21 files changed, 50 insertions, 43 deletions

diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index e66953ce53e7..92b517af7260 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -150,7 +150,7 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
                                 skb_reserve(skbn, frontlen + 2);
                                 skb_set_network_header(skbn,
                                                       skb_network_offset(skb));
-                                memcpy(skb_put(skbn, len), skb->data, len);
+                                skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                                 p = skb_push(skbn, 2);
 
                                 *p++ = AX25_P_SEGMENT;
@@ -164,7 +164,7 @@ void ax25_output(ax25_cb *ax25, int paclen, struct sk_buff *skb)
                                 skb_reserve(skbn, frontlen + 1);
                                 skb_set_network_header(skbn,
                                                       skb_network_offset(skb));
-                                memcpy(skb_put(skbn, len), skb->data, len);
+                                skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                                 p = skb_push(skbn, 1);
                                 *p = AX25_P_TEXT;
                         }
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 97156c4abc8d..ab2db55982ca 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -382,7 +382,7 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
                 break;
         }
 
-        memcpy(__skb_put(nskb, skb->len), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, __skb_put(nskb, skb->len), skb->len);
         kfree_skb(skb);
 
         s->stats.rx_packets++;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 3933608a9296..66bef1ccee2a 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -124,7 +124,7 @@ static inline void cmtp_add_msgpart(struct cmtp_session *session, int id, const
         }
 
         if (skb && (skb->len > 0))
-                memcpy(skb_put(nskb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(nskb, skb->len), skb->len);
 
         memcpy(skb_put(nskb, count), buf, count);
 
@@ -256,7 +256,7 @@ static void cmtp_process_transmit(struct cmtp_session *session)
                         hdr[2] = size >> 8;
                 }
 
-                memcpy(skb_put(nskb, size), skb->data, size);
+                skb_copy_from_linear_data(skb, skb_put(nskb, size), size);
                 skb_pull(skb, size);
 
                 if (skb->len > 0) {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 162eab6a4478..a5867879b615 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2107,7 +2107,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                 if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
                         goto drop;
 
-                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                              skb->len);
                 conn->rx_len = len - skb->len;
         } else {
                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
@@ -2128,7 +2129,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                         goto drop;
                 }
 
-                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                              skb->len);
                 conn->rx_len -= skb->len;
 
                 if (!conn->rx_len) {
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 8cee7fdc16c3..8b45224699f4 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -129,7 +129,8 @@ static inline void nf_bridge_save_header(struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_8021Q))
                 header_size += VLAN_HLEN;
 
-        memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
+        skb_copy_from_linear_data_offset(skb, -header_size,
+                                         skb->nf_bridge->data, header_size);
 }
 
 /*
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f16c72204cf6..17c6bb5927b6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -576,7 +576,7 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
         /* Set the tail pointer and length */
         skb_put(n, skb_headlen(skb));
         /* Copy the bytes */
-        memcpy(n->data, skb->data, n->len);
+        skb_copy_from_linear_data(skb, n->data, n->len);
         n->csum      = skb->csum;
         n->ip_summed = skb->ip_summed;
 
@@ -1043,7 +1043,7 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
         if ((copy = start - offset) > 0) {
                 if (copy > len)
                         copy = len;
-                memcpy(to, skb->data + offset, copy);
+                skb_copy_from_linear_data_offset(skb, offset, to, copy);
                 if ((len -= copy) == 0)
                         return 0;
                 offset += copy;
@@ -1362,7 +1362,7 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb, u8 *to)
 
         BUG_ON(csstart > skb_headlen(skb));
 
-        memcpy(to, skb->data, csstart);
+        skb_copy_from_linear_data(skb, to, csstart);
 
         csum = 0;
         if (csstart != skb->len)
@@ -1536,8 +1536,8 @@ static inline void skb_split_inside_header(struct sk_buff *skb,
 {
         int i;
 
