flag to the kernel this is a route add */
@@ -1544,7 +1545,7 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
1544 int ct; 1545 int ct;
1545 struct rtnexthop *nhp; 1546 struct rtnexthop *nhp;
1546 struct net_device *dev = vif_table[c->mfc_parent].dev; 1547 struct net_device *dev = vif_table[c->mfc_parent].dev;
1547 u8 *b = skb->tail; 1548 u8 *b = skb_tail_pointer(skb);
1548 struct rtattr *mp_head; 1549 struct rtattr *mp_head;
1549 1550
1550 if (dev) 1551 if (dev)
@@ -1564,7 +1565,7 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
1564 } 1565 }
1565 } 1566 }
1566 mp_head->rta_type = RTA_MULTIPATH; 1567 mp_head->rta_type = RTA_MULTIPATH;
1567 mp_head->rta_len = skb->tail - (u8*)mp_head; 1568 mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
1568 rtm->rtm_type = RTN_MULTICAST; 1569 rtm->rtm_type = RTN_MULTICAST;
1569 return 1; 1570 return 1;
1570 1571
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 25bd68967305..344ddbbdc756 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -162,7 +162,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
162 iph = ip_hdr(*pskb); 162 iph = ip_hdr(*pskb);
163 th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]); 163 th = (struct tcphdr *)&(((char *)iph)[iph->ihl*4]);
164 data = (char *)th + (th->doff << 2); 164 data = (char *)th + (th->doff << 2);
165 data_limit = (*pskb)->tail; 165 data_limit = skb_tail_pointer(*pskb);
166 166
167 if (ip_vs_ftp_get_addrport(data, data_limit, 167 if (ip_vs_ftp_get_addrport(data, data_limit,
168 SERVER_STRING, 168 SERVER_STRING,
@@ -269,7 +269,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
269 the length of the header in 32-bit multiples, it is accurate 269 the length of the header in 32-bit multiples, it is accurate
270 to calculate data address by th+HLEN*4 */ 270 to calculate data address by th+HLEN*4 */
271 data = data_start = (char *)th + (th->doff << 2); 271 data = data_start = (char *)th + (th->doff << 2);
272 data_limit = (*pskb)->tail; 272 data_limit = skb_tail_pointer(*pskb);
273 273
274 while (data <= data_limit - 6) { 274 while (data <= data_limit - 6) {
275 if (strnicmp(data, "PASV\r\n", 6) == 0) { 275 if (strnicmp(data, "PASV\r\n", 6) == 0) {
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index b4450f1ccc1b..6298d404e7c7 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -37,28 +37,28 @@ target(struct sk_buff **pskb,
37 /* We assume that pln and hln were checked in the match */ 37 /* We assume that pln and hln were checked in the match */
38 if (mangle->flags & ARPT_MANGLE_SDEV) { 38 if (mangle->flags & ARPT_MANGLE_SDEV) {
39 if (ARPT_DEV_ADDR_LEN_MAX < hln || 39 if (ARPT_DEV_ADDR_LEN_MAX < hln ||
40 (arpptr + hln > (**pskb).tail)) 40 (arpptr + hln > skb_tail_pointer(*pskb)))
41 return NF_DROP; 41 return NF_DROP;
42 memcpy(arpptr, mangle->src_devaddr, hln); 42 memcpy(arpptr, mangle->src_devaddr, hln);
43 } 43 }
44 arpptr += hln; 44 arpptr += hln;
45 if (mangle->flags & ARPT_MANGLE_SIP) { 45 if (mangle->flags & ARPT_MANGLE_SIP) {
46 if (ARPT_MANGLE_ADDR_LEN_MAX < pln || 46 if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
47 (arpptr + pln > (**pskb).tail)) 47 (arpptr + pln > skb_tail_pointer(*pskb)))
48 return NF_DROP; 48 return NF_DROP;
49 memcpy(arpptr, &mangle->u_s.src_ip, pln); 49 memcpy(arpptr, &mangle->u_s.src_ip, pln);
50 } 50 }
51 arpptr += pln; 51 arpptr += pln;
52 if (mangle->flags & ARPT_MANGLE_TDEV) { 52 if (mangle->flags & ARPT_MANGLE_TDEV) {
53 if (ARPT_DEV_ADDR_LEN_MAX < hln || 53 if (ARPT_DEV_ADDR_LEN_MAX < hln ||
54 (arpptr + hln > (**pskb).tail)) 54 (arpptr + hln > skb_tail_pointer(*pskb)))
55 return NF_DROP; 55 return NF_DROP;
56 memcpy(arpptr, mangle->tgt_devaddr, hln); 56 memcpy(arpptr, mangle->tgt_devaddr, hln);
57 } 57 }
58 arpptr += hln; 58 arpptr += hln;
59 if (mangle->flags & ARPT_MANGLE_TIP) { 59 if (mangle->flags & ARPT_MANGLE_TIP) {
60 if (ARPT_MANGLE_ADDR_LEN_MAX < pln || 60 if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
61 (arpptr + pln > (**pskb).tail)) 61 (arpptr + pln > skb_tail_pointer(*pskb)))
62 return NF_DROP; 62 return NF_DROP;
63 memcpy(arpptr, &mangle->u_t.tgt_ip, pln); 63 memcpy(arpptr, &mangle->u_t.tgt_ip, pln);
64 } 64 }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5842f1aa973a..15e0d2002235 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -191,7 +191,7 @@ ipq_flush(int verdict)
191static struct sk_buff * 191static struct sk_buff *
192ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp) 192ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
193{ 193{
194 unsigned char *old_tail; 194 sk_buff_data_t old_tail;
195 size_t size = 0; 195 size_t size = 0;
196 size_t data_len = 0; 196 size_t data_len = 0;
197 struct sk_buff *skb; 197 struct sk_buff *skb;
@@ -235,7 +235,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
235 if (!skb) 235 if (!skb)
236 goto nlmsg_failure; 236 goto nlmsg_failure;
237 237
238 old_tail= skb->tail; 238 old_tail = skb->tail;
239 nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh)); 239 nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
240 pmsg = NLMSG_DATA(nlh); 240 pmsg = NLMSG_DATA(nlh);
241 memset(pmsg, 0, sizeof(*pmsg)); 241 memset(pmsg, 0, sizeof(*pmsg));
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index c2c92ff12781..8a40fbe842b7 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -92,7 +92,8 @@ static void mangle_contents(struct sk_buff *skb,
92 /* move post-replacement */ 92 /* move post-replacement */
93 memmove(data + match_offset + rep_len, 93 memmove(data + match_offset + rep_len,
94 data + match_offset + match_len, 94 data + match_offset + match_len,
95 skb->tail - (data + match_offset + match_len)); 95 skb->tail - (skb->network_header + dataoff +
96 match_offset + match_len));
96 97
97 /* insert data from buffer */ 98 /* insert data from buffer */
98 memcpy(data + match_offset, rep_buffer, rep_len); 99 memcpy(data + match_offset, rep_buffer, rep_len);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2b214cc3724c..18a09a78ca0b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2231,7 +2231,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
2231 th->cwr = 0; 2231 th->cwr = 0;
2232 } while (skb->next); 2232 } while (skb->next);
2233 2233
2234 delta = htonl(oldlen + (skb->tail - skb_transport_header(skb)) + 2234 delta = htonl(oldlen + (skb->tail - skb->transport_header) +
2235 skb->data_len); 2235 skb->data_len);
2236 th->check = ~csum_fold((__force __wsum)((__force u32)th->check + 2236 th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
2237 (__force u32)delta)); 2237 (__force u32)delta));
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 29c53fbb2204..c22cdcd84320 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -733,7 +733,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
733 } 733 }
734 skb_shinfo(skb)->nr_frags = k; 734 skb_shinfo(skb)->nr_frags = k;
735 735
736 skb->tail = skb->data; 736 skb_reset_tail_pointer(skb);
737 skb->data_len -= len; 737 skb->data_len -= len;
738 skb->len = skb->data_len; 738 skb->len = skb->data_len;
739} 739}
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f16f4f0c5814..4a355fea4098 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -268,7 +268,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
268 serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb); 268 serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
269 serr->port = fl->fl_ip_dport; 269 serr->port = fl->fl_ip_dport;
270 270
271 __skb_pull(skb, skb->tail - skb->data); 271 __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
272 skb_reset_transport_header(skb); 272 skb_reset_transport_header(skb);
273 273
274 if (sock_queue_err_skb(sk, skb)) 274 if (sock_queue_err_skb(sk, skb))
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7fdf84dee73f..b8e8914cc002 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -51,6 +51,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
51 int clen; 51 int clen;
52 int alen; 52 int alen;
53 int nfrags; 53 int nfrags;
54 u8 *tail;
54 struct esp_data *esp = x->data; 55 struct esp_data *esp = x->data;
55 int hdr_len = (skb_transport_offset(skb) + 56 int hdr_len = (skb_transport_offset(skb) +
56 sizeof(*esph) + esp->conf.ivlen); 57 sizeof(*esph) + esp->conf.ivlen);
@@ -78,18 +79,19 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
78 } 79 }
79 80
80 /* Fill padding... */ 81 /* Fill padding... */
82 tail = skb_tail_pointer(trailer);
81 do { 83 do {
82 int i; 84 int i;
83 for (i=0; i<clen-skb->len - 2; i++) 85 for (i=0; i<clen-skb->len - 2; i++)
84 *(u8*)(trailer->tail + i) = i+1; 86 tail[i] = i + 1;
85 } while (0); 87 } while (0);
86 *(u8*)(trailer->tail + clen-skb->len - 2) = (clen - skb->len)-2; 88 tail[clen-skb->len - 2] = (clen - skb->len) - 2;
87 pskb_put(skb, trailer, clen - skb->len); 89 pskb_put(skb, trailer, clen - skb->len);
88 90
89 top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len); 91 top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
90 esph = (struct ipv6_esp_hdr *)skb_transport_header(skb); 92 esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);
91 top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph)); 93 top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
92 *(u8 *)(trailer->tail - 1) = *skb_network_header(skb); 94 *(skb_tail_pointer(skb) - 1) = *skb_network_header(skb);
93 *skb_network_header(skb) = IPPROTO_ESP; 95 *skb_network_header(skb) = IPPROTO_ESP;
94 96
95 esph->spi = x->id.spi; 97 esph->spi = x->id.spi;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index a6a275db88cd..275d2e812a44 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -51,7 +51,7 @@
51int ipv6_find_tlv(struct sk_buff *skb, int offset, int type) 51int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
52{ 52{
53 const unsigned char *nh = skb_network_header(skb); 53 const unsigned char *nh = skb_network_header(skb);
54 int packet_len = skb->tail - nh; 54 int packet_len = skb->tail - skb->network_header;
55 struct ipv6_opt_hdr *hdr; 55 struct ipv6_opt_hdr *hdr;
56 int len; 56 int len;
57 57
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d3edc3cf1ce9..e94992ab92e6 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -317,7 +317,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
317 int hlimit, tclass; 317 int hlimit, tclass;
318 int err = 0; 318 int err = 0;
319 319
320 if ((u8*)hdr < skb->head || (u8*)(hdr+1) > skb->tail) 320 if ((u8 *)hdr < skb->head ||
321 (skb->network_header + sizeof(*hdr)) > skb->tail)
321 return; 322 return;
322 323
323 /* 324 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b2c092c6b9dc..e2b8db6b9aef 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -514,7 +514,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
514 u16 offset = sizeof(struct ipv6hdr); 514 u16 offset = sizeof(struct ipv6hdr);
515 struct ipv6_opt_hdr *exthdr = 515 struct ipv6_opt_hdr *exthdr =
516 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1); 516 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
517 unsigned int packet_len = skb->tail - skb_network_header(skb); 517 unsigned int packet_len = skb->tail - skb->network_header;
518 int found_rhdr = 0; 518 int found_rhdr = 0;
