25 files changed, 84 insertions, 72 deletions

diff --git a/net/802/psnap.c b/net/802/psnap.c
index 6e7c2120b83f..7cba1f426081 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -56,7 +56,7 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
         };
 
         rcu_read_lock();
-        proto = find_snap_client(skb->h.raw);
+        proto = find_snap_client(skb_transport_header(skb));
         if (proto) {
                 /* Pass the frame on. */
                 skb->h.raw  += 5;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 75d4d695edec..5f28887822e9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1585,9 +1585,10 @@ static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_set_transport_header(skb, lv);
 
-        SOCK_DEBUG(sk, "base=%p pos=%p\n", skb->data, skb->h.raw);
+        SOCK_DEBUG(sk, "base=%p pos=%p\n",
+                   skb->data, skb_transport_header(skb));
 
-        *skb->h.raw = AX25_UI;
+        *skb_transport_header(skb) = AX25_UI;
 
         /* Datagram frames go straight out of the door as UI */
         ax25_queue_xmit(skb, ax25->ax25_dev->dev);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c11ceb6b3f79..c177e75d64a6 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1076,7 +1076,7 @@ static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
 
         skb_push(skb, HCI_ACL_HDR_SIZE);
         skb_reset_transport_header(skb);
-        hdr = (struct hci_acl_hdr *)skb->h.raw;
+        hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
         hdr->dlen   = cpu_to_le16(len);
 }
@@ -1145,7 +1145,7 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
 
         skb_push(skb, HCI_SCO_HDR_SIZE);
         skb_reset_transport_header(skb);
-        memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
+        memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
 
         skb->dev = (void *) hdev;
         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
diff --git a/net/core/dev.c b/net/core/dev.c
index f7f7e5687e46..30fcc7f9d4ed 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1175,12 +1175,12 @@ int skb_checksum_help(struct sk_buff *skb)
         BUG_ON(offset > (int)skb->len);
         csum = skb_checksum(skb, offset, skb->len-offset, 0);
 
-        offset = skb->tail - skb->h.raw;
+        offset = skb->tail - skb_transport_header(skb);
         BUG_ON(offset <= 0);
         BUG_ON(skb->csum_offset + 2 > offset);
 
-        *(__sum16*)(skb->h.raw + skb->csum_offset) = csum_fold(csum);
-
+        *(__sum16 *)(skb_transport_header(skb) +
+                     skb->csum_offset) = csum_fold(csum);
 out_set_summed:
         skb->ip_summed = CHECKSUM_NONE;
 out:
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index dcc2e4b6b2fe..78993dadb53a 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -943,7 +943,7 @@ static void aun_data_available(struct sock *sk, int slen)
                 printk(KERN_DEBUG "AUN: recvfrom() error %d\n", -err);
         }
 
-        data = skb->h.raw + sizeof(struct udphdr);
+        data = skb_transport_header(skb) + sizeof(struct udphdr);
         ah = (struct aunhdr *)data;
         len = skb->len - sizeof(struct udphdr);
         ip = ip_hdr(skb);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 292516bb1eca..8f0df7b4dfe7 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -348,7 +348,7 @@ static int igmpv3_sendpack(struct sk_buff *skb)
         struct iphdr *pip = ip_hdr(skb);
         struct igmphdr *pig = igmp_hdr(skb);
         const int iplen = skb->tail - skb->nh.raw;
-        const int igmplen = skb->tail - skb->h.raw;
+        const int igmplen = skb->tail - skb_transport_header(skb);
 