-        memcpy(skb_put(skb1, pos - len), skb->data + len, pos - len);
-
+        skb_copy_from_linear_data_offset(skb, len, skb_put(skb1, pos - len),
+                                         pos - len);
         /* And move data appendix as is. */
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
                 skb_shinfo(skb1)->frags[i] = skb_shinfo(skb)->frags[i];
@@ -1927,8 +1927,8 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 skb_set_network_header(nskb, skb->mac_len);
                 nskb->transport_header = (nskb->network_header +
                                           skb_network_header_len(skb));
-                memcpy(skb_put(nskb, doffset), skb->data, doffset);
-
+                skb_copy_from_linear_data(skb, skb_put(nskb, doffset),
+                                          doffset);
                 if (!sg) {
                         nskb->csum = skb_copy_and_csum_bits(skb, offset,
                                                             skb_put(nskb, len),
@@ -1941,7 +1941,8 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
 
                 nskb->ip_summed = CHECKSUM_PARTIAL;
                 nskb->csum = skb->csum;
-                memcpy(skb_put(nskb, hsize), skb->data + offset, hsize);
+                skb_copy_from_linear_data_offset(skb, offset,
+                                                 skb_put(nskb, hsize), hsize);
 
                 while (pos < offset + len) {
                         BUG_ON(i >= nfrags);
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index d9498a165acf..4074a6e5d0de 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -362,7 +362,8 @@ static void dn_nsp_conn_conf(struct sock *sk, struct sk_buff *skb)
                         u16 dlen = *skb->data;
                         if ((dlen <= 16) && (dlen <= skb->len)) {
                                 scp->conndata_in.opt_optl = dn_htons(dlen);
-                                memcpy(scp->conndata_in.opt_data, skb->data + 1, dlen);
+                                skb_copy_from_linear_data_offset(skb, 1,
+                                              scp->conndata_in.opt_data, dlen);
                         }
                 }
                 dn_nsp_send_link(sk, DN_NOCHANGE, 0);
@@ -406,7 +407,7 @@ static void dn_nsp_disc_init(struct sock *sk, struct sk_buff *skb)
                 u16 dlen = *skb->data;
                 if ((dlen <= 16) && (dlen <= skb->len)) {
                         scp->discdata_in.opt_optl = dn_htons(dlen);
-                        memcpy(scp->discdata_in.opt_data, skb->data + 1, dlen);
+                        skb_copy_from_linear_data_offset(skb, 1, scp->discdata_in.opt_data, dlen);
                 }
         }
 
diff --git a/net/ieee80211/ieee80211_crypt_wep.c b/net/ieee80211/ieee80211_crypt_wep.c
index ec6d8851a061..4eb35079e434 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -152,7 +152,7 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
                 return -1;
 
         /* Copy the IV into the first 3 bytes of the key */
-        memcpy(key, skb->data + hdr_len, 3);
+        skb_copy_from_linear_data_offset(skb, hdr_len, key, 3);
 
         /* Copy rest of the WEP key (the secret part) */
         memcpy(key + 3, wep->key, wep->key_len);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 59a765c49cf9..94e2b8e2ab26 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -606,12 +606,12 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                 if (frag == 0) {
                         /* copy first fragment (including full headers) into
                          * beginning of the fragment cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data, flen);
+                        skb_copy_from_linear_data(skb, skb_put(frag_skb, flen), flen);
                 } else {
                         /* append frame payload to the end of the fragment
                          * cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-                               flen);
+                        skb_copy_from_linear_data_offset(skb, hdrlen,
+                                      skb_put(frag_skb, flen), flen);
                 }
                 dev_kfree_skb_any(skb);
                 skb = NULL;
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index 62a8a2b76539..a4c3c51140a3 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -309,8 +309,8 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         /* Save source and destination addresses */
-        memcpy(dest, skb->data, ETH_ALEN);
-        memcpy(src, skb->data + ETH_ALEN, ETH_ALEN);
+        skb_copy_from_linear_data(skb, dest, ETH_ALEN);
+        skb_copy_from_linear_data_offset(skb, ETH_ALEN, src, ETH_ALEN);
 