519 *nexthdr = &ipv6_hdr(skb)->nexthdr; 519 *nexthdr = &ipv6_hdr(skb)->nexthdr;
520 520
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4c45bcce75e8..6c2758951d60 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1423,7 +1423,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
1423 1423
1424 memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra)); 1424 memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
1425 1425
1426 skb_set_transport_header(skb, skb->tail - skb->data); 1426 skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
1427 skb_put(skb, sizeof(*pmr)); 1427 skb_put(skb, sizeof(*pmr));
1428 pmr = (struct mld2_report *)skb_transport_header(skb); 1428 pmr = (struct mld2_report *)skb_transport_header(skb);
1429 pmr->type = ICMPV6_MLD2_REPORT; 1429 pmr->type = ICMPV6_MLD2_REPORT;
@@ -1468,8 +1468,8 @@ static void mld_sendpack(struct sk_buff *skb)
1468 int err; 1468 int err;
1469 1469
1470 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS); 1470 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
1471 payload_len = skb->tail - skb_network_header(skb) - sizeof(*pip6); 1471 payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
1472 mldlen = skb->tail - skb_transport_header(skb); 1472 mldlen = skb->tail - skb->transport_header;
1473 pip6->payload_len = htons(payload_len); 1473 pip6->payload_len = htons(payload_len);
1474 1474
1475 pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen, 1475 pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index f0288e92fb52..6ed763ee6785 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -260,7 +260,7 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
260 struct ipv6_opt_hdr *exthdr = 260 struct ipv6_opt_hdr *exthdr =
261 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1); 261 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
262 const unsigned char *nh = skb_network_header(skb); 262 const unsigned char *nh = skb_network_header(skb);
263 unsigned int packet_len = skb->tail - nh; 263 unsigned int packet_len = skb->tail - skb->network_header;
264 int found_rhdr = 0; 264 int found_rhdr = 0;
265 265
266 *nexthdr = &ipv6_hdr(skb)->nexthdr; 266 *nexthdr = &ipv6_hdr(skb)->nexthdr;
@@ -392,7 +392,7 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
392 struct ipv6_opt_hdr *exthdr = 392 struct ipv6_opt_hdr *exthdr =
393 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1); 393 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
394 const unsigned char *nh = skb_network_header(skb); 394 const unsigned char *nh = skb_network_header(skb);
395 unsigned int packet_len = skb->tail - nh; 395 unsigned int packet_len = skb->tail - skb->network_header;
396 int found_rhdr = 0; 396 int found_rhdr = 0;
397 397
398 *nexthdr = &ipv6_hdr(skb)->nexthdr; 398 *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f8e619772fb4..b1cf70816477 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -492,7 +492,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
492 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 492 skb_reserve(skb, LL_RESERVED_SPACE(dev));
493 ip6_nd_hdr(sk, skb, dev, src_addr, daddr, IPPROTO_ICMPV6, len); 493 ip6_nd_hdr(sk, skb, dev, src_addr, daddr, IPPROTO_ICMPV6, len);
494 494
495 skb_set_transport_header(skb, skb->tail - skb->data); 495 skb->transport_header = skb->tail;
496 skb_put(skb, len); 496 skb_put(skb, len);
497 msg = (struct nd_msg *)skb_transport_header(skb); 497 msg = (struct nd_msg *)skb_transport_header(skb);
498 498
@@ -584,7 +584,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
584 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 584 skb_reserve(skb, LL_RESERVED_SPACE(dev));
585 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len); 585 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
586 586
587 skb_set_transport_header(skb, skb->tail - skb->data); 587 skb->transport_header = skb->tail;
588 skb_put(skb, len); 588 skb_put(skb, len);
589 msg = (struct nd_msg *)skb_transport_header(skb); 589 msg = (struct nd_msg *)skb_transport_header(skb);
590 msg->icmph.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION; 590 msg->icmph.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION;
@@ -685,7 +685,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
685 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 685 skb_reserve(skb, LL_RESERVED_SPACE(dev));
686 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len); 686 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
687 687
688 skb_set_transport_header(skb, skb->tail - skb->data); 688 skb->transport_header = skb->tail;
689 skb_put(skb, len); 689 skb_put(skb, len);
690 hdr = icmp6_hdr(skb); 690 hdr = icmp6_hdr(skb);
691 hdr->icmp6_type = NDISC_ROUTER_SOLICITATION; 691 hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
@@ -767,7 +767,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
767 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 767 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
768 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 768 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
769 u8 *lladdr = NULL; 769 u8 *lladdr = NULL;
770 u32 ndoptlen = skb->tail - msg->opt; 770 u32 ndoptlen = skb->tail - (skb->transport_header +
771 offsetof(struct nd_msg, opt));
771 struct ndisc_options ndopts; 772 struct ndisc_options ndopts;
772 struct net_device *dev = skb->dev; 773 struct net_device *dev = skb->dev;
773 struct inet6_ifaddr *ifp; 774 struct inet6_ifaddr *ifp;
@@ -945,7 +946,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
945 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 946 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
946 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 947 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
947 u8 *lladdr = NULL; 948 u8 *lladdr = NULL;
948 u32 ndoptlen = skb->tail - msg->opt; 949 u32 ndoptlen = skb->tail - (skb->transport_header +
950 offsetof(struct nd_msg, opt));
949 struct ndisc_options ndopts; 951 struct ndisc_options ndopts;
950 struct net_device *dev = skb->dev; 952 struct net_device *dev = skb->dev;
951 struct inet6_ifaddr *ifp; 953 struct inet6_ifaddr *ifp;
@@ -1111,8 +1113,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
1111 1113
1112 __u8 * opt = (__u8 *)(ra_msg + 1); 1114 __u8 * opt = (__u8 *)(ra_msg + 1);
1113 1115
1114 optlen = (skb->tail - skb_transport_header(skb)) - 1116 optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
1115 sizeof(struct ra_msg);
1116 1117
1117 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1118 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1118 ND_PRINTK2(KERN_WARNING 1119 ND_PRINTK2(KERN_WARNING
@@ -1361,7 +1362,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
1361 return; 1362 return;
1362 } 1363 }
1363 1364
1364 optlen = skb->tail - skb_transport_header(skb); 1365 optlen = skb->tail - skb->transport_header;
1365 optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr); 1366 optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1366 1367
1367 if (optlen < 0) { 1368 if (optlen < 0) {
@@ -1522,7 +1523,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
1522 ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr, 1523 ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
1523 IPPROTO_ICMPV6, len); 1524 IPPROTO_ICMPV6, len);
1524 1525
1525 skb_set_transport_header(buff, buff->tail - buff->data); 1526 skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
1526 skb_put(buff, len); 1527 skb_put(buff, len);
1527 icmph = icmp6_hdr(buff); 1528 icmph = icmp6_hdr(buff);
1528 1529
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 66a2c4135251..5cfce218c5e1 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -189,7 +189,7 @@ ipq_flush(int verdict)
189static struct sk_buff * 189static struct sk_buff *
190ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp) 190ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
191{ 191{
192 unsigned char *old_tail; 192 sk_buff_data_t old_tail;
193 size_t size = 0; 193 size_t size = 0;
194 size_t data_len = 0; 194 size_t data_len = 0;
195 struct sk_buff *skb; 195 struct sk_buff *skb;
@@ -233,7 +233,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
233 if (!skb) 233 if (!skb)
234 goto nlmsg_failure; 234 goto nlmsg_failure;
235 235
236 old_tail= skb->tail; 236 old_tail = skb->tail;
237 nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh)); 237 nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
238 pmsg = NLMSG_DATA(nlh); 238 pmsg = NLMSG_DATA(nlh);
239 memset(pmsg, 0, sizeof(*pmsg)); 239 memset(pmsg, 0, sizeof(*pmsg));
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8705f6a502d9..2b3be68b70a7 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1077,7 +1077,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
1077 spin_lock_bh(&sk->sk_receive_queue.lock); 1077 spin_lock_bh(&sk->sk_receive_queue.lock);
1078 skb = skb_peek(&sk->sk_receive_queue); 1078 skb = skb_peek(&sk->sk_receive_queue);
1079 if (skb != NULL) 1079 if (skb != NULL)
1080 amount = skb->tail - skb_transport_header(skb); 1080 amount = skb->tail - skb->transport_header;
1081 spin_unlock_bh(&sk->sk_receive_queue.lock); 1081 spin_unlock_bh(&sk->sk_receive_queue.lock);
1082 return put_user(amount, (int __user *)arg); 1082 return put_user(amount, (int __user *)arg);
1083 } 1083 }
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index 01d7c9c7b3b4..e5e4792a0314 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -133,8 +133,8 @@ int ircomm_param_request(struct ircomm_tty_cb *self, __u8 pi, int flush)
133 * Inserting is a little bit tricky since we don't know how much 133 * Inserting is a little bit tricky since we don't know how much
134 * room we will need. But this should hopefully work OK 134 * room we will need. But this should hopefully work OK
135 */ 135 */
136 count = irda_param_insert(self, pi, skb->tail, skb_tailroom(skb), 136 count = irda_param_insert(self, pi, skb_tail_pointer(skb),
137 &ircomm_param_info); 137 skb_tailroom(skb), &ircomm_param_info);
138 if (count < 0) { 138 if (count < 0) {
139 IRDA_WARNING("%s(), no room for parameter!\n", __FUNCTION__); 139 IRDA_WARNING("%s(), no room for parameter!\n", __FUNCTION__);
140 spin_unlock_irqrestore(&self->spinlock, flags); 140 spin_unlock_irqrestore(&self->spinlock, flags);
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index fcf9d6599628..ed69773b0f8e 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1039,7 +1039,7 @@ static int __irlan_insert_param(struct sk_buff *skb, char *param, int type,
1039 } 1039 }
1040 1040
1041 /* Insert at end of sk-buffer */ 1041 /* Insert at end of sk-buffer */
1042 frame = skb->tail; 1042 frame = skb_tail_pointer(skb);
1043 1043
1044 /* Make space for data */ 1044 /* Make space for data */
1045 if (skb_tailroom(skb) < (param_len+value_len+3)) { 1045 if (skb_tailroom(skb) < (param_len+value_len+3)) {
diff --git a/net/irda/qos.c b/net/irda/qos.c
index 349012c926b7..aeb18cf1dcae 100644
--- a/net/irda/qos.c
+++ b/net/irda/qos.c
@@ -469,49 +469,49 @@ int irlap_insert_qos_negotiation_params(struct irlap_cb *self,
469 int ret; 469 int ret;
470 470
471 /* Insert data rate */ 471 /* Insert data rate */
472 ret = irda_param_insert(self, PI_BAUD_RATE, skb->tail, 472 ret = irda_param_insert(self, PI_BAUD_RATE, skb_tail_pointer(skb),