         pip->tot_len = htons(iplen);
         ip_send_check(pip);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 39216e6a59ed..e6a9e452fd61 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -619,7 +619,7 @@ static int ipgre_rcv(struct sk_buff *skb)
                 skb_reset_mac_header(skb);
                 __pskb_pull(skb, offset);
                 skb_reset_network_header(skb);
-                skb_postpull_rcsum(skb, skb->h.raw, offset);
+                skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
                 skb->pkt_type = PACKET_HOST;
 #ifdef CONFIG_NET_IPGRE_BROADCAST
                 if (MULTICAST(iph->daddr)) {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 602268661eb3..11029b9d4cf7 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1128,7 +1128,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
                         if (fraggap) {
                                 skb->csum = skb_copy_and_csum_bits(skb_prev,
                                                                    maxfraglen,
-                                                                   skb->h.raw,
+                                                    skb_transport_header(skb),
                                                                    fraggap, 0);
                                 skb_prev->csum = csum_sub(skb_prev->csum,
                                                           skb->csum);
@@ -1374,7 +1374,9 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
                        &ipc, rt, MSG_DONTWAIT);
         if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
                 if (arg->csumoffset >= 0)
-                        *((__sum16 *)skb->h.raw + arg->csumoffset) = csum_fold(csum_add(skb->csum, arg->csum));
+                        *((__sum16 *)skb_transport_header(skb) +
+                          arg->csumoffset) = csum_fold(csum_add(skb->csum,
+                                                                arg->csum));
                 skb->ip_summed = CHECKSUM_NONE;
                 ip_push_pending_frames(sk);
         }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 6b91c9f5d57a..4e19ee0e0102 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -432,7 +432,7 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 goto drop;
 
         /* Basic sanity checks can be done without the lock.  */
-        rarp = (struct arphdr *)skb->h.raw;
+        rarp = (struct arphdr *)skb_transport_header(skb);
 
         /* If this test doesn't pass, it's not IP, or we should
          * ignore it anyway.
@@ -455,7 +455,7 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 goto drop;
 
         /* OK, it is all there and looks valid, process... */
-        rarp = (struct arphdr *)skb->h.raw;
+        rarp = (struct arphdr *)skb_transport_header(skb);
         rarp_ptr = (unsigned char *) (rarp + 1);
 
         /* One reply at a time, please. */
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 05bc27002def..8f45c95db451 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1437,7 +1437,8 @@ int pim_rcv_v1(struct sk_buff * skb)
             pim->group != PIM_V1_VERSION || pim->code != PIM_V1_REGISTER)
                 goto drop;
 
-        encap = (struct iphdr*)(skb->h.raw + sizeof(struct igmphdr));
+        encap = (struct iphdr *)(skb_transport_header(skb) +
+                                 sizeof(struct igmphdr));
         /*
            Check that:
            a. packet is really destinted to a multicast group
@@ -1490,7 +1491,7 @@ static int pim_rcv(struct sk_buff * skb)
         if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap)))
                 goto drop;
 
-        pim = (struct pimreghdr*)skb->h.raw;
+        pim = (struct pimreghdr *)skb_transport_header(skb);
         if (pim->type != ((PIM_VERSION<<4)|(PIM_REGISTER)) ||
             (pim->flags&PIM_NULL_REGISTER) ||
             (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
@@ -1498,7 +1499,8 @@ static int pim_rcv(struct sk_buff * skb)
                 goto drop;
 
         /* check if the inner packet is destined to mcast group */
-        encap = (struct iphdr*)(skb->h.raw + sizeof(struct pimreghdr));
+        encap = (struct iphdr *)(skb_transport_header(skb) +
+                                 sizeof(struct pimreghdr));
         if (!MULTICAST(encap->daddr) ||
             encap->tot_len == 0 ||
             ntohs(encap->tot_len) + sizeof(*pim) > skb->len)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f832f3c33ab1..2b214cc3724c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2219,8 +2219,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                 th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
                                        (__force u32)delta));
                 if (skb->ip_summed != CHECKSUM_PARTIAL)
-                        th->check = csum_fold(csum_partial(skb->h.raw, thlen,
-                                                           skb->csum));
+                        th->check =
+                             csum_fold(csum_partial(skb_transport_header(skb),
+                                                    thlen, skb->csum));
 
                 seq += len;
                 skb = skb->next;
@@ -2230,12 +2231,13 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                 th->cwr = 0;
         } while (skb->next);
 