         if (host_encrypt || host_build_iv)
                 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
@@ -363,7 +363,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                 snapped = 1;
                 ieee80211_copy_snap(skb_put(skb_new, SNAP_SIZE + sizeof(u16)),
                                     ether_type);
-                memcpy(skb_put(skb_new, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(skb_new, skb->len), skb->len);
                 res = crypt->ops->encrypt_msdu(skb_new, hdr_len, crypt->priv);
                 if (res < 0) {
                         IEEE80211_ERROR("msdu encryption failed\n");
@@ -492,7 +492,7 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
                         bytes -= SNAP_SIZE + sizeof(u16);
                 }
 
-                memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
+                skb_copy_from_linear_data(skb, skb_put(skb_frag, bytes), bytes);
 
                 /* Advance the SKB... */
                 skb_pull(skb, bytes);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 875da382d9b9..34606eff8a05 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -596,7 +596,7 @@ slow_path:
                  *      Copy the packet header into the new buffer.
                  */
 
-                memcpy(skb_network_header(skb2), skb->data, hlen);
+                skb_copy_from_linear_data(skb, skb_network_header(skb2), hlen);
 
                 /*
                  *      Copy a block of the IP datagram.
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index be3f082a87ed..4cfdad4e8356 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -746,7 +746,7 @@ slow_path:
                 /*
                  *      Copy the packet header into the new buffer.
                  */
-                memcpy(skb_network_header(frag), skb->data, hlen);
+                skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
                 /*
                  *      Build fragment header.
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index da3f2bc1b6f6..b55bc8f989df 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -314,8 +314,8 @@ static inline void irttp_fragment_skb(struct tsap_cb *self,
                 skb_reserve(frag, self->max_header_size);
 
                 /* Copy data from the original skb into this fragment. */
-                memcpy(skb_put(frag, self->max_seg_size), skb->data,
-                       self->max_seg_size);
+                skb_copy_from_linear_data(skb, skb_put(frag, self->max_seg_size),
+                              self->max_seg_size);
 
                 /* Insert TTP header, with the more bit set */
                 frame = skb_push(frag, TTP_HEADER);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 053fa26ff90a..5dc7448925db 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1160,7 +1160,8 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (sax != NULL) {
                 sax->sax25_family = AF_NETROM;
-                memcpy(sax->sax25_call.ax25_call, skb->data + 7, AX25_ADDR_LEN);
+                skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
+                              AX25_ADDR_LEN);
         }
 
         msg->msg_namelen = sizeof(*sax);
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index 99fdab16ded0..f324d5df4186 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -34,7 +34,7 @@ int nr_loopback_queue(struct sk_buff *skb)
         struct sk_buff *skbn;
 
         if ((skbn = alloc_skb(skb->len, GFP_ATOMIC)) != NULL) {
-                memcpy(skb_put(skbn, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(skbn, skb->len), skb->len);
                 skb_reset_transport_header(skbn);
 
                 skb_queue_tail(&loopback_queue, skbn);
diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c
index 0cbfb611465b..7c467c95c7d6 100644
--- a/net/netrom/nr_out.c
+++ b/net/netrom/nr_out.c
@@ -40,7 +40,7 @@ void nr_output(struct sock *sk, struct sk_buff *skb)
 
         if (skb->len - NR_TRANSPORT_LEN > NR_MAX_PACKET_SIZE) {
                 /* Save a copy of the Transport Header */
-                memcpy(transport, skb->data, NR_TRANSPORT_LEN);
+                skb_copy_from_linear_data(skb, transport, NR_TRANSPORT_LEN);
                 skb_pull(skb, NR_TRANSPORT_LEN);
 
                 frontlen = skb_headroom(skb);
@@ -54,7 +54,7 @@ void nr_output(struct sock *sk, struct sk_buff *skb)
                         len = (NR_MAX_PACKET_SIZE > skb->len) ? skb->len : NR_MAX_PACKET_SIZE;
 
