23 files changed, 67 insertions, 58 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index a1686dfcbb9a..0e9f00c5c899 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -173,7 +173,7 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct br2684_dev *brdev,
         }
         skb_push(skb, minheadroom);
         if (brvcc->encaps == e_llc)
-                memcpy(skb->data, llc_oui_pid_pad, 10);
+                skb_copy_to_linear_data(skb, llc_oui_pid_pad, 10);
         else
                 memset(skb->data, 0, 2);
 #endif /* FASTER_VERSION */
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 4b3e72f31b3b..6d63afa5764d 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -576,8 +576,8 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                         break;
                                 }
                                 skb2->len = sizeof(struct atmlec_msg);
-                                memcpy(skb2->data, mesg,
-                                       sizeof(struct atmlec_msg));
+                                skb_copy_to_linear_data(skb2, mesg,
+                                                        sizeof(*mesg));
                                 atm_force_charge(priv->lecd, skb2->truesize);
                                 sk = sk_atm(priv->lecd);
                                 skb_queue_tail(&sk->sk_receive_queue, skb2);
@@ -1337,7 +1337,7 @@ static int lane2_resolve(struct net_device *dev, u8 *dst_mac, int force,
                 if (skb == NULL)
                         return -1;
                 skb->len = *sizeoftlvs;
-                memcpy(skb->data, *tlvs, *sizeoftlvs);
+                skb_copy_to_linear_data(skb, *tlvs, *sizeoftlvs);
                 retval = send_to_lecd(priv, l_arp_xmt, dst_mac, NULL, skb);
         }
         return retval;
@@ -1371,7 +1371,7 @@ static int lane2_associate_req(struct net_device *dev, u8 *lan_dst,
         if (skb == NULL)
                 return 0;
         skb->len = sizeoftlvs;
-        memcpy(skb->data, tlvs, sizeoftlvs);
+        skb_copy_to_linear_data(skb, tlvs, sizeoftlvs);
         retval = send_to_lecd(priv, l_associate_req, NULL, NULL, skb);
         if (retval != 0)
                 printk("lec.c: lane2_associate_req() failed\n");
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 4d2592c14090..813e08d6dc7c 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -504,11 +504,13 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
                 tagged_llc_snap_hdr.tag = entry->ctrl_info.tag;
                 skb_pull(skb, ETH_HLEN);                       /* get rid of Eth header */
                 skb_push(skb, sizeof(tagged_llc_snap_hdr));    /* add LLC/SNAP header   */
-                memcpy(skb->data, &tagged_llc_snap_hdr, sizeof(tagged_llc_snap_hdr));
+                skb_copy_to_linear_data(skb, &tagged_llc_snap_hdr,
+                                        sizeof(tagged_llc_snap_hdr));
         } else {
                 skb_pull(skb, ETH_HLEN);                        /* get rid of Eth header */
                 skb_push(skb, sizeof(struct llc_snap_hdr));     /* add LLC/SNAP header + tag  */
-                memcpy(skb->data, &llc_snap_mpoa_data, sizeof(struct llc_snap_hdr));
+                skb_copy_to_linear_data(skb, &llc_snap_mpoa_data,
+                                        sizeof(struct llc_snap_hdr));
         }
 
         atomic_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
@@ -711,7 +713,8 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 return;
         }
         skb_push(new_skb, eg->ctrl_info.DH_length);     /* add MAC header */
-        memcpy(new_skb->data, eg->ctrl_info.DLL_header, eg->ctrl_info.DH_length);
+        skb_copy_to_linear_data(new_skb, eg->ctrl_info.DLL_header,
+                                eg->ctrl_info.DH_length);
         new_skb->protocol = eth_type_trans(new_skb, dev);
         skb_reset_network_header(new_skb);
 
@@ -936,7 +939,7 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
         if (skb == NULL)
                 return -ENOMEM;
         skb_put(skb, sizeof(struct k_message));
-        memcpy(skb->data, mesg, sizeof(struct k_message));
+        skb_copy_to_linear_data(skb, mesg, sizeof(*mesg));
         atm_force_charge(mpc->mpoad_vcc, skb->truesize);
 
         sk = sk_atm(mpc->mpoad_vcc);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 8b45224699f4..fd70d041e51f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -149,7 +149,8 @@ int nf_bridge_copy_header(struct sk_buff *skb)
         if (err)
                 return err;
 
-        memcpy(skb->data - header_size, skb->nf_bridge->data, header_size);
+        skb_copy_to_linear_data_offset(skb, -header_size,
+                                       skb->nf_bridge->data, header_size);
 
         if (skb->protocol == htons(ETH_P_8021Q))
                 __skb_push(skb, VLAN_HLEN);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 57a82445c465..1fb30c3528bc 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -293,7 +293,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         if (!skb)
                 return;
 