-        delta = htonl(oldlen + (skb->tail - skb->h.raw) + skb->data_len);
+        delta = htonl(oldlen + (skb->tail - skb_transport_header(skb)) +
+                      skb->data_len);
         th->check = ~csum_fold((__force __wsum)((__force u32)th->check +
                                 (__force u32)delta));
         if (skb->ip_summed != CHECKSUM_PARTIAL)
-                th->check = csum_fold(csum_partial(skb->h.raw, thlen,
-                                                   skb->csum));
+                th->check = csum_fold(csum_partial(skb_transport_header(skb),
+                                                   thlen, skb->csum));
 
 out:
         return segs;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c1ce36237380..9c3b4c7a50ad 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -140,7 +140,7 @@ static void tcp_measure_rcv_mss(struct sock *sk,
                  *
                  * "len" is invariant segment length, including TCP header.
                  */
-                len += skb->data - skb->h.raw;
+                len += skb->data - skb_transport_header(skb);
                 if (len >= TCP_MIN_RCVMSS + sizeof(struct tcphdr) ||
                     /* If PSH is not set, packet should be
                      * full sized, provided peer TCP is not badly broken.
@@ -940,7 +940,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned char *ptr = ack_skb->h.raw + TCP_SKB_CB(ack_skb)->sacked;
+        unsigned char *ptr = (skb_transport_header(ack_skb) +
+                              TCP_SKB_CB(ack_skb)->sacked);
         struct tcp_sack_block_wire *sp = (struct tcp_sack_block_wire *)(ptr+2);
         struct sk_buff *cached_skb;
         int num_sacks = (ptr[1] - TCPOLEN_SACK_BASE)>>3;
@@ -3634,10 +3635,10 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
                         return;
 
                 skb_set_mac_header(nskb, skb_mac_header(skb) - skb->head);
-                skb_set_network_header(nskb,
-                                       skb_network_header(skb) - skb->head);
-                skb_set_transport_header(nskb, skb->h.raw - skb->head);
-
+                skb_set_network_header(nskb, (skb_network_header(skb) -
+                                              skb->head));
+                skb_set_transport_header(nskb, (skb_transport_header(skb) -
+                                                skb->head));
                 skb_reserve(nskb, header);
                 memcpy(nskb->head, skb->head, header);
                 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 32fcfc0b5c8c..591f0f1ef87f 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -51,7 +51,7 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 
                 BUG_ON(optlen < 0);
 
-                ph = (struct ip_beet_phdr *)skb->h.raw;
+                ph = (struct ip_beet_phdr *)skb_transport_header(skb);
                 ph->padlen = 4 - (optlen & 4);
                 ph->hdrlen = optlen / 8;
                 ph->nexthdr = top_iph->protocol;
diff --git a/net/ipv4/xfrm4_mode_transport.c b/net/ipv4/xfrm4_mode_transport.c
index 2c46cbb3bbb5..dc8834ea3754 100644
--- a/net/ipv4/xfrm4_mode_transport.c
+++ b/net/ipv4/xfrm4_mode_transport.c
@@ -45,10 +45,11 @@ static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
  */
 static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        int ihl = skb->data - skb->h.raw;
+        int ihl = skb->data - skb_transport_header(skb);
 
         if (skb->h.raw != skb->nh.raw) {
-                memmove(skb->h.raw, skb_network_header(skb), ihl);
+                memmove(skb_transport_header(skb),
+                        skb_network_header(skb), ihl);
                 skb->nh.raw = skb->h.raw;
         }
         ip_hdr(skb)->tot_len = htons(skb->len + ihl);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index e5ee981d3e10..d2af4fe3725b 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -268,7 +268,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
                         goto error_free_iph;
         }
 