473 skb_tailroom(skb), &irlap_param_info); 473 skb_tailroom(skb), &irlap_param_info);
474 if (ret < 0) 474 if (ret < 0)
475 return ret; 475 return ret;
476 skb_put(skb, ret); 476 skb_put(skb, ret);
477 477
478 /* Insert max turnaround time */ 478 /* Insert max turnaround time */
479 ret = irda_param_insert(self, PI_MAX_TURN_TIME, skb->tail, 479 ret = irda_param_insert(self, PI_MAX_TURN_TIME, skb_tail_pointer(skb),
480 skb_tailroom(skb), &irlap_param_info); 480 skb_tailroom(skb), &irlap_param_info);
481 if (ret < 0) 481 if (ret < 0)
482 return ret; 482 return ret;
483 skb_put(skb, ret); 483 skb_put(skb, ret);
484 484
485 /* Insert data size */ 485 /* Insert data size */
486 ret = irda_param_insert(self, PI_DATA_SIZE, skb->tail, 486 ret = irda_param_insert(self, PI_DATA_SIZE, skb_tail_pointer(skb),
487 skb_tailroom(skb), &irlap_param_info); 487 skb_tailroom(skb), &irlap_param_info);
488 if (ret < 0) 488 if (ret < 0)
489 return ret; 489 return ret;
490 skb_put(skb, ret); 490 skb_put(skb, ret);
491 491
492 /* Insert window size */ 492 /* Insert window size */
493 ret = irda_param_insert(self, PI_WINDOW_SIZE, skb->tail, 493 ret = irda_param_insert(self, PI_WINDOW_SIZE, skb_tail_pointer(skb),
494 skb_tailroom(skb), &irlap_param_info); 494 skb_tailroom(skb), &irlap_param_info);
495 if (ret < 0) 495 if (ret < 0)
496 return ret; 496 return ret;
497 skb_put(skb, ret); 497 skb_put(skb, ret);
498 498
499 /* Insert additional BOFs */ 499 /* Insert additional BOFs */
500 ret = irda_param_insert(self, PI_ADD_BOFS, skb->tail, 500 ret = irda_param_insert(self, PI_ADD_BOFS, skb_tail_pointer(skb),
501 skb_tailroom(skb), &irlap_param_info); 501 skb_tailroom(skb), &irlap_param_info);
502 if (ret < 0) 502 if (ret < 0)
503 return ret; 503 return ret;
504 skb_put(skb, ret); 504 skb_put(skb, ret);
505 505
506 /* Insert minimum turnaround time */ 506 /* Insert minimum turnaround time */
507 ret = irda_param_insert(self, PI_MIN_TURN_TIME, skb->tail, 507 ret = irda_param_insert(self, PI_MIN_TURN_TIME, skb_tail_pointer(skb),
508 skb_tailroom(skb), &irlap_param_info); 508 skb_tailroom(skb), &irlap_param_info);
509 if (ret < 0) 509 if (ret < 0)
510 return ret; 510 return ret;
511 skb_put(skb, ret); 511 skb_put(skb, ret);
512 512
513 /* Insert link disconnect/threshold time */ 513 /* Insert link disconnect/threshold time */
514 ret = irda_param_insert(self, PI_LINK_DISC, skb->tail, 514 ret = irda_param_insert(self, PI_LINK_DISC, skb_tail_pointer(skb),
515 skb_tailroom(skb), &irlap_param_info); 515 skb_tailroom(skb), &irlap_param_info);
516 if (ret < 0) 516 if (ret < 0)
517 return ret; 517 return ret;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 48f05314ebf7..442300c633d7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -268,9 +268,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
268 struct nlmsghdr *nlh; 268 struct nlmsghdr *nlh;
269 struct nfgenmsg *nfmsg; 269 struct nfgenmsg *nfmsg;
270 struct nfattr *nest_parms; 270 struct nfattr *nest_parms;
271 unsigned char *b; 271 unsigned char *b = skb_tail_pointer(skb);
272
273 b = skb->tail;
274 272
275 event |= NFNL_SUBSYS_CTNETLINK << 8; 273 event |= NFNL_SUBSYS_CTNETLINK << 8;
276 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg)); 274 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
@@ -303,7 +301,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
303 ctnetlink_dump_use(skb, ct) < 0) 301 ctnetlink_dump_use(skb, ct) < 0)
304 goto nfattr_failure; 302 goto nfattr_failure;
305 303
306 nlh->nlmsg_len = skb->tail - b; 304 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
307 return skb->len; 305 return skb->len;
308 306
309nlmsg_failure: 307nlmsg_failure:
@@ -322,7 +320,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
322 struct nf_conn *ct = (struct nf_conn *)ptr; 320 struct nf_conn *ct = (struct nf_conn *)ptr;
323 struct sk_buff *skb; 321 struct sk_buff *skb;
324 unsigned int type; 322 unsigned int type;
325 unsigned char *b; 323 sk_buff_data_t b;
326 unsigned int flags = 0, group; 324 unsigned int flags = 0, group;
327 325
328 /* ignore our fake conntrack entry */ 326 /* ignore our fake conntrack entry */
@@ -1152,9 +1150,7 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1152{ 1150{
1153 struct nlmsghdr *nlh; 1151 struct nlmsghdr *nlh;
1154 struct nfgenmsg *nfmsg; 1152 struct nfgenmsg *nfmsg;
1155 unsigned char *b; 1153 unsigned char *b = skb_tail_pointer(skb);
1156
1157 b = skb->tail;
1158 1154
1159 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8; 1155 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1160 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg)); 1156 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
@@ -1168,7 +1164,7 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1168 if (ctnetlink_exp_dump_expect(skb, exp) < 0) 1164 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1169 goto nfattr_failure; 1165 goto nfattr_failure;
1170 1166
1171 nlh->nlmsg_len = skb->tail - b; 1167 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1172 return skb->len; 1168 return skb->len;
1173 1169
1174nlmsg_failure: 1170nlmsg_failure:
@@ -1186,7 +1182,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
1186 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr; 1182 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1187 struct sk_buff *skb; 1183 struct sk_buff *skb;
1188 unsigned int type; 1184 unsigned int type;
1189 unsigned char *b; 1185 sk_buff_data_t b;
1190 int flags = 0; 1186 int flags = 0;
1191 1187
1192 if (events & IPEXP_NEW) { 1188 if (events & IPEXP_NEW) {
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 5eeebd2efa7a..9709f94787f8 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -409,15 +409,14 @@ __build_packet_message(struct nfulnl_instance *inst,
409 const struct nf_loginfo *li, 409 const struct nf_loginfo *li,
410 const char *prefix, unsigned int plen) 410 const char *prefix, unsigned int plen)
411{ 411{
412 unsigned char *old_tail;
413 struct nfulnl_msg_packet_hdr pmsg; 412 struct nfulnl_msg_packet_hdr pmsg;
414 struct nlmsghdr *nlh; 413 struct nlmsghdr *nlh;
415 struct nfgenmsg *nfmsg; 414 struct nfgenmsg *nfmsg;
416 __be32 tmp_uint; 415 __be32 tmp_uint;
416 sk_buff_data_t old_tail = inst->skb->tail;
417 417
418 UDEBUG("entered\n"); 418 UDEBUG("entered\n");
419 419
420 old_tail = inst->skb->tail;
421 nlh = NLMSG_PUT(inst->skb, 0, 0, 420 nlh = NLMSG_PUT(inst->skb, 0, 0,
422 NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET, 421 NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
423 sizeof(struct nfgenmsg)); 422 sizeof(struct nfgenmsg));
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cfbee39f61d6..b6585caa431e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -338,7 +338,7 @@ static struct sk_buff *
338nfqnl_build_packet_message(struct nfqnl_instance *queue, 338nfqnl_build_packet_message(struct nfqnl_instance *queue,
339 struct nfqnl_queue_entry *entry, int *errp) 339 struct nfqnl_queue_entry *entry, int *errp)
340{ 340{
341 unsigned char *old_tail; 341 sk_buff_data_t old_tail;
342 size_t size; 342 size_t size;
343 size_t data_len = 0; 343 size_t data_len = 0;
344 struct sk_buff *skb; 344 struct sk_buff *skb;
@@ -404,7 +404,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
404 if (!skb) 404 if (!skb)
405 goto nlmsg_failure; 405 goto nlmsg_failure;
406 406
407 old_tail= skb->tail; 407 old_tail = skb->tail;
408 nlh = NLMSG_PUT(skb, 0, 0, 408 nlh = NLMSG_PUT(skb, 0, 0,
409 NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET, 409 NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
410 sizeof(struct nfgenmsg)); 410 sizeof(struct nfgenmsg));
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 50dc5edb7752..fdb6eb13cbcb 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -785,7 +785,7 @@ static inline struct sk_buff *netlink_trim(struct sk_buff *skb,
785 785
786 skb_orphan(skb); 786 skb_orphan(skb);
787 787
788 delta = skb->end - skb->tail; 788 delta = skb->end - skb_tail_pointer(skb);
789 if (delta * 2 < skb->truesize) 789 if (delta * 2 < skb->truesize)
790 return skb; 790 return skb;
791 791
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 51c059b09a37..36388b2f32f9 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -775,7 +775,7 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
775 err = -EINVAL; 775 err = -EINVAL;
776 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len); 776 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
777 if (sock->type != SOCK_DGRAM) { 777 if (sock->type != SOCK_DGRAM) {
778 skb->tail = skb->data; 778 skb_reset_tail_pointer(skb);
779 skb->len = 0; 779 skb->len = 0;
780 } else if (res < 0) 780 } else if (res < 0)
781 goto out_free; 781 goto out_free;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index cb21617a5670..28326fb1fc4e 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -93,7 +93,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
93 continue; 93 continue;
94 a->priv = p; 94 a->priv = p;
95 a->order = n_i; 95 a->order = n_i;
96 r = (struct rtattr*) skb->tail; 96 r = (struct rtattr *)skb_tail_pointer(skb);
97 RTA_PUT(skb, a->order, 0, NULL); 97 RTA_PUT(skb, a->order, 0, NULL);
98 err = tcf_action_dump_1(skb, a, 0, 0); 98 err = tcf_action_dump_1(skb, a, 0, 0);
99 if (err < 0) { 99 if (err < 0) {
@@ -101,7 +101,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
101 skb_trim(skb, (u8*)r - skb->data); 101 skb_trim(skb, (u8*)r - skb->data);
102 goto done; 102 goto done;
103 } 103 }
104 r->rta_len = skb->tail - (u8*)r; 104 r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
105 n_i++; 105 n_i++;
106 if (n_i >= TCA_ACT_MAX_PRIO) 106 if (n_i >= TCA_ACT_MAX_PRIO)
107 goto done; 107 goto done;
@@ -125,7 +125,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
125 struct rtattr *r ; 125 struct rtattr *r ;
126 int i= 0, n_i = 0; 126 int i= 0, n_i = 0;
127 127
128 r = (struct rtattr*) skb->tail; 128 r = (struct rtattr *)skb_tail_pointer(skb);
129 RTA_PUT(skb, a->order, 0, NULL); 129 RTA_PUT(skb, a->order, 0, NULL);
130 RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind); 130 RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
131 for (i = 0; i < (hinfo->hmask + 1); i++) { 131 for (i = 0; i < (hinfo->hmask + 1); i++) {
@@ -140,7 +140,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
140 } 140 }
141 } 141 }
142 RTA_PUT(skb, TCA_FCNT, 4, &n_i); 142 RTA_PUT(skb, TCA_FCNT, 4, &n_i);
143 r->rta_len = skb->tail - (u8*)r; 143 r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
144 144
145 return n_i; 145 return n_i;
146rtattr_failure: 146rtattr_failure:
@@ -423,7 +423,7 @@ int
423tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref) 423tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
424{ 424{
425 int err = -EINVAL; 425 int err = -EINVAL;
426 unsigned char *b = skb->tail; 426 unsigned char *b = skb_tail_pointer(skb);
427 struct rtattr *r; 427 struct rtattr *r;
428 428
429 if (a->ops == NULL || a->ops->dump == NULL) 429 if (a->ops == NULL || a->ops->dump == NULL)
@@ -432,10 +432,10 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
432 RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind); 432 RTA_PUT(skb, TCA_KIND, IFNAMSIZ, a->ops->kind);