-        memcpy(skb->data, msg, len);
+        skb_copy_to_linear_data(skb, msg, len);
         skb->len += len;
 
         skb_push(skb, sizeof(*udph));
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 17c6bb5927b6..331d3efa82fa 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1129,7 +1129,7 @@ int skb_store_bits(const struct sk_buff *skb, int offset, void *from, int len)
         if ((copy = start - offset) > 0) {
                 if (copy > len)
                         copy = len;
-                memcpy(skb->data + offset, from, copy);
+                skb_copy_to_linear_data_offset(skb, offset, from, copy);
                 if ((len -= copy) == 0)
                         return 0;
                 offset += copy;
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 94e2b8e2ab26..6ae036b1920f 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -759,8 +759,9 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                     IEEE80211_FCTL_TODS) && skb->len >= ETH_HLEN + ETH_ALEN) {
                 /* Non-standard frame: get addr4 from its bogus location after
                  * the payload */
-                memcpy(skb->data + ETH_ALEN,
-                       skb->data + skb->len - ETH_ALEN, ETH_ALEN);
+                skb_copy_to_linear_data_offset(skb, ETH_ALEN,
+                                               skb->data + skb->len - ETH_ALEN,
+                                               ETH_ALEN);
                 skb_trim(skb, skb->len - ETH_ALEN);
         }
 #endif
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index ba348b1e5f84..ab86137c71d2 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -66,7 +66,7 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->truesize += dlen - plen;
         __skb_put(skb, dlen - plen);
-        memcpy(skb->data, scratch, dlen);
+        skb_copy_to_linear_data(skb, scratch, dlen);
 out:
         put_cpu();
         return err;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 48027df5a90b..0ebae413ae87 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -584,7 +584,7 @@ static int ipmr_cache_report(struct sk_buff *pkt, vifi_t vifi, int assert)
 
         skb->network_header = skb->tail;
         skb_put(skb, ihl);
-        memcpy(skb->data,pkt->data,ihl);
+        skb_copy_to_linear_data(skb, pkt->data, ihl);
         ip_hdr(skb)->protocol = 0;                      /* Flag to the kernel this is a route add */
         msg = (struct igmpmsg *)skb_network_header(skb);
         msg->im_vif = vifi;
diff --git a/net/ipv4/ipvs/ip_vs_app.c b/net/ipv4/ipvs/ip_vs_app.c
index c8a822c0aa75..15ad5dd2d984 100644
--- a/net/ipv4/ipvs/ip_vs_app.c
+++ b/net/ipv4/ipvs/ip_vs_app.c
@@ -602,7 +602,7 @@ int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
                 skb_put(skb, diff);
                 memmove(skb->data + o_offset + n_len,
                         skb->data + o_offset + o_len, o_left);
-                memcpy(skb->data + o_offset, n_buf, n_len);
+                skb_copy_to_linear_data_offset(skb, o_offset, n_buf, n_len);
         }
 
         /* must update the iph total length here */
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index cd8fec05f9bc..0d72693869e6 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -368,7 +368,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         }
         if (!skb_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
-        memcpy(e->skb->data, v->payload, v->data_len);
+        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
         e->skb->ip_summed = CHECKSUM_NONE;
 
         return 0;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 7691a1b5caac..1ee50b5782e1 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -111,7 +111,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->truesize += dlen - plen;
         __skb_put(skb, dlen - plen);
-        memcpy(skb->data, scratch, dlen);
+        skb_copy_to_linear_data(skb, scratch, dlen);
         err = ipch->nexthdr;
 
 out_put_cpu:
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 2f1ae422d87f..bfae9fdc4668 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -366,7 +366,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         }
         if (!skb_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
-        memcpy(e->skb->data, v->payload, v->data_len);
+        skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
         e->skb->ip_summed = CHECKSUM_NONE;
 
         return 0;
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index b55bc8f989df..3279897a01b0 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -256,7 +256,7 @@ static struct sk_buff *irttp_reassemble_skb(struct tsap_cb *self)
          *  Copy all fragments to a new buffer
          */
         while ((frag = skb_dequeue(&self->rx_fragments)) != NULL) {
-                memcpy(skb->data+n, frag->data, frag->len);
+                skb_copy_to_linear_data_offset(skb, n, frag->data, frag->len);
                 n += frag->len;
 
                 dev_kfree_skb(frag);
diff --git a/net/irda/wrapper.c b/net/irda/wrapper.c
index 2acc66dfb558..a7a7f191f1a8 100644
--- a/net/irda/wrapper.c
+++ b/net/irda/wrapper.c
@@ -239,7 +239,8 @@ async_bump(struct net_device *dev,
 