-        ah = (struct ip_auth_hdr *)skb->h.raw;
+        ah = (struct ip_auth_hdr *)skb_transport_header(skb);
         ah->nexthdr = nexthdr;
 
         top_iph->priority    = 0;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index ad522b7b5771..436eb9e6a6cf 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -87,7 +87,7 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         pskb_put(skb, trailer, clen - skb->len);
 
         top_iph = (struct ipv6hdr *)__skb_push(skb, hdr_len);
-        esph = (struct ipv6_esp_hdr *)skb->h.raw;
+        esph = (struct ipv6_esp_hdr *)skb_transport_header(skb);
         top_iph->payload_len = htons(skb->len + alen - sizeof(*top_iph));
         *(u8 *)(trailer->tail - 1) = *skb_network_header(skb);
         *skb_network_header(skb) = IPPROTO_ESP;
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 1bda0299890e..f25ee773f52e 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -144,7 +144,7 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
         struct tlvtype_proc *curr;
         const unsigned char *nh = skb_network_header(skb);
         int off = skb->h.raw - skb->nh.raw;
-        int len = ((skb->h.raw[1]+1)<<3);
+        int len = (skb_transport_header(skb)[1] + 1) << 3;
 
         if (skb_transport_offset(skb) + len > skb_headlen(skb))
                 goto bad;
@@ -290,15 +290,14 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 ((skb->h.raw[1] + 1) << 3)))) {
+                                 ((skb_transport_header(skb)[1] + 1) << 3)))) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
 
-        opt->lastopt = skb->h.raw - skb->nh.raw;
-        opt->dst1 = skb->h.raw - skb->nh.raw;
+        opt->lastopt = opt->dst1 = skb->h.raw - skb->nh.raw;
 #ifdef CONFIG_IPV6_MIP6
         dstbuf = opt->dst1;
 #endif
@@ -307,7 +306,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
         if (ip6_parse_tlv(tlvprocdestopt_lst, skbp)) {
                 dst_release(dst);
                 skb = *skbp;
-                skb->h.raw += ((skb->h.raw[1]+1)<<3);
+                skb->h.raw += (skb_transport_header(skb)[1] + 1) << 3;
                 opt = IP6CB(skb);
 #ifdef CONFIG_IPV6_MIP6
                 opt->nhoff = dstbuf;
@@ -390,14 +389,14 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 ((skb->h.raw[1] + 1) << 3)))) {
+                                 ((skb_transport_header(skb)[1] + 1) << 3)))) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
 
-        hdr = (struct ipv6_rt_hdr *) skb->h.raw;
+        hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 
         switch (hdr->type) {
 #ifdef CONFIG_IPV6_MIP6
@@ -444,8 +443,7 @@ looped_back:
                         break;
                 }
 
-                opt->lastopt = skb->h.raw - skb->nh.raw;
-                opt->srcrt = skb->h.raw - skb->nh.raw;
+                opt->lastopt = opt->srcrt = skb->h.raw - skb->nh.raw;
                 skb->h.raw += (hdr->hdrlen + 1) << 3;
                 opt->dst0 = opt->dst1;
                 opt->dst1 = 0;
@@ -745,7 +743,8 @@ int ipv6_parse_hopopts(struct sk_buff **skbp)
          * hop-by-hop options.
          */
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
-            !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) {
+            !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
+                                 ((skb_transport_header(skb)[1] + 1) << 3)))) {
                 kfree_skb(skb);
                 return -1;
         }
@@ -753,7 +752,7 @@ int ipv6_parse_hopopts(struct sk_buff **skbp)
         opt->hop = sizeof(struct ipv6hdr);
         if (ip6_parse_tlv(tlvprochopopt_lst, skbp)) {
                 skb = *skbp;
-                skb->h.raw += (skb->h.raw[1]+1)<<3;
+                skb->h.raw += (skb_transport_header(skb)[1] + 1) << 3;
                 opt = IP6CB(skb);
                 opt->nhoff = sizeof(struct ipv6hdr);
                 return 1;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 4a6501695e98..5555c98dea03 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -143,7 +143,7 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
         /* compression */
         plen = skb->len - hdr_len;
         dlen = IPCOMP_SCRATCH_SIZE;
-        start = skb->h.raw;
+        start = skb_transport_header(skb);
 