433 if (tcf_action_copy_stats(skb, a, 0)) 433 if (tcf_action_copy_stats(skb, a, 0))
434 goto rtattr_failure; 434 goto rtattr_failure;
435 r = (struct rtattr*) skb->tail; 435 r = (struct rtattr *)skb_tail_pointer(skb);
436 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 436 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
437 if ((err = tcf_action_dump_old(skb, a, bind, ref)) > 0) { 437 if ((err = tcf_action_dump_old(skb, a, bind, ref)) > 0) {
438 r->rta_len = skb->tail - (u8*)r; 438 r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
439 return err; 439 return err;
440 } 440 }
441 441
@@ -449,17 +449,17 @@ tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
449{ 449{
450 struct tc_action *a; 450 struct tc_action *a;
451 int err = -EINVAL; 451 int err = -EINVAL;
452 unsigned char *b = skb->tail; 452 unsigned char *b = skb_tail_pointer(skb);
453 struct rtattr *r ; 453 struct rtattr *r ;
454 454
455 while ((a = act) != NULL) { 455 while ((a = act) != NULL) {
456 r = (struct rtattr*) skb->tail; 456 r = (struct rtattr *)skb_tail_pointer(skb);
457 act = a->next; 457 act = a->next;
458 RTA_PUT(skb, a->order, 0, NULL); 458 RTA_PUT(skb, a->order, 0, NULL);
459 err = tcf_action_dump_1(skb, a, bind, ref); 459 err = tcf_action_dump_1(skb, a, bind, ref);
460 if (err < 0) 460 if (err < 0)
461 goto errout; 461 goto errout;
462 r->rta_len = skb->tail - (u8*)r; 462 r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
463 } 463 }
464 464
465 return 0; 465 return 0;
@@ -635,7 +635,7 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
635{ 635{
636 struct tcamsg *t; 636 struct tcamsg *t;
637 struct nlmsghdr *nlh; 637 struct nlmsghdr *nlh;
638 unsigned char *b = skb->tail; 638 unsigned char *b = skb_tail_pointer(skb);
639 struct rtattr *x; 639 struct rtattr *x;
640 640
641 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags); 641 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
@@ -645,15 +645,15 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
645 t->tca__pad1 = 0; 645 t->tca__pad1 = 0;
646 t->tca__pad2 = 0; 646 t->tca__pad2 = 0;
647 647
648 x = (struct rtattr*) skb->tail; 648 x = (struct rtattr *)skb_tail_pointer(skb);
649 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL); 649 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
650 650
651 if (tcf_action_dump(skb, a, bind, ref) < 0) 651 if (tcf_action_dump(skb, a, bind, ref) < 0)
652 goto rtattr_failure; 652 goto rtattr_failure;
653 653
654 x->rta_len = skb->tail - (u8*)x; 654 x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
655 655
656 nlh->nlmsg_len = skb->tail - b; 656 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
657 return skb->len; 657 return skb->len;
658 658
659rtattr_failure: 659rtattr_failure:
@@ -767,7 +767,7 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
767 return -ENOBUFS; 767 return -ENOBUFS;
768 } 768 }
769 769
770 b = (unsigned char *)skb->tail; 770 b = skb_tail_pointer(skb);
771 771
772 if (rtattr_parse_nested(tb, TCA_ACT_MAX, rta) < 0) 772 if (rtattr_parse_nested(tb, TCA_ACT_MAX, rta) < 0)
773 goto err_out; 773 goto err_out;
@@ -783,16 +783,16 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
783 t->tca__pad1 = 0; 783 t->tca__pad1 = 0;
784 t->tca__pad2 = 0; 784 t->tca__pad2 = 0;
785 785
786 x = (struct rtattr *) skb->tail; 786 x = (struct rtattr *)skb_tail_pointer(skb);
787 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL); 787 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
788 788
789 err = a->ops->walk(skb, &dcb, RTM_DELACTION, a); 789 err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
790 if (err < 0) 790 if (err < 0)
791 goto rtattr_failure; 791 goto rtattr_failure;
792 792
793 x->rta_len = skb->tail - (u8 *) x; 793 x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
794 794
795 nlh->nlmsg_len = skb->tail - b; 795 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
796 nlh->nlmsg_flags |= NLM_F_ROOT; 796 nlh->nlmsg_flags |= NLM_F_ROOT;
797 module_put(a->ops->owner); 797 module_put(a->ops->owner);
798 kfree(a); 798 kfree(a);
@@ -884,7 +884,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
884 if (!skb) 884 if (!skb)
885 return -ENOBUFS; 885 return -ENOBUFS;
886 886
887 b = (unsigned char *)skb->tail; 887 b = skb_tail_pointer(skb);
888 888
889 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags); 889 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
890 t = NLMSG_DATA(nlh); 890 t = NLMSG_DATA(nlh);
@@ -892,15 +892,15 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
892 t->tca__pad1 = 0; 892 t->tca__pad1 = 0;
893 t->tca__pad2 = 0; 893 t->tca__pad2 = 0;
894 894
895 x = (struct rtattr*) skb->tail; 895 x = (struct rtattr *)skb_tail_pointer(skb);
896 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL); 896 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
897 897
898 if (tcf_action_dump(skb, a, 0, 0) < 0) 898 if (tcf_action_dump(skb, a, 0, 0) < 0)
899 goto rtattr_failure; 899 goto rtattr_failure;
900 900
901 x->rta_len = skb->tail - (u8*)x; 901 x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
902 902
903 nlh->nlmsg_len = skb->tail - b; 903 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
904 NETLINK_CB(skb).dst_group = RTNLGRP_TC; 904 NETLINK_CB(skb).dst_group = RTNLGRP_TC;
905 905
906 err = rtnetlink_send(skb, pid, RTNLGRP_TC, flags&NLM_F_ECHO); 906 err = rtnetlink_send(skb, pid, RTNLGRP_TC, flags&NLM_F_ECHO);
@@ -1015,7 +1015,7 @@ static int
1015tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb) 1015tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
1016{ 1016{
1017 struct nlmsghdr *nlh; 1017 struct nlmsghdr *nlh;
1018 unsigned char *b = skb->tail; 1018 unsigned char *b = skb_tail_pointer(skb);
1019 struct rtattr *x; 1019 struct rtattr *x;
1020 struct tc_action_ops *a_o; 1020 struct tc_action_ops *a_o;
1021 struct tc_action a; 1021 struct tc_action a;
@@ -1048,7 +1048,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
1048 t->tca__pad1 = 0; 1048 t->tca__pad1 = 0;
1049 t->tca__pad2 = 0; 1049 t->tca__pad2 = 0;
1050 1050
1051 x = (struct rtattr *) skb->tail; 1051 x = (struct rtattr *)skb_tail_pointer(skb);
1052 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL); 1052 RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
1053 1053
1054 ret = a_o->walk(skb, cb, RTM_GETACTION, &a); 1054 ret = a_o->walk(skb, cb, RTM_GETACTION, &a);
@@ -1056,12 +1056,12 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
1056 goto rtattr_failure; 1056 goto rtattr_failure;
1057 1057
1058 if (ret > 0) { 1058 if (ret > 0) {
1059 x->rta_len = skb->tail - (u8 *) x; 1059 x->rta_len = skb_tail_pointer(skb) - (u8 *)x;
1060 ret = skb->len; 1060 ret = skb->len;
1061 } else 1061 } else
1062 skb_trim(skb, (u8*)x - skb->data); 1062 skb_trim(skb, (u8*)x - skb->data);
1063 1063
1064 nlh->nlmsg_len = skb->tail - b; 1064 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1065 if (NETLINK_CB(cb->skb).pid && ret) 1065 if (NETLINK_CB(cb->skb).pid && ret)
1066 nlh->nlmsg_flags |= NLM_F_MULTI; 1066 nlh->nlmsg_flags |= NLM_F_MULTI;
1067 module_put(a_o->owner); 1067 module_put(a_o->owner);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 87d0faf32867..aad748b3b38c 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -155,7 +155,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
155 155
156static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref) 156static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
157{ 157{
158 unsigned char *b = skb->tail; 158 unsigned char *b = skb_tail_pointer(skb);
159 struct tc_gact opt; 159 struct tc_gact opt;
160 struct tcf_gact *gact = a->priv; 160 struct tcf_gact *gact = a->priv;
161 struct tcf_t t; 161 struct tcf_t t;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 47f0b1324239..2ccfd5b20fab 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -245,7 +245,7 @@ static int tcf_ipt(struct sk_buff *skb, struct tc_action *a,
245 245
246static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref) 246static int tcf_ipt_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
247{ 247{
248 unsigned char *b = skb->tail; 248 unsigned char *b = skb_tail_pointer(skb);
249 struct tcf_ipt *ipt = a->priv; 249 struct tcf_ipt *ipt = a->priv;
250 struct ipt_entry_target *t; 250 struct ipt_entry_target *t;
251 struct tcf_t tm; 251 struct tcf_t tm;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 3e93683e9ab3..15f6ecdaf611 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -206,7 +206,7 @@ bad_mirred:
206 206
207static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref) 207static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
208{ 208{
209 unsigned char *b = skb->tail; 209 unsigned char *b = skb_tail_pointer(skb);
210 struct tcf_mirred *m = a->priv; 210 struct tcf_mirred *m = a->priv;
211 struct tc_mirred opt; 211 struct tc_mirred opt;
212 struct tcf_t t; 212 struct tcf_t t;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 20813eee8af4..d654cea1a46c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -195,7 +195,7 @@ done:
195static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a, 195static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
196 int bind, int ref) 196 int bind, int ref)
197{ 197{
198 unsigned char *b = skb->tail; 198 unsigned char *b = skb_tail_pointer(skb);
199 struct tcf_pedit *p = a->priv; 199 struct tcf_pedit *p = a->priv;
200 struct tc_pedit *opt; 200 struct tc_pedit *opt;
201 struct tcf_t t; 201 struct tcf_t t;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 10a5a5c36f76..068b23763665 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -80,7 +80,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
80 continue; 80 continue;
81 a->priv = p; 81 a->priv = p;
82 a->order = index; 82 a->order = index;
83 r = (struct rtattr*) skb->tail; 83 r = (struct rtattr *)skb_tail_pointer(skb);
84 RTA_PUT(skb, a->order, 0, NULL); 84 RTA_PUT(skb, a->order, 0, NULL);
85 if (type == RTM_DELACTION) 85 if (type == RTM_DELACTION)
86 err = tcf_action_dump_1(skb, a, 0, 1); 86 err = tcf_action_dump_1(skb, a, 0, 1);
@@ -91,7 +91,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
91 skb_trim(skb, (u8*)r - skb->data); 91 skb_trim(skb, (u8*)r - skb->data);
92 goto done; 92 goto done;
93 } 93 }
94 r->rta_len = skb->tail - (u8*)r; 94 r->rta_len = skb_tail_pointer(skb) - (u8 *)r;
95 n_i++; 95 n_i++;
96 } 96 }
97 } 97 }
@@ -326,7 +326,7 @@ static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
326static int 326static int
327tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref) 327tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
328{ 328{
329 unsigned char *b = skb->tail; 329 unsigned char *b = skb_tail_pointer(skb);
330 struct tcf_police *police = a->priv; 330 struct tcf_police *police = a->priv;
331 struct tc_police opt; 331 struct tc_police opt;
332 332
@@ -572,7 +572,7 @@ EXPORT_SYMBOL(tcf_police);
572 572
573int tcf_police_dump(struct sk_buff *skb, struct tcf_police *police) 573int tcf_police_dump(struct sk_buff *skb, struct tcf_police *police)
574{ 574{
575 unsigned char *b = skb->tail; 575 unsigned char *b = skb_tail_pointer(skb);
576 struct tc_police opt; 576 struct tc_police opt;