         if(docopy) {
                 /* Copy data without CRC (lenght already checked) */
-                memcpy(newskb->data, rx_buff->data, rx_buff->len - 2);
+                skb_copy_to_linear_data(newskb, rx_buff->data,
+                                        rx_buff->len - 2);
                 /* Deliver this skb */
                 dataskb = newskb;
         } else {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 9aefb1c9bfa3..7a97bec67729 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -648,7 +648,7 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
         }
         if (!skb_make_writable(&e->skb, data_len))
                 return -ENOMEM;
-        memcpy(e->skb->data, data, data_len);
+        skb_copy_to_linear_data(e->skb, data, data_len);
         e->skb->ip_summed = CHECKSUM_NONE;
         return 0;
 }
diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c
index 7c467c95c7d6..e3e6c44e1890 100644
--- a/net/netrom/nr_out.c
+++ b/net/netrom/nr_out.c
@@ -59,8 +59,8 @@ void nr_output(struct sock *sk, struct sk_buff *skb)
 
                         /* Duplicate the Transport Header */
                         skb_push(skbn, NR_TRANSPORT_LEN);
-                        memcpy(skbn->data, transport, NR_TRANSPORT_LEN);
-
+                        skb_copy_to_linear_data(skbn, transport,
+                                                NR_TRANSPORT_LEN);
                         if (skb->len > 0)
                                 skbn->data[4] |= NR_MORE_FLAG;
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f38c3b3471ee..806bf6f5dc6d 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1181,7 +1181,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                         /* Duplicate the Header */
                         skb_push(skbn, ROSE_MIN_LEN);
-                        memcpy(skbn->data, header, ROSE_MIN_LEN);
+                        skb_copy_to_linear_data(skbn, header, ROSE_MIN_LEN);
 
                         if (skb->len > 0)
                                 skbn->data[2] |= M_BIT;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 71c2f2fd405c..f3f99c8ea08a 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1001,7 +1001,7 @@ static int link_bundle_buf(struct link *l_ptr,
                 return 0;
 
         skb_put(bundler, pad + size);
-        memcpy(bundler->data + to_pos, buf->data, size);
+        skb_copy_to_linear_data_offset(bundler, to_pos, buf->data, size);
         msg_set_size(bundler_msg, to_pos + size);
         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);
         dbg("Packed msg # %u(%u octets) into pos %u in buf(#%u)\n",
@@ -1109,8 +1109,8 @@ int tipc_link_send_buf(struct link *l_ptr, struct sk_buff *buf)
                         if (bundler) {
                                 msg_init(&bundler_hdr, MSG_BUNDLER, OPEN_MSG,
                                          TIPC_OK, INT_H_SIZE, l_ptr->addr);
-                                memcpy(bundler->data, (unchar *)&bundler_hdr,
-                                       INT_H_SIZE);
+                                skb_copy_to_linear_data(bundler, &bundler_hdr,
+                                                        INT_H_SIZE);
                                 skb_trim(bundler, INT_H_SIZE);
                                 link_bundle_buf(l_ptr, bundler, buf);
                                 buf = bundler;
@@ -1383,9 +1383,9 @@ again:
         if (!buf)
                 return -ENOMEM;
         buf->next = NULL;
-        memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE);
+        skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
         hsz = msg_hdr_sz(hdr);
-        memcpy(buf->data + INT_H_SIZE, (unchar *)hdr, hsz);
+        skb_copy_to_linear_data_offset(buf, INT_H_SIZE, hdr, hsz);
         msg_dbg(buf_msg(buf), ">BUILD>");
 
         /* Chop up message: */
@@ -1416,8 +1416,8 @@ error:
                                 return -EFAULT;
                         }
                 } else
-                        memcpy(buf->data + fragm_crs, sect_crs, sz);
-
+                        skb_copy_to_linear_data_offset(buf, fragm_crs,
+                                                       sect_crs, sz);
                 sect_crs += sz;
                 sect_rest -= sz;
                 fragm_crs += sz;
@@ -1442,7 +1442,7 @@ error:
 
                         buf->next = NULL;
                         prev->next = buf;
-                        memcpy(buf->data, (unchar *)&fragm_hdr, INT_H_SIZE);
+                        skb_copy_to_linear_data(buf, &fragm_hdr, INT_H_SIZE);
                         fragm_crs = INT_H_SIZE;
                         fragm_rest = fragm_sz;
                         msg_dbg(buf_msg(buf),"  >BUILD>");
@@ -2130,7 +2130,7 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg,
                 buf = l_ptr->proto_msg_queue;
                 if (!buf)
                         return;
-                memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg));
+                skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
                 return;
         }
         msg_set_timestamp(msg, jiffies_to_msecs(jiffies));
@@ -2143,7 +2143,7 @@ void tipc_link_send_proto_msg(struct link *l_ptr, u32 msg_typ, int probe_msg,
         if (!buf)
                 return;
 