         cpu = get_cpu();
         scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 1f2a3be9308a..c6436f5e3e9f 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1212,7 +1212,7 @@ int igmp6_event_query(struct sk_buff *skb)
                         in6_dev_put(idev);
                         return -EINVAL;
                 }
-                mlh2 = (struct mld2_query *) skb->h.raw;
+                mlh2 = (struct mld2_query *)skb_transport_header(skb);
                 max_delay = (MLDV2_MRC(ntohs(mlh2->mrc))*HZ)/1000;
                 if (!max_delay)
                         max_delay = 1;
@@ -1235,7 +1235,7 @@ int igmp6_event_query(struct sk_buff *skb)
                                 in6_dev_put(idev);
                                 return -EINVAL;
                         }
-                        mlh2 = (struct mld2_query *) skb->h.raw;
+                        mlh2 = (struct mld2_query *)skb_transport_header(skb);
                         mark = 1;
                 }
         } else {
@@ -1460,18 +1460,20 @@ static inline int mld_dev_queue_xmit(struct sk_buff *skb)
 static void mld_sendpack(struct sk_buff *skb)
 {
         struct ipv6hdr *pip6 = ipv6_hdr(skb);
-        struct mld2_report *pmr = (struct mld2_report *)skb->h.raw;
+        struct mld2_report *pmr =
+                              (struct mld2_report *)skb_transport_header(skb);
         int payload_len, mldlen;
         struct inet6_dev *idev = in6_dev_get(skb->dev);
         int err;
 
         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         payload_len = skb->tail - skb_network_header(skb) - sizeof(*pip6);
-        mldlen = skb->tail - skb->h.raw;
+        mldlen = skb->tail - skb_transport_header(skb);
         pip6->payload_len = htons(payload_len);
 
         pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
-                IPPROTO_ICMPV6, csum_partial(skb->h.raw, mldlen, 0));
+                IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
+                                             mldlen, 0));
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
                 mld_dev_queue_xmit);
         if (!err) {
@@ -1505,7 +1507,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         pgr->grec_auxwords = 0;
         pgr->grec_nsrcs = 0;
         pgr->grec_mca = pmc->mca_addr;  /* structure copy */
-        pmr = (struct mld2_report *)skb->h.raw;
+        pmr = (struct mld2_report *)skb_transport_header(skb);
         pmr->ngrec = htons(ntohs(pmr->ngrec)+1);
         *ppgr = pgr;
         return skb;
@@ -1538,7 +1540,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         if (!*psf_list)
                 goto empty_source;
 
-        pmr = skb ? (struct mld2_report *)skb->h.raw : NULL;
+        pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
 
         /* EX and TO_EX get a fresh packet, if needed */
         if (truncate) {
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 85202891644e..f0288e92fb52 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -92,10 +92,10 @@ int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 
         if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 ((skb->h.raw[1] + 1) << 3))))
+                                 ((skb_transport_header(skb)[1] + 1) << 3))))
                 return -1;
 
-        mh = (struct ip6_mh *)skb->h.raw;
+        mh = (struct ip6_mh *)skb_transport_header(skb);
 
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
@@ -158,7 +158,7 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
         nexthdr = *skb_network_header(skb);
         *skb_network_header(skb) = IPPROTO_DSTOPTS;
 
-        dstopt = (struct ipv6_destopt_hdr *)skb->h.raw;
+        dstopt = (struct ipv6_destopt_hdr *)skb_transport_header(skb);
         dstopt->nexthdr = nexthdr;
 
         hao = mip6_padn((char *)(dstopt + 1),
@@ -370,7 +370,7 @@ static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
         nexthdr = *skb_network_header(skb);
         *skb_network_header(skb) = IPPROTO_ROUTING;
 