577 577
578 opt.index = police->tcf_index; 578 opt.index = police->tcf_index;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index c7971182af07..ecbcfa59b76c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -155,7 +155,7 @@ static inline int tcf_simp_cleanup(struct tc_action *a, int bind)
155static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a, 155static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
156 int bind, int ref) 156 int bind, int ref)
157{ 157{
158 unsigned char *b = skb->tail; 158 unsigned char *b = skb_tail_pointer(skb);
159 struct tcf_defact *d = a->priv; 159 struct tcf_defact *d = a->priv;
160 struct tc_defact opt; 160 struct tc_defact opt;
161 struct tcf_t t; 161 struct tcf_t t;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 5c6ffdb77d2d..84231baf77d1 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -323,7 +323,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
323{ 323{
324 struct tcmsg *tcm; 324 struct tcmsg *tcm;
325 struct nlmsghdr *nlh; 325 struct nlmsghdr *nlh;
326 unsigned char *b = skb->tail; 326 unsigned char *b = skb_tail_pointer(skb);
327 327
328 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags); 328 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
329 tcm = NLMSG_DATA(nlh); 329 tcm = NLMSG_DATA(nlh);
@@ -340,7 +340,7 @@ tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
340 if (tp->ops->dump && tp->ops->dump(tp, fh, skb, tcm) < 0) 340 if (tp->ops->dump && tp->ops->dump(tp, fh, skb, tcm) < 0)
341 goto rtattr_failure; 341 goto rtattr_failure;
342 } 342 }
343 nlh->nlmsg_len = skb->tail - b; 343 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
344 return skb->len; 344 return skb->len;
345 345
346nlmsg_failure: 346nlmsg_failure:
@@ -563,30 +563,30 @@ tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
563 * to work with both old and new modes of entering 563 * to work with both old and new modes of entering
564 * tc data even if iproute2 was newer - jhs 564 * tc data even if iproute2 was newer - jhs
565 */ 565 */
566 struct rtattr * p_rta = (struct rtattr*) skb->tail; 566 struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
567 567
568 if (exts->action->type != TCA_OLD_COMPAT) { 568 if (exts->action->type != TCA_OLD_COMPAT) {
569 RTA_PUT(skb, map->action, 0, NULL); 569 RTA_PUT(skb, map->action, 0, NULL);
570 if (tcf_action_dump(skb, exts->action, 0, 0) < 0) 570 if (tcf_action_dump(skb, exts->action, 0, 0) < 0)
571 goto rtattr_failure; 571 goto rtattr_failure;
572 p_rta->rta_len = skb->tail - (u8*)p_rta; 572 p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
573 } else if (map->police) { 573 } else if (map->police) {
574 RTA_PUT(skb, map->police, 0, NULL); 574 RTA_PUT(skb, map->police, 0, NULL);
575 if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0) 575 if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0)
576 goto rtattr_failure; 576 goto rtattr_failure;
577 p_rta->rta_len = skb->tail - (u8*)p_rta; 577 p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
578 } 578 }
579 } 579 }
580#elif defined CONFIG_NET_CLS_POLICE 580#elif defined CONFIG_NET_CLS_POLICE
581 if (map->police && exts->police) { 581 if (map->police && exts->police) {
582 struct rtattr * p_rta = (struct rtattr*) skb->tail; 582 struct rtattr *p_rta = (struct rtattr *)skb_tail_pointer(skb);
583 583
584 RTA_PUT(skb, map->police, 0, NULL); 584 RTA_PUT(skb, map->police, 0, NULL);
585 585
586 if (tcf_police_dump(skb, exts->police) < 0) 586 if (tcf_police_dump(skb, exts->police) < 0)
587 goto rtattr_failure; 587 goto rtattr_failure;
588 588
589 p_rta->rta_len = skb->tail - (u8*)p_rta; 589 p_rta->rta_len = skb_tail_pointer(skb) - (u8 *)p_rta;
590 } 590 }
591#endif 591#endif
592 return 0; 592 return 0;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 4a91f082a81d..800ec2ac326b 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -245,7 +245,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
245 struct sk_buff *skb, struct tcmsg *t) 245 struct sk_buff *skb, struct tcmsg *t)
246{ 246{
247 struct basic_filter *f = (struct basic_filter *) fh; 247 struct basic_filter *f = (struct basic_filter *) fh;
248 unsigned char *b = skb->tail; 248 unsigned char *b = skb_tail_pointer(skb);
249 struct rtattr *rta; 249 struct rtattr *rta;
250 250
251 if (f == NULL) 251 if (f == NULL)
@@ -263,7 +263,7 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
263 tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0) 263 tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
264 goto rtattr_failure; 264 goto rtattr_failure;
265 265
266 rta->rta_len = (skb->tail - b); 266 rta->rta_len = skb_tail_pointer(skb) - b;
267 return skb->len; 267 return skb->len;
268 268
269rtattr_failure: 269rtattr_failure:
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 5dbb9d451f73..f5f355852a87 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -348,7 +348,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
348{ 348{
349 struct fw_head *head = (struct fw_head *)tp->root; 349 struct fw_head *head = (struct fw_head *)tp->root;
350 struct fw_filter *f = (struct fw_filter*)fh; 350 struct fw_filter *f = (struct fw_filter*)fh;
351 unsigned char *b = skb->tail; 351 unsigned char *b = skb_tail_pointer(skb);
352 struct rtattr *rta; 352 struct rtattr *rta;
353 353
354 if (f == NULL) 354 if (f == NULL)
@@ -374,7 +374,7 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
374 if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0) 374 if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0)
375 goto rtattr_failure; 375 goto rtattr_failure;
376 376
377 rta->rta_len = skb->tail - b; 377 rta->rta_len = skb_tail_pointer(skb) - b;
378 378
379 if (tcf_exts_dump_stats(skb, &f->exts, &fw_ext_map) < 0) 379 if (tcf_exts_dump_stats(skb, &f->exts, &fw_ext_map) < 0)
380 goto rtattr_failure; 380 goto rtattr_failure;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index abc47cc48ad0..1f94df36239d 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -562,7 +562,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
562 struct sk_buff *skb, struct tcmsg *t) 562 struct sk_buff *skb, struct tcmsg *t)
563{ 563{
564 struct route4_filter *f = (struct route4_filter*)fh; 564 struct route4_filter *f = (struct route4_filter*)fh;
565 unsigned char *b = skb->tail; 565 unsigned char *b = skb_tail_pointer(skb);
566 struct rtattr *rta; 566 struct rtattr *rta;
567 u32 id; 567 u32 id;
568 568
@@ -591,7 +591,7 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
591 if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0) 591 if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0)
592 goto rtattr_failure; 592 goto rtattr_failure;
593 593
594 rta->rta_len = skb->tail - b; 594 rta->rta_len = skb_tail_pointer(skb) - b;
595 595
596 if (tcf_exts_dump_stats(skb, &f->exts, &route_ext_map) < 0) 596 if (tcf_exts_dump_stats(skb, &f->exts, &route_ext_map) < 0)
597 goto rtattr_failure; 597 goto rtattr_failure;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 6f373b020eb4..87ed6f3c5070 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -593,7 +593,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
593{ 593{
594 struct rsvp_filter *f = (struct rsvp_filter*)fh; 594 struct rsvp_filter *f = (struct rsvp_filter*)fh;
595 struct rsvp_session *s; 595 struct rsvp_session *s;
596 unsigned char *b = skb->tail; 596 unsigned char *b = skb_tail_pointer(skb);
597 struct rtattr *rta; 597 struct rtattr *rta;
598 struct tc_rsvp_pinfo pinfo; 598 struct tc_rsvp_pinfo pinfo;
599 599
@@ -623,7 +623,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
623 if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0) 623 if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0)
624 goto rtattr_failure; 624 goto rtattr_failure;
625 625
626 rta->rta_len = skb->tail - b; 626 rta->rta_len = skb_tail_pointer(skb) - b;
627 627
628 if (tcf_exts_dump_stats(skb, &f->exts, &rsvp_ext_map) < 0) 628 if (tcf_exts_dump_stats(skb, &f->exts, &rsvp_ext_map) < 0)
629 goto rtattr_failure; 629 goto rtattr_failure;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 7563fdcef4b7..0537d6066b43 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -448,7 +448,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
448{ 448{
449 struct tcindex_data *p = PRIV(tp); 449 struct tcindex_data *p = PRIV(tp);
450 struct tcindex_filter_result *r = (struct tcindex_filter_result *) fh; 450 struct tcindex_filter_result *r = (struct tcindex_filter_result *) fh;
451 unsigned char *b = skb->tail; 451 unsigned char *b = skb_tail_pointer(skb);
452 struct rtattr *rta; 452 struct rtattr *rta;
453 453
454 DPRINTK("tcindex_dump(tp %p,fh 0x%lx,skb %p,t %p),p %p,r %p,b %p\n", 454 DPRINTK("tcindex_dump(tp %p,fh 0x%lx,skb %p,t %p),p %p,r %p,b %p\n",
@@ -463,7 +463,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
463 RTA_PUT(skb,TCA_TCINDEX_SHIFT,sizeof(p->shift),&p->shift); 463 RTA_PUT(skb,TCA_TCINDEX_SHIFT,sizeof(p->shift),&p->shift);
464 RTA_PUT(skb,TCA_TCINDEX_FALL_THROUGH,sizeof(p->fall_through), 464 RTA_PUT(skb,TCA_TCINDEX_FALL_THROUGH,sizeof(p->fall_through),
465 &p->fall_through); 465 &p->fall_through);
466 rta->rta_len = skb->tail-b; 466 rta->rta_len = skb_tail_pointer(skb) - b;
467 } else { 467 } else {
468 if (p->perfect) { 468 if (p->perfect) {
469 t->tcm_handle = r-p->perfect; 469 t->tcm_handle = r-p->perfect;
@@ -486,7 +486,7 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
486 486
487 if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0) 487 if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0)
488 goto rtattr_failure; 488 goto rtattr_failure;
489 rta->rta_len = skb->tail-b; 489 rta->rta_len = skb_tail_pointer(skb) - b;
490 490
491 if (tcf_exts_dump_stats(skb, &r->exts, &tcindex_ext_map) < 0) 491 if (tcf_exts_dump_stats(skb, &r->exts, &tcindex_ext_map) < 0)
492 goto rtattr_failure; 492 goto rtattr_failure;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 695b34051b9f..fa11bb750049 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -213,7 +213,7 @@ check_terminal:
213 off2 = 0; 213 off2 = 0;
214 } 214 }
215 215
216 if (ptr < skb->tail) 216 if (ptr < skb_tail_pointer(skb))
217 goto next_ht; 217 goto next_ht;
218 } 218 }
219 219
@@ -718,7 +718,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
718 struct sk_buff *skb, struct tcmsg *t) 718 struct sk_buff *skb, struct tcmsg *t)
719{ 719{
720 struct tc_u_knode *n = (struct tc_u_knode*)fh; 720 struct tc_u_knode *n = (struct tc_u_knode*)fh;
721 unsigned char *b = skb->tail; 721 unsigned char *b = skb_tail_pointer(skb);
722 struct rtattr *rta; 722 struct rtattr *rta;
723 723
724 if (n == NULL) 724 if (n == NULL)
@@ -765,7 +765,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
765#endif 765#endif
766 } 766 }
767 767
768 rta->rta_len = skb->tail - b; 768 rta->rta_len = skb_tail_pointer(skb) - b;
769 if (TC_U32_KEY(n->handle)) 769 if (TC_U32_KEY(n->handle))
770 if (tcf_exts_dump_stats(skb, &n->exts, &u32_ext_map) < 0) 770 if (tcf_exts_dump_stats(skb, &n->exts, &u32_ext_map) < 0)
771 goto rtattr_failure; 771 goto rtattr_failure;
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 959c306c5714..63146d339d81 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -418,17 +418,19 @@ void tcf_em_tree_destroy(struct tcf_proto *tp, struct tcf_ematch_tree *tree)