                         /* Copy the user data */
-                        memcpy(skb_put(skbn, len), skb->data, len);
+                        skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                         skb_pull(skb, len);
 
                         /* Duplicate the Transport Header */
diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 07b694d18870..04e7d0d2fd8f 100644
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -226,13 +226,13 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags)
 
         dptr = skb_put(skbn, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
 
-        memcpy(dptr, skb->data + 7, AX25_ADDR_LEN);
+        skb_copy_from_linear_data_offset(skb, 7, dptr, AX25_ADDR_LEN);
         dptr[6] &= ~AX25_CBIT;
         dptr[6] &= ~AX25_EBIT;
         dptr[6] |= AX25_SSSID_SPARE;
         dptr += AX25_ADDR_LEN;
 
-        memcpy(dptr, skb->data + 0, AX25_ADDR_LEN);
+        skb_copy_from_linear_data(skb, dptr, AX25_ADDR_LEN);
         dptr[6] &= ~AX25_CBIT;
         dptr[6] |= AX25_EBIT;
         dptr[6] |= AX25_SSSID_SPARE;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 1511697b22ba..f38c3b3471ee 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1156,7 +1156,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                 int lg;
 
                 /* Save a copy of the Header */
-                memcpy(header, skb->data, ROSE_MIN_LEN);
+                skb_copy_from_linear_data(skb, header, ROSE_MIN_LEN);
                 skb_pull(skb, ROSE_MIN_LEN);
 
                 frontlen = skb_headroom(skb);
@@ -1176,7 +1176,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                         lg = (ROSE_PACLEN > skb->len) ? skb->len : ROSE_PACLEN;
 
                         /* Copy the user data */
-                        memcpy(skb_put(skbn, lg), skb->data, lg);
+                        skb_copy_from_linear_data(skb, skb_put(skbn, lg), lg);
                         skb_pull(skb, lg);
 
                         /* Duplicate the Header */
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index adcda8ebee9c..0d6002fc77b2 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -951,7 +951,7 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
          *      Incoming Call User Data.
          */
         if (skb->len >= 0) {
-                memcpy(makex25->calluserdata.cuddata, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
                 makex25->calluserdata.cudlength = skb->len;
         }
 
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index b2bbe552a89d..ba13248aa1c3 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -112,8 +112,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                          *      Copy any Call User Data.
                          */
                         if (skb->len >= 0) {
-                                memcpy(x25->calluserdata.cuddata, skb->data,
-                                       skb->len);
+                                skb_copy_from_linear_data(skb,
+                                              x25->calluserdata.cuddata,
+                                              skb->len);
                                 x25->calluserdata.cudlength = skb->len;
                         }
                         if (!sock_flag(sk, SOCK_DEAD))
diff --git a/net/x25/x25_out.c b/net/x25/x25_out.c
index 6f5737853912..bb45e21ffce9 100644
--- a/net/x25/x25_out.c
+++ b/net/x25/x25_out.c
@@ -61,7 +61,7 @@ int x25_output(struct sock *sk, struct sk_buff *skb)
 
         if (skb->len - header_len > max_len) {
                 /* Save a copy of the Header */
-                memcpy(header, skb->data, header_len);
+                skb_copy_from_linear_data(skb, header, header_len);
                 skb_pull(skb, header_len);
 
                 frontlen = skb_headroom(skb);
@@ -84,7 +84,7 @@ int x25_output(struct sock *sk, struct sk_buff *skb)
                         len = max_len > skb->len ? skb->len : max_len;
 
                         /* Copy the user data */
-                        memcpy(skb_put(skbn, len), skb->data, len);
+                        skb_copy_from_linear_data(skb, skb_put(skbn, len), len);
                         skb_pull(skb, len);
 
                         /* Duplicate the Header */