7 files changed, 10 insertions, 13 deletions

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 2ce1cb2aa2ed..bd651a408817 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -165,7 +165,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action *act,
         while ((a = act) != NULL) {
 repeat:
                 if (a->ops && a->ops->act) {
-                        ret = a->ops->act(&skb, a, res);
+                        ret = a->ops->act(skb, a, res);
                         if (TC_MUNGED & skb->tc_verd) {
                                 /* copied already, allow trampling */
                                 skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
diff --git a/net/sched/gact.c b/net/sched/gact.c
index d1c6d542912a..a1e68f78dcc2 100644
--- a/net/sched/gact.c
+++ b/net/sched/gact.c
@@ -135,10 +135,9 @@ tcf_gact_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_gact(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 {
         struct tcf_gact *p = PRIV(a, gact);
-        struct sk_buff *skb = *pskb;
         int action = TC_ACT_SHOT;
 
         spin_lock(&p->lock);
diff --git a/net/sched/ipt.c b/net/sched/ipt.c
index f50136eed211..b5001939b74b 100644
--- a/net/sched/ipt.c
+++ b/net/sched/ipt.c
@@ -201,11 +201,10 @@ tcf_ipt_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_ipt(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_ipt(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 {
         int ret = 0, result = 0;
         struct tcf_ipt *p = PRIV(a, ipt);
-        struct sk_buff *skb = *pskb;
 
         if (skb_cloned(skb)) {
                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
@@ -222,6 +221,9 @@ tcf_ipt(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
          worry later - danger - this API seems to have changed
          from earlier kernels */
 
+        /* iptables targets take a double skb pointer in case the skb
+         * needs to be replaced. We don't own the skb, so this must not
+         * happen. The pskb_expand_head above should make sure of this */
         ret = p->t->u.kernel.target->target(&skb, skb->dev, NULL,
                                             p->hook, p->t->data, NULL);
         switch (ret) {
diff --git a/net/sched/mirred.c b/net/sched/mirred.c
index 20d06916dc0b..4fcccbd50885 100644
--- a/net/sched/mirred.c
+++ b/net/sched/mirred.c
@@ -158,12 +158,11 @@ tcf_mirred_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_mirred(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_mirred(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 {
         struct tcf_mirred *p = PRIV(a, mirred);
         struct net_device *dev;
         struct sk_buff *skb2 = NULL;
-        struct sk_buff *skb = *pskb;
         u32 at = G_TC_AT(skb->tc_verd);
 
         spin_lock(&p->lock);
diff --git a/net/sched/pedit.c b/net/sched/pedit.c
index 767d24f4610e..b5167afec2dc 100644
--- a/net/sched/pedit.c
+++ b/net/sched/pedit.c
@@ -130,10 +130,9 @@ tcf_pedit_cleanup(struct tc_action *a, int bind)
 }
 
 static int
-tcf_pedit(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+tcf_pedit(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 {
         struct tcf_pedit *p = PRIV(a, pedit);
-        struct sk_buff *skb = *pskb;
         int i, munged = 0;
         u8 *pptr;
 
diff --git a/net/sched/police.c b/net/sched/police.c
index eb39fb2f39b6..a8345163cc60 100644
--- a/net/sched/police.c
+++ b/net/sched/police.c
@@ -284,11 +284,10 @@ static int tcf_act_police_cleanup(struct tc_action *a, int bind)
         return 0;
 }
 
-static int tcf_act_police(struct sk_buff **pskb, struct tc_action *a,
+static int tcf_act_police(struct sk_buff *skb, struct tc_action *a,
                           struct tcf_result *res)
 {
         psched_time_t now;
-        struct sk_buff *skb = *pskb;
         struct tcf_police *p = PRIV(a);
         long toks;
         long ptoks = 0;
diff --git a/net/sched/simple.c b/net/sched/simple.c
index 8a6ae4f491e8..e5f2e1f431e2 100644
--- a/net/sched/simple.c
+++ b/net/sched/simple.c
@@ -44,9 +44,8 @@ static DEFINE_RWLOCK(simp_lock);
 #include <net/pkt_act.h>
 #include <net/act_generic.h>
 
-static int tcf_simp(struct sk_buff **pskb, struct tc_action *a, struct tcf_result *res)
+static int tcf_simp(struct sk_buff *skb, struct tc_action *a, struct tcf_result *res)
 {
-        struct sk_buff *skb = *pskb;
         struct tcf_defact *p = PRIV(a, defact);
 
         spin_lock(&p->lock);