418int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv) 418int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
419{ 419{
420 int i; 420 int i;
421 struct rtattr * top_start = (struct rtattr*) skb->tail; 421 u8 *tail;
422 struct rtattr * list_start; 422 struct rtattr *top_start = (struct rtattr *)skb_tail_pointer(skb);
423 struct rtattr *list_start;
423 424
424 RTA_PUT(skb, tlv, 0, NULL); 425 RTA_PUT(skb, tlv, 0, NULL);
425 RTA_PUT(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr); 426 RTA_PUT(skb, TCA_EMATCH_TREE_HDR, sizeof(tree->hdr), &tree->hdr);
426 427
427 list_start = (struct rtattr *) skb->tail; 428 list_start = (struct rtattr *)skb_tail_pointer(skb);
428 RTA_PUT(skb, TCA_EMATCH_TREE_LIST, 0, NULL); 429 RTA_PUT(skb, TCA_EMATCH_TREE_LIST, 0, NULL);
429 430
431 tail = skb_tail_pointer(skb);
430 for (i = 0; i < tree->hdr.nmatches; i++) { 432 for (i = 0; i < tree->hdr.nmatches; i++) {
431 struct rtattr *match_start = (struct rtattr*) skb->tail; 433 struct rtattr *match_start = (struct rtattr *)tail;
432 struct tcf_ematch *em = tcf_em_get_match(tree, i); 434 struct tcf_ematch *em = tcf_em_get_match(tree, i);
433 struct tcf_ematch_hdr em_hdr = { 435 struct tcf_ematch_hdr em_hdr = {
434 .kind = em->ops ? em->ops->kind : TCF_EM_CONTAINER, 436 .kind = em->ops ? em->ops->kind : TCF_EM_CONTAINER,
@@ -447,11 +449,12 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
447 } else if (em->datalen > 0) 449 } else if (em->datalen > 0)
448 RTA_PUT_NOHDR(skb, em->datalen, (void *) em->data); 450 RTA_PUT_NOHDR(skb, em->datalen, (void *) em->data);
449 451
450 match_start->rta_len = skb->tail - (u8*) match_start; 452 tail = skb_tail_pointer(skb);
453 match_start->rta_len = tail - (u8 *)match_start;
451 } 454 }
452 455
453 list_start->rta_len = skb->tail - (u8 *) list_start; 456 list_start->rta_len = tail - (u8 *)list_start;
454 top_start->rta_len = skb->tail - (u8 *) top_start; 457 top_start->rta_len = tail - (u8 *)top_start;
455 458
456 return 0; 459 return 0;
457 460
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ecbdc6b42a9c..7482a950717b 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -813,7 +813,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
813{ 813{
814 struct tcmsg *tcm; 814 struct tcmsg *tcm;
815 struct nlmsghdr *nlh; 815 struct nlmsghdr *nlh;
816 unsigned char *b = skb->tail; 816 unsigned char *b = skb_tail_pointer(skb);
817 struct gnet_dump d; 817 struct gnet_dump d;
818 818
819 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags); 819 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
@@ -847,7 +847,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
847 if (gnet_stats_finish_copy(&d) < 0) 847 if (gnet_stats_finish_copy(&d) < 0)
848 goto rtattr_failure; 848 goto rtattr_failure;
849 849
850 nlh->nlmsg_len = skb->tail - b; 850 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
851 return skb->len; 851 return skb->len;
852 852
853nlmsg_failure: 853nlmsg_failure:
@@ -1051,7 +1051,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
1051{ 1051{
1052 struct tcmsg *tcm; 1052 struct tcmsg *tcm;
1053 struct nlmsghdr *nlh; 1053 struct nlmsghdr *nlh;
1054 unsigned char *b = skb->tail; 1054 unsigned char *b = skb_tail_pointer(skb);
1055 struct gnet_dump d; 1055 struct gnet_dump d;
1056 struct Qdisc_class_ops *cl_ops = q->ops->cl_ops; 1056 struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
1057 1057
@@ -1076,7 +1076,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
1076 if (gnet_stats_finish_copy(&d) < 0) 1076 if (gnet_stats_finish_copy(&d) < 0)
1077 goto rtattr_failure; 1077 goto rtattr_failure;
1078 1078
1079 nlh->nlmsg_len = skb->tail - b; 1079 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1080 return skb->len; 1080 return skb->len;
1081 1081
1082nlmsg_failure: 1082nlmsg_failure:
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index baca8743c12b..1d7bb1632138 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -631,7 +631,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
631{ 631{
632 struct atm_qdisc_data *p = PRIV(sch); 632 struct atm_qdisc_data *p = PRIV(sch);
633 struct atm_flow_data *flow = (struct atm_flow_data *) cl; 633 struct atm_flow_data *flow = (struct atm_flow_data *) cl;
634 unsigned char *b = skb->tail; 634 unsigned char *b = skb_tail_pointer(skb);
635 struct rtattr *rta; 635 struct rtattr *rta;
636 636
637 DPRINTK("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n", 637 DPRINTK("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
@@ -661,7 +661,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
661 661
662 RTA_PUT(skb,TCA_ATM_EXCESS,sizeof(zero),&zero); 662 RTA_PUT(skb,TCA_ATM_EXCESS,sizeof(zero),&zero);
663 } 663 }
664 rta->rta_len = skb->tail-b; 664 rta->rta_len = skb_tail_pointer(skb) - b;
665 return skb->len; 665 return skb->len;
666 666
667rtattr_failure: 667rtattr_failure:
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index d83414d828d8..be98a01253e9 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,7 +1465,7 @@ static int cbq_init(struct Qdisc *sch, struct rtattr *opt)
1465 1465
1466static __inline__ int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl) 1466static __inline__ int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
1467{ 1467{
1468 unsigned char *b = skb->tail; 1468 unsigned char *b = skb_tail_pointer(skb);
1469 1469
1470 RTA_PUT(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate); 1470 RTA_PUT(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate);
1471 return skb->len; 1471 return skb->len;
@@ -1477,7 +1477,7 @@ rtattr_failure:
1477 1477
1478static __inline__ int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl) 1478static __inline__ int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
1479{ 1479{
1480 unsigned char *b = skb->tail; 1480 unsigned char *b = skb_tail_pointer(skb);
1481 struct tc_cbq_lssopt opt; 1481 struct tc_cbq_lssopt opt;
1482 1482
1483 opt.flags = 0; 1483 opt.flags = 0;
@@ -1502,7 +1502,7 @@ rtattr_failure:
1502 1502
1503static __inline__ int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl) 1503static __inline__ int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
1504{ 1504{
1505 unsigned char *b = skb->tail; 1505 unsigned char *b = skb_tail_pointer(skb);
1506 struct tc_cbq_wrropt opt; 1506 struct tc_cbq_wrropt opt;
1507 1507
1508 opt.flags = 0; 1508 opt.flags = 0;
@@ -1520,7 +1520,7 @@ rtattr_failure:
1520 1520
1521static __inline__ int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl) 1521static __inline__ int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl)
1522{ 1522{
1523 unsigned char *b = skb->tail; 1523 unsigned char *b = skb_tail_pointer(skb);
1524 struct tc_cbq_ovl opt; 1524 struct tc_cbq_ovl opt;
1525 1525
1526 opt.strategy = cl->ovl_strategy; 1526 opt.strategy = cl->ovl_strategy;
@@ -1537,7 +1537,7 @@ rtattr_failure:
1537 1537
1538static __inline__ int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl) 1538static __inline__ int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
1539{ 1539{
1540 unsigned char *b = skb->tail; 1540 unsigned char *b = skb_tail_pointer(skb);
1541 struct tc_cbq_fopt opt; 1541 struct tc_cbq_fopt opt;
1542 1542
1543 if (cl->split || cl->defmap) { 1543 if (cl->split || cl->defmap) {
@@ -1556,7 +1556,7 @@ rtattr_failure:
1556#ifdef CONFIG_NET_CLS_POLICE 1556#ifdef CONFIG_NET_CLS_POLICE
1557static __inline__ int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl) 1557static __inline__ int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl)
1558{ 1558{
1559 unsigned char *b = skb->tail; 1559 unsigned char *b = skb_tail_pointer(skb);
1560 struct tc_cbq_police opt; 1560 struct tc_cbq_police opt;
1561 1561
1562 if (cl->police) { 1562 if (cl->police) {
@@ -1590,14 +1590,14 @@ static int cbq_dump_attr(struct sk_buff *skb, struct cbq_class *cl)
1590static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb) 1590static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
1591{ 1591{
1592 struct cbq_sched_data *q = qdisc_priv(sch); 1592 struct cbq_sched_data *q = qdisc_priv(sch);
1593 unsigned char *b = skb->tail; 1593 unsigned char *b = skb_tail_pointer(skb);
1594 struct rtattr *rta; 1594 struct rtattr *rta;
1595 1595
1596 rta = (struct rtattr*)b; 1596 rta = (struct rtattr*)b;
1597 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 1597 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
1598 if (cbq_dump_attr(skb, &q->link) < 0) 1598 if (cbq_dump_attr(skb, &q->link) < 0)
1599 goto rtattr_failure; 1599 goto rtattr_failure;
1600 rta->rta_len = skb->tail - b; 1600 rta->rta_len = skb_tail_pointer(skb) - b;
1601 return skb->len; 1601 return skb->len;
1602 1602
1603rtattr_failure: 1603rtattr_failure:
@@ -1619,7 +1619,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
1619 struct sk_buff *skb, struct tcmsg *tcm) 1619 struct sk_buff *skb, struct tcmsg *tcm)
1620{ 1620{
1621 struct cbq_class *cl = (struct cbq_class*)arg; 1621 struct cbq_class *cl = (struct cbq_class*)arg;
1622 unsigned char *b = skb->tail; 1622 unsigned char *b = skb_tail_pointer(skb);
1623 struct rtattr *rta; 1623 struct rtattr *rta;
1624 1624
1625 if (cl->tparent) 1625 if (cl->tparent)
@@ -1633,7 +1633,7 @@ cbq_dump_class(struct Qdisc *sch, unsigned long arg,
1633 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 1633 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
1634 if (cbq_dump_attr(skb, cl) < 0) 1634 if (cbq_dump_attr(skb, cl) < 0)
1635 goto rtattr_failure; 1635 goto rtattr_failure;
1636 rta->rta_len = skb->tail - b; 1636 rta->rta_len = skb_tail_pointer(skb) - b;
1637 return skb->len; 1637 return skb->len;
1638 1638
1639rtattr_failure: 1639rtattr_failure:
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 5197b6caaf2d..80e6f811e3bc 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1363,7 +1363,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
1363 struct tcmsg *tcm) 1363 struct tcmsg *tcm)
1364{ 1364{
1365 struct hfsc_class *cl = (struct hfsc_class *)arg; 1365 struct hfsc_class *cl = (struct hfsc_class *)arg;
1366 unsigned char *b = skb->tail; 1366 unsigned char *b = skb_tail_pointer(skb);
1367 struct rtattr *rta = (struct rtattr *)b; 1367 struct rtattr *rta = (struct rtattr *)b;
1368 1368
1369 tcm->tcm_parent = cl->cl_parent ? cl->cl_parent->classid : TC_H_ROOT; 1369 tcm->tcm_parent = cl->cl_parent ? cl->cl_parent->classid : TC_H_ROOT;
@@ -1374,7 +1374,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
1374 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 1374 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
1375 if (hfsc_dump_curves(skb, cl) < 0) 1375 if (hfsc_dump_curves(skb, cl) < 0)
1376 goto rtattr_failure; 1376 goto rtattr_failure;
1377 rta->rta_len = skb->tail - b; 1377 rta->rta_len = skb_tail_pointer(skb) - b;
1378 return skb->len; 1378 return skb->len;
1379 1379
1380 rtattr_failure: 1380 rtattr_failure:
@@ -1576,7 +1576,7 @@ static int
1576hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb) 1576hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
1577{ 1577{
1578 struct hfsc_sched *q = qdisc_priv(sch); 1578 struct hfsc_sched *q = qdisc_priv(sch);
