3 files changed, 19 insertions, 17 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index ffa26c10bfe8..4f9e11b533a3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -191,7 +191,7 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 
         /* Special commands */
         while ((skb = skb_dequeue(&hdev->driver_init))) {
-                skb->pkt_type = HCI_COMMAND_PKT;
+                bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
                 skb->dev = (void *) hdev;
                 skb_queue_tail(&hdev->cmd_q, skb);
                 hci_sched_cmd(hdev);
@@ -995,7 +995,7 @@ static int hci_send_frame(struct sk_buff *skb)
                 return -ENODEV;
         }
 
-        BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+        BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
         if (atomic_read(&hdev->promisc)) {
                 /* Time stamp */
@@ -1034,7 +1034,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 
         BT_DBG("skb len %d", skb->len);
 
-        skb->pkt_type = HCI_COMMAND_PKT;
+        bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
         skb_queue_tail(&hdev->cmd_q, skb);
         hci_sched_cmd(hdev);
@@ -1081,7 +1081,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
 
         skb->dev = (void *) hdev;
-        skb->pkt_type = HCI_ACLDATA_PKT;
+        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
 
         if (!(list = skb_shinfo(skb)->frag_list)) {
@@ -1103,7 +1103,7 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
                         skb = list; list = list->next;
                         
                         skb->dev = (void *) hdev;
-                        skb->pkt_type = HCI_ACLDATA_PKT;
+                        bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
 
                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
@@ -1139,7 +1139,7 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
         memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
 
         skb->dev = (void *) hdev;
-        skb->pkt_type = HCI_SCODATA_PKT;
+        bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
         skb_queue_tail(&conn->data_q, skb);
         hci_sched_tx(hdev);
         return 0;
@@ -1369,7 +1369,7 @@ void hci_rx_task(unsigned long arg)
 
                 if (test_bit(HCI_INIT, &hdev->flags)) {
                         /* Don't process data packets in this states. */
-                        switch (skb->pkt_type) {
+                        switch (bt_cb(skb)->pkt_type) {
                         case HCI_ACLDATA_PKT:
                         case HCI_SCODATA_PKT:
                                 kfree_skb(skb);
@@ -1378,7 +1378,7 @@ void hci_rx_task(unsigned long arg)
                 }
 
                 /* Process frame */
-                switch (skb->pkt_type) {
+                switch (bt_cb(skb)->pkt_type) {
                 case HCI_EVENT_PKT:
                         hci_event_packet(hdev, skb);
                         break;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a004284c4d98..40b219560bb1 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1089,7 +1089,7 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         bt_cb(skb)->incoming = 1;
         do_gettimeofday(&skb->stamp);
 
-        skb->pkt_type = HCI_EVENT_PKT;
+        bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
         skb->dev = (void *) hdev;
         hci_send_to_sock(hdev, skb);
         kfree_skb(skb);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index ebdcce5e7ca0..eed9090d77f1 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -110,11 +110,11 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 /* Apply filter */
                 flt = &hci_pi(sk)->filter;
 
-                if (!test_bit((skb->pkt_type == HCI_VENDOR_PKT) ?
-                                0 : (skb->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
+                if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
+                                0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
                         continue;
 
-                if (skb->pkt_type == HCI_EVENT_PKT) {
+                if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
                         register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 
                         if (!hci_test_bit(evt, &flt->event_mask))
@@ -131,7 +131,7 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                         continue;
 
                 /* Put type byte before the data */
-                memcpy(skb_push(nskb, 1), &nskb->pkt_type, 1);
+                memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
 
                 if (sock_queue_rcv_skb(sk, nskb))
                         kfree_skb(nskb);
@@ -327,8 +327,10 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
 {
         __u32 mask = hci_pi(sk)->cmsg_mask;
 
-        if (mask & HCI_CMSG_DIR)
-                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(int), &bt_cb(skb)->incoming);
+        if (mask & HCI_CMSG_DIR) {
+                int incoming = bt_cb(skb)->incoming;
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
+        }
 
         if (mask & HCI_CMSG_TSTAMP)
                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
@@ -405,11 +407,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto drop;
         }
 
-        skb->pkt_type = *((unsigned char *) skb->data);
+        bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
         skb_pull(skb, 1);
         skb->dev = (void *) hdev;
 
-        if (skb->pkt_type == HCI_COMMAND_PKT) {
+        if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
                 u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
                 u16 ogf = hci_opcode_ogf(opcode);
                 u16 ocf = hci_opcode_ocf(opcode);