-        rt2 = (struct rt2_hdr *)skb->h.raw;
+        rt2 = (struct rt2_hdr *)skb_transport_header(skb);
         rt2->rt_hdr.nexthdr = nexthdr;
         rt2->rt_hdr.hdrlen = (x->props.header_len >> 3) - 1;
         rt2->rt_hdr.type = IPV6_SRCRT_TYPE_2;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 8b946f56287a..f9a85ab594db 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -760,7 +760,7 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
 static void ndisc_recv_ns(struct sk_buff *skb)
 {
-        struct nd_msg *msg = (struct nd_msg *)skb->h.raw;
+        struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
@@ -938,7 +938,7 @@ out:
 
 static void ndisc_recv_na(struct sk_buff *skb)
 {
-        struct nd_msg *msg = (struct nd_msg *)skb->h.raw;
+        struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
@@ -1040,7 +1040,7 @@ out:
 
 static void ndisc_recv_rs(struct sk_buff *skb)
 {
-        struct rs_msg *rs_msg = (struct rs_msg *) skb->h.raw;
+        struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
         struct neighbour *neigh;
         struct inet6_dev *idev;
@@ -1097,7 +1097,7 @@ out:
 
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
-        struct ra_msg *ra_msg = (struct ra_msg *) skb->h.raw;
+        struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
         struct neighbour *neigh = NULL;
         struct inet6_dev *in6_dev;
         struct rt6_info *rt = NULL;
@@ -1108,7 +1108,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         __u8 * opt = (__u8 *)(ra_msg + 1);
 
-        optlen = (skb->tail - skb->h.raw) - sizeof(struct ra_msg);
+        optlen = (skb->tail - skb_transport_header(skb)) -
+                  sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                 ND_PRINTK2(KERN_WARNING
@@ -1357,7 +1358,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 return;
         }
 
-        optlen = skb->tail - skb->h.raw;
+        optlen = skb->tail - skb_transport_header(skb);
         optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
 
         if (optlen < 0) {
@@ -1584,9 +1585,9 @@ int ndisc_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, skb->len))
                 return 0;
 
-        msg = (struct nd_msg *) skb->h.raw;
+        msg = (struct nd_msg *)skb_transport_header(skb);
 
-        __skb_push(skb, skb->data-skb->h.raw);
+        __skb_push(skb, skb->data - skb_transport_header(skb));
 
         if (ipv6_hdr(skb)->hop_limit != 255) {
                 ND_PRINTK2(KERN_WARNING
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index bb049f1c2679..116257d59a36 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1077,7 +1077,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL)
-                                amount = skb->tail - skb->h.raw;
+                                amount = skb->tail - skb_transport_header(skb);
                         spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index ef29a7bb97ce..31d4271ea540 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -726,7 +726,7 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
         }
 
         hdr = ipv6_hdr(skb);
-        fhdr = (struct frag_hdr *)skb->h.raw;
+        fhdr = (struct frag_hdr *)skb_transport_header(skb);
 
         if (!(fhdr->frag_off & htons(0xFFF9))) {
                 /* It is not a fragmented frame */
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 0134d74ef087..d526f4e9c65e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -51,10 +51,11 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
  */
 static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        int ihl = skb->data - skb->h.raw;
+        int ihl = skb->data - skb_transport_header(skb);
 
         if (skb->h.raw != skb->nh.raw) {
-                memmove(skb->h.raw, skb_network_header(skb), ihl);
+                memmove(skb_transport_header(skb),
+                        skb_network_header(skb), ihl);
                 skb->nh.raw = skb->h.raw;
         }
         ipv6_hdr(skb)->payload_len = htons(skb->len + ihl -
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ee15bdae1419..5c4695840c58 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
         case IPPROTO_COMP:
                 if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
                         return -EINVAL;
-                *spi = htonl(ntohs(*(__be16*)(skb->h.raw + 2)));
+                *spi = htonl(ntohs(*(__be16*)(skb_transport_header(skb) + 2)));
                 *seq = 0;
                 return 0;
         default:
@@ -72,8 +72,8 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
         if (!pskb_may_pull(skb, 16))
                 return -EINVAL;
 
-        *spi = *(__be32*)(skb->h.raw + offset);
-        *seq = *(__be32*)(skb->h.raw + offset_seq);
+        *spi = *(__be32*)(skb_transport_header(skb) + offset);
+        *seq = *(__be32*)(skb_transport_header(skb) + offset_seq);
         return 0;
 }
 EXPORT_SYMBOL(xfrm_parse_spi);