1579 unsigned char *b = skb->tail; 1579 unsigned char *b = skb_tail_pointer(skb);
1580 struct tc_hfsc_qopt qopt; 1580 struct tc_hfsc_qopt qopt;
1581 1581
1582 qopt.defcls = q->defcls; 1582 qopt.defcls = q->defcls;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index f76c20c0a109..c687388a8cb6 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1110,7 +1110,7 @@ static int htb_init(struct Qdisc *sch, struct rtattr *opt)
1110static int htb_dump(struct Qdisc *sch, struct sk_buff *skb) 1110static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
1111{ 1111{
1112 struct htb_sched *q = qdisc_priv(sch); 1112 struct htb_sched *q = qdisc_priv(sch);
1113 unsigned char *b = skb->tail; 1113 unsigned char *b = skb_tail_pointer(skb);
1114 struct rtattr *rta; 1114 struct rtattr *rta;
1115 struct tc_htb_glob gopt; 1115 struct tc_htb_glob gopt;
1116 spin_lock_bh(&sch->dev->queue_lock); 1116 spin_lock_bh(&sch->dev->queue_lock);
@@ -1123,12 +1123,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
1123 rta = (struct rtattr *)b; 1123 rta = (struct rtattr *)b;
1124 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 1124 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
1125 RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt); 1125 RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
1126 rta->rta_len = skb->tail - b; 1126 rta->rta_len = skb_tail_pointer(skb) - b;
1127 spin_unlock_bh(&sch->dev->queue_lock); 1127 spin_unlock_bh(&sch->dev->queue_lock);
1128 return skb->len; 1128 return skb->len;
1129rtattr_failure: 1129rtattr_failure:
1130 spin_unlock_bh(&sch->dev->queue_lock); 1130 spin_unlock_bh(&sch->dev->queue_lock);
1131 skb_trim(skb, skb->tail - skb->data); 1131 skb_trim(skb, skb_tail_pointer(skb) - skb->data);
1132 return -1; 1132 return -1;
1133} 1133}
1134 1134
@@ -1136,7 +1136,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
1136 struct sk_buff *skb, struct tcmsg *tcm) 1136 struct sk_buff *skb, struct tcmsg *tcm)
1137{ 1137{
1138 struct htb_class *cl = (struct htb_class *)arg; 1138 struct htb_class *cl = (struct htb_class *)arg;
1139 unsigned char *b = skb->tail; 1139 unsigned char *b = skb_tail_pointer(skb);
1140 struct rtattr *rta; 1140 struct rtattr *rta;
1141 struct tc_htb_opt opt; 1141 struct tc_htb_opt opt;
1142 1142
@@ -1159,7 +1159,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
1159 opt.prio = cl->un.leaf.prio; 1159 opt.prio = cl->un.leaf.prio;
1160 opt.level = cl->level; 1160 opt.level = cl->level;
1161 RTA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt); 1161 RTA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt);
1162 rta->rta_len = skb->tail - b; 1162 rta->rta_len = skb_tail_pointer(skb) - b;
1163 spin_unlock_bh(&sch->dev->queue_lock); 1163 spin_unlock_bh(&sch->dev->queue_lock);
1164 return skb->len; 1164 return skb->len;
1165rtattr_failure: 1165rtattr_failure:
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index cfe070ee6ee3..d19f4070c237 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -362,12 +362,12 @@ static void ingress_destroy(struct Qdisc *sch)
362 362
363static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb) 363static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
364{ 364{
365 unsigned char *b = skb->tail; 365 unsigned char *b = skb_tail_pointer(skb);
366 struct rtattr *rta; 366 struct rtattr *rta;
367 367
368 rta = (struct rtattr *) b; 368 rta = (struct rtattr *) b;
369 RTA_PUT(skb, TCA_OPTIONS, 0, NULL); 369 RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
370 rta->rta_len = skb->tail - b; 370 rta->rta_len = skb_tail_pointer(skb) - b;
371 return skb->len; 371 return skb->len;
372 372
373rtattr_failure: 373rtattr_failure:
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 915f82a2cc3d..2a9b1e429ff8 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -583,7 +583,7 @@ static void netem_destroy(struct Qdisc *sch)
583static int netem_dump(struct Qdisc *sch, struct sk_buff *skb) 583static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
584{ 584{
585 const struct netem_sched_data *q = qdisc_priv(sch); 585 const struct netem_sched_data *q = qdisc_priv(sch);
586 unsigned char *b = skb->tail; 586 unsigned char *b = skb_tail_pointer(skb);
587 struct rtattr *rta = (struct rtattr *) b; 587 struct rtattr *rta = (struct rtattr *) b;
588 struct tc_netem_qopt qopt; 588 struct tc_netem_qopt qopt;
589 struct tc_netem_corr cor; 589 struct tc_netem_corr cor;
@@ -611,7 +611,7 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
611 corrupt.correlation = q->corrupt_cor.rho; 611 corrupt.correlation = q->corrupt_cor.rho;
612 RTA_PUT(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt); 612 RTA_PUT(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt);
613 613
614 rta->rta_len = skb->tail - b; 614 rta->rta_len = skb_tail_pointer(skb) - b;
615 615
616 return skb->len; 616 return skb->len;
617 617
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index de889f23f22a..5b371109ec1c 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -271,7 +271,7 @@ static int prio_init(struct Qdisc *sch, struct rtattr *opt)
271static int prio_dump(struct Qdisc *sch, struct sk_buff *skb) 271static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
272{ 272{
273 struct prio_sched_data *q = qdisc_priv(sch); 273 struct prio_sched_data *q = qdisc_priv(sch);
274 unsigned char *b = skb->tail; 274 unsigned char *b = skb_tail_pointer(skb);
275 struct tc_prio_qopt opt; 275 struct tc_prio_qopt opt;
276 276
277 opt.bands = q->bands; 277 opt.bands = q->bands;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index e3695407afc6..a511ba83e26f 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -461,7 +461,7 @@ static void sfq_destroy(struct Qdisc *sch)
461static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb) 461static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
462{ 462{
463 struct sfq_sched_data *q = qdisc_priv(sch); 463 struct sfq_sched_data *q = qdisc_priv(sch);
464 unsigned char *b = skb->tail; 464 unsigned char *b = skb_tail_pointer(skb);
465 struct tc_sfq_qopt opt; 465 struct tc_sfq_qopt opt;
466 466
467 opt.quantum = q->quantum; 467 opt.quantum = q->quantum;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index f14692f3a14e..231895562c66 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -387,7 +387,7 @@ static void tbf_destroy(struct Qdisc *sch)
387static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb) 387static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
388{ 388{
389 struct tbf_sched_data *q = qdisc_priv(sch); 389 struct tbf_sched_data *q = qdisc_priv(sch);
390 unsigned char *b = skb->tail; 390 unsigned char *b = skb_tail_pointer(skb);
391 struct rtattr *rta; 391 struct rtattr *rta;
392 struct tc_tbf_qopt opt; 392 struct tc_tbf_qopt opt;
393 393
@@ -403,7 +403,7 @@ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
403 opt.mtu = q->mtu; 403 opt.mtu = q->mtu;
404 opt.buffer = q->buffer; 404 opt.buffer = q->buffer;
405 RTA_PUT(skb, TCA_TBF_PARMS, sizeof(opt), &opt); 405 RTA_PUT(skb, TCA_TBF_PARMS, sizeof(opt), &opt);
406 rta->rta_len = skb->tail - b; 406 rta->rta_len = skb_tail_pointer(skb) - b;
407 407
408 return skb->len; 408 return skb->len;
409 409
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 1ff47b18724a..18b97eedc1fa 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -612,7 +612,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
612 break; 612 break;
613 613
614 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); 614 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
615 if (ch_end > skb->tail) 615 if (ch_end > skb_tail_pointer(skb))
616 break; 616 break;
617 617
618 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the 618 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
@@ -644,7 +644,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
644 } 644 }
645 645
646 ch = (sctp_chunkhdr_t *) ch_end; 646 ch = (sctp_chunkhdr_t *) ch_end;
647 } while (ch_end < skb->tail); 647 } while (ch_end < skb_tail_pointer(skb));
648 648
649 return 0; 649 return 0;
650 650
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30629e17781..88aa22407549 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -159,16 +159,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
159 * the skb->tail. 159 * the skb->tail.
160 */ 160 */
161 if (unlikely(skb_is_nonlinear(chunk->skb))) { 161 if (unlikely(skb_is_nonlinear(chunk->skb))) {
162 if (chunk->chunk_end > chunk->skb->tail) 162 if (chunk->chunk_end > skb_tail_pointer(chunk->skb))
163 chunk->chunk_end = chunk->skb->tail; 163 chunk->chunk_end = skb_tail_pointer(chunk->skb);
164 } 164 }
165 skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t)); 165 skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
166 chunk->subh.v = NULL; /* Subheader is no longer valid. */ 166 chunk->subh.v = NULL; /* Subheader is no longer valid. */
167 167
168 if (chunk->chunk_end < chunk->skb->tail) { 168 if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
169 /* This is not a singleton */ 169 /* This is not a singleton */
170 chunk->singleton = 0; 170 chunk->singleton = 0;
171 } else if (chunk->chunk_end > chunk->skb->tail) { 171 } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
172 /* RFC 2960, Section 6.10 Bundling 172 /* RFC 2960, Section 6.10 Bundling
173 * 173 *
174 * Partial chunks MUST NOT be placed in an SCTP packet. 174 * Partial chunks MUST NOT be placed in an SCTP packet.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 60c5b59d4c65..759ea3d19976 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1143,7 +1143,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
1143 1143
1144 /* Adjust the chunk length field. */ 1144 /* Adjust the chunk length field. */
1145 chunk->chunk_hdr->length = htons(chunklen + padlen + len); 1145 chunk->chunk_hdr->length = htons(chunklen + padlen + len);
1146 chunk->chunk_end = chunk->skb->tail; 1146 chunk->chunk_end = skb_tail_pointer(chunk->skb);
1147 1147
1148 return target; 1148 return target;
1149} 1149}
@@ -1168,7 +1168,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
1168 /* Adjust the chunk length field. */ 1168 /* Adjust the chunk length field. */
1169 chunk->chunk_hdr->length = 1169 chunk->chunk_hdr->length =
1170 htons(ntohs(chunk->chunk_hdr->length) + len); 1170 htons(ntohs(chunk->chunk_hdr->length) + len);
1171 chunk->chunk_end = chunk->skb->tail; 1171 chunk->chunk_end = skb_tail_pointer(chunk->skb);
1172 1172
1173out: 1173out:
1174 return err; 1174 return err;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index bf502c499c81..438e5dc5c714 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3115,7 +3115,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3115 break; 3115 break;
3116 3116
3117 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); 3117 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3118 if (ch_end > skb->tail) 3118 if (ch_end > skb_tail_pointer(skb))
3119 break; 3119 break;
3120 3120
3121 if (SCTP_CID_SHUTDOWN_ACK == ch->type) 3121 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
@@ -3130,7 +3130,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3130 return sctp_sf_pdiscard(ep, asoc, type, arg, commands); 3130 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3131 3131
3132 ch = (sctp_chunkhdr_t *) ch_end; 3132 ch = (sctp_chunkhdr_t *) ch_end;
3133 } while (ch_end < skb->tail); 3133 } while (ch_end < skb_tail_pointer(skb));
3134 3134
3135 if (ootb_shut_ack) 3135 if (ootb_shut_ack)
3136 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands); 3136 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 14789a82de53..c71337a22d33 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -89,7 +89,7 @@ struct sk_buff *tipc_cfg_reply_alloc(int payload_size)
89int tipc_cfg_append_tlv(struct sk_buff *buf, int tlv_type, 89int tipc_cfg_append_tlv(struct sk_buff *buf, int tlv_type,
90 void *tlv_data, int tlv_data_size) 90 void *tlv_data, int tlv_data_size)
91{ 91{
92 struct tlv_desc *tlv = (struct tlv_desc *)buf->tail; 92 struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(buf);
93 int new_tlv_space = TLV_SPACE(tlv_data_size); 93 int new_tlv_space = TLV_SPACE(tlv_data_size);
94 94
95 if (skb_tailroom(buf) < new_tlv_space) { 95 if (skb_tailroom(buf) < new_tlv_space) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b71739fbe2c6..45832fb75ea4 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1020,7 +1020,7 @@ restart:
1020 1020
1021 if (!err) { 1021 if (!err) {
1022 buf_crs = (unsigned char *)(TIPC_SKB_CB(buf)->handle); 1022 buf_crs = (unsigned char *)(TIPC_SKB_CB(buf)->handle);
1023 sz = buf->tail - buf_crs; 1023 sz = skb_tail_pointer(buf) - buf_crs;
1024 1024
1025 needed = (buf_len - sz_copied); 1025 needed = (buf_len - sz_copied);
1026 sz_to_copy = (sz <= needed) ? sz : needed; 1026 sz_to_copy = (sz <= needed) ? sz : needed;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 816e3690b60f..814bb3125ada 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -576,7 +576,7 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
576 struct sk_buff *skb = sp->out_skb; 576 struct sk_buff *skb = sp->out_skb;
577 struct xfrm_usersa_info *p; 577 struct xfrm_usersa_info *p;
578 struct nlmsghdr *nlh; 578 struct nlmsghdr *nlh;
579 unsigned char *b = skb->tail; 579 unsigned char *b = skb_tail_pointer(skb);
580 580
581 if (sp->this_idx < sp->start_idx) 581 if (sp->this_idx < sp->start_idx)
582 goto out; 582 goto out;
@@ -621,7 +621,7 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
621 if (x->lastused) 621 if (x->lastused)
622 RTA_PUT(skb, XFRMA_LASTUSED, sizeof(x->lastused), &x->lastused); 622 RTA_PUT(skb, XFRMA_LASTUSED, sizeof(x->lastused), &x->lastused);
623 623
624 nlh->nlmsg_len = skb->tail - b; 624 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
625out: 625out:
626 sp->this_idx++; 626 sp->this_idx++;
627 return 0; 627 return 0;
@@ -1157,7 +1157,7 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
1157 struct sk_buff *in_skb = sp->in_skb; 1157 struct sk_buff *in_skb = sp->in_skb;
1158 struct sk_buff *skb = sp->out_skb; 1158 struct sk_buff *skb = sp->out_skb;
1159 struct nlmsghdr *nlh; 1159 struct nlmsghdr *nlh;
1160 unsigned char *b = skb->tail; 1160 unsigned char *b = skb_tail_pointer(skb);
1161 1161
1162 if (sp->this_idx < sp->start_idx) 1162 if (sp->this_idx < sp->start_idx)
1163 goto out; 1163 goto out;
@@ -1176,7 +1176,7 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
1176 if (copy_to_user_policy_type(xp->type, skb) < 0) 1176 if (copy_to_user_policy_type(xp->type, skb) < 0)
1177 goto nlmsg_failure; 1177 goto nlmsg_failure;
1178 1178
1179 nlh->nlmsg_len = skb->tail - b; 1179 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1180out: 1180out:
1181 sp->this_idx++; 1181 sp->this_idx++;
1182 return 0; 1182 return 0;
@@ -1330,7 +1330,7 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
1330 struct xfrm_aevent_id *id; 1330 struct xfrm_aevent_id *id;
1331 struct nlmsghdr *nlh; 1331 struct nlmsghdr *nlh;
1332 struct xfrm_lifetime_cur ltime; 1332 struct xfrm_lifetime_cur ltime;
1333 unsigned char *b = skb->tail; 1333 unsigned char *b = skb_tail_pointer(skb);
1334 1334
1335 nlh = NLMSG_PUT(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id)); 1335 nlh = NLMSG_PUT(skb, c->pid, c->seq, XFRM_MSG_NEWAE, sizeof(*id));
1336 id = NLMSG_DATA(nlh); 1336 id = NLMSG_DATA(nlh);
@@ -1362,7 +1362,7 @@ static int build_aevent(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
1362 RTA_PUT(skb,XFRMA_ETIMER_THRESH,sizeof(u32),&etimer); 1362 RTA_PUT(skb,XFRMA_ETIMER_THRESH,sizeof(u32),&etimer);
1363 } 1363 }
1364 1364
1365 nlh->nlmsg_len = skb->tail - b; 1365 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1366 return skb->len; 1366 return skb->len;
1367 1367
1368rtattr_failure: 1368rtattr_failure:
@@ -1744,7 +1744,7 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
1744 struct xfrm_migrate *mp; 1744 struct xfrm_migrate *mp;
1745 struct xfrm_userpolicy_id *pol_id; 1745 struct xfrm_userpolicy_id *pol_id;
1746 struct nlmsghdr *nlh; 1746 struct nlmsghdr *nlh;
1747 unsigned char *b = skb->tail; 1747 unsigned char *b = skb_tail_pointer(skb);
1748 int i; 1748 int i;
1749 1749
1750 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id)); 1750 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_MIGRATE, sizeof(*pol_id));
@@ -1764,7 +1764,7 @@ static int build_migrate(struct sk_buff *skb, struct xfrm_migrate *m,
1764 goto nlmsg_failure; 1764 goto nlmsg_failure;
1765 } 1765 }
1766 1766
1767 nlh->nlmsg_len = skb->tail - b; 1767 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1768 return skb->len; 1768 return skb->len;
1769nlmsg_failure: 1769nlmsg_failure:
1770 skb_trim(skb, b - skb->data); 1770 skb_trim(skb, b - skb->data);
@@ -1942,7 +1942,7 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
1942{ 1942{
1943 struct xfrm_user_expire *ue; 1943 struct xfrm_user_expire *ue;
1944 struct nlmsghdr *nlh; 1944 struct nlmsghdr *nlh;
1945 unsigned char *b = skb->tail; 1945 unsigned char *b = skb_tail_pointer(skb);
1946 1946
1947 nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_EXPIRE, 1947 nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_EXPIRE,
1948 sizeof(*ue)); 1948 sizeof(*ue));
@@ -1952,7 +1952,7 @@ static int build_expire(struct sk_buff *skb, struct xfrm_state *x, struct km_eve
1952 copy_to_user_state(x, &ue->state); 1952 copy_to_user_state(x, &ue->state);
1953 ue->hard = (c->data.hard != 0) ? 1 : 0; 1953 ue->hard = (c->data.hard != 0) ? 1 : 0;
1954 1954
1955 nlh->nlmsg_len = skb->tail - b; 1955 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1956 return skb->len; 1956 return skb->len;
1957 1957
1958nlmsg_failure: 1958nlmsg_failure:
@@ -1999,7 +1999,7 @@ static int xfrm_notify_sa_flush(struct km_event *c)
1999 struct xfrm_usersa_flush *p; 1999 struct xfrm_usersa_flush *p;
2000 struct nlmsghdr *nlh; 2000 struct nlmsghdr *nlh;
2001 struct sk_buff *skb; 2001 struct sk_buff *skb;
2002 unsigned char *b; 2002 sk_buff_data_t b;
2003 int len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush)); 2003 int len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush));
2004 2004
2005 skb = alloc_skb(len, GFP_ATOMIC); 2005 skb = alloc_skb(len, GFP_ATOMIC);
@@ -2045,7 +2045,7 @@ static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
2045 struct xfrm_usersa_id *id; 2045 struct xfrm_usersa_id *id;
2046 struct nlmsghdr *nlh; 2046 struct nlmsghdr *nlh;
2047 struct sk_buff *skb; 2047 struct sk_buff *skb;
2048 unsigned char *b; 2048 sk_buff_data_t b;
2049 int len = xfrm_sa_len(x); 2049 int len = xfrm_sa_len(x);
2050 int headlen; 2050 int headlen;
2051 2051
@@ -2129,7 +2129,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2129{ 2129{
2130 struct xfrm_user_acquire *ua; 2130 struct xfrm_user_acquire *ua;
2131 struct nlmsghdr *nlh; 2131 struct nlmsghdr *nlh;
2132 unsigned char *b = skb->tail; 2132 unsigned char *b = skb_tail_pointer(skb);
2133 __u32 seq = xfrm_get_acqseq(); 2133 __u32 seq = xfrm_get_acqseq();
2134 2134
2135 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_ACQUIRE, 2135 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_ACQUIRE,
@@ -2153,7 +2153,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
2153 if (copy_to_user_policy_type(xp->type, skb) < 0) 2153 if (copy_to_user_policy_type(xp->type, skb) < 0)
2154 goto nlmsg_failure; 2154 goto nlmsg_failure;
2155 2155
2156 nlh->nlmsg_len = skb->tail - b; 2156 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
2157 return skb->len; 2157 return skb->len;
2158 2158
2159nlmsg_failure: 2159nlmsg_failure:
@@ -2249,7 +2249,7 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2249 struct xfrm_user_polexpire *upe; 2249 struct xfrm_user_polexpire *upe;
2250 struct nlmsghdr *nlh; 2250 struct nlmsghdr *nlh;
2251 int hard = c->data.hard; 2251 int hard = c->data.hard;
2252 unsigned char *b = skb->tail; 2252 unsigned char *b = skb_tail_pointer(skb);
2253 2253
2254 nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe)); 2254 nlh = NLMSG_PUT(skb, c->pid, 0, XFRM_MSG_POLEXPIRE, sizeof(*upe));
2255 upe = NLMSG_DATA(nlh); 2255 upe = NLMSG_DATA(nlh);
@@ -2264,7 +2264,7 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
2264 goto nlmsg_failure; 2264 goto nlmsg_failure;
2265 upe->hard = !!hard; 2265 upe->hard = !!hard;
2266 2266
2267 nlh->nlmsg_len = skb->tail - b; 2267 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
2268 return skb->len; 2268 return skb->len;
2269 2269
2270nlmsg_failure: 2270nlmsg_failure:
@@ -2300,7 +2300,7 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
2300 struct xfrm_userpolicy_id *id; 2300 struct xfrm_userpolicy_id *id;
2301 struct nlmsghdr *nlh; 2301 struct nlmsghdr *nlh;
2302 struct sk_buff *skb; 2302 struct sk_buff *skb;
2303 unsigned char *b; 2303 sk_buff_data_t b;
2304 int len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr); 2304 int len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
2305 int headlen; 2305 int headlen;
2306 2306
@@ -2357,7 +2357,7 @@ static int xfrm_notify_policy_flush(struct km_event *c)
2357{ 2357{
2358 struct nlmsghdr *nlh; 2358 struct nlmsghdr *nlh;
2359 struct sk_buff *skb; 2359 struct sk_buff *skb;
2360 unsigned char *b; 2360 sk_buff_data_t b;
2361 int len = 0; 2361 int len = 0;
2362#ifdef CONFIG_XFRM_SUB_POLICY 2362#ifdef CONFIG_XFRM_SUB_POLICY
2363 len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type)); 2363 len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
@@ -2410,7 +2410,7 @@ static int build_report(struct sk_buff *skb, u8 proto,
2410{ 2410{
2411 struct xfrm_user_report *ur; 2411 struct xfrm_user_report *ur;
2412 struct nlmsghdr *nlh; 2412 struct nlmsghdr *nlh;
2413 unsigned char *b = skb->tail; 2413 unsigned char *b = skb_tail_pointer(skb);
2414 2414
2415 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur)); 2415 nlh = NLMSG_PUT(skb, 0, 0, XFRM_MSG_REPORT, sizeof(*ur));
2416 ur = NLMSG_DATA(nlh); 2416 ur = NLMSG_DATA(nlh);
@@ -2422,7 +2422,7 @@ static int build_report(struct sk_buff *skb, u8 proto,
2422 if (addr) 2422 if (addr)
2423 RTA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr); 2423 RTA_PUT(skb, XFRMA_COADDR, sizeof(*addr), addr);
2424 2424
2425 nlh->nlmsg_len = skb->tail - b; 2425 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
2426 return skb->len; 2426 return skb->len;
2427 2427
2428nlmsg_failure: 2428nlmsg_failure:
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-26 04:55:12 -0500