-        memcpy(buf->data, (unchar *)msg, sizeof(l_ptr->proto_msg));
+        skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
         msg_set_size(buf_msg(buf), msg_size);
 
         if (tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr)) {
@@ -2319,8 +2319,8 @@ void tipc_link_tunnel(struct link *l_ptr,
                      "unable to send tunnel msg\n");
                 return;
         }
-        memcpy(buf->data, (unchar *)tunnel_hdr, INT_H_SIZE);
-        memcpy(buf->data + INT_H_SIZE, (unchar *)msg, length);
+        skb_copy_to_linear_data(buf, tunnel_hdr, INT_H_SIZE);
+        skb_copy_to_linear_data_offset(buf, INT_H_SIZE, msg, length);
         dbg("%c->%c:", l_ptr->b_ptr->net_plane, tunnel->b_ptr->net_plane);
         msg_dbg(buf_msg(buf), ">SEND>");
         tipc_link_send_buf(tunnel, buf);
@@ -2361,7 +2361,7 @@ void tipc_link_changeover(struct link *l_ptr)
 
                 buf = buf_acquire(INT_H_SIZE);
                 if (buf) {
-                        memcpy(buf->data, (unchar *)&tunnel_hdr, INT_H_SIZE);
+                        skb_copy_to_linear_data(buf, &tunnel_hdr, INT_H_SIZE);
                         msg_set_size(&tunnel_hdr, INT_H_SIZE);
                         dbg("%c->%c:", l_ptr->b_ptr->net_plane,
                             tunnel->b_ptr->net_plane);
@@ -2426,8 +2426,9 @@ void tipc_link_send_duplicate(struct link *l_ptr, struct link *tunnel)
                              "unable to send duplicate msg\n");
                         return;
                 }
-                memcpy(outbuf->data, (unchar *)&tunnel_hdr, INT_H_SIZE);
-                memcpy(outbuf->data + INT_H_SIZE, iter->data, length);
+                skb_copy_to_linear_data(outbuf, &tunnel_hdr, INT_H_SIZE);
+                skb_copy_to_linear_data_offset(outbuf, INT_H_SIZE, iter->data,
+                                               length);
                 dbg("%c->%c:", l_ptr->b_ptr->net_plane,
                     tunnel->b_ptr->net_plane);
                 msg_dbg(buf_msg(outbuf), ">SEND>");
@@ -2457,7 +2458,7 @@ static struct sk_buff *buf_extract(struct sk_buff *skb, u32 from_pos)
 
         eb = buf_acquire(size);
         if (eb)
-                memcpy(eb->data, (unchar *)msg, size);
+                skb_copy_to_linear_data(eb, msg, size);
         return eb;
 }
 
@@ -2631,9 +2632,9 @@ int tipc_link_send_long_buf(struct link *l_ptr, struct sk_buff *buf)
                         goto exit;
                 }
                 msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
-                memcpy(fragm->data, (unchar *)&fragm_hdr, INT_H_SIZE);
-                memcpy(fragm->data + INT_H_SIZE, crs, fragm_sz);
-
+                skb_copy_to_linear_data(fragm, &fragm_hdr, INT_H_SIZE);
+                skb_copy_to_linear_data_offset(fragm, INT_H_SIZE, crs,
+                                               fragm_sz);
                 /*  Send queued messages first, if any: */
 
                 l_ptr->stats.sent_fragments++;
@@ -2733,8 +2734,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 if (pbuf != NULL) {
                         pbuf->next = *pending;
                         *pending = pbuf;
-                        memcpy(pbuf->data, (unchar *)imsg, msg_data_sz(fragm));
-
+                        skb_copy_to_linear_data(pbuf, imsg,
+                                                msg_data_sz(fragm));
                         /*  Prepare buffer for subsequent fragments. */
 
                         set_long_msg_seqno(pbuf, long_msg_seq_no);
@@ -2750,7 +2751,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
                 u32 fsz = get_fragm_size(pbuf);
                 u32 crs = ((msg_fragm_no(fragm) - 1) * fsz);
                 u32 exp_frags = get_expected_frags(pbuf) - 1;
-                memcpy(pbuf->data + crs, msg_data(fragm), dsz);
+                skb_copy_to_linear_data_offset(pbuf, crs,
+                                               msg_data(fragm), dsz);
                 buf_discard(fbuf);
 
                 /* Is message complete? */
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 62d549063604..aec7ce7af875 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -786,15 +786,16 @@ static inline int msg_build(struct tipc_msg *hdr,
         *buf = buf_acquire(sz);
         if (!(*buf))
                 return -ENOMEM;
-        memcpy((*buf)->data, (unchar *)hdr, hsz);
+        skb_copy_to_linear_data(*buf, hdr, hsz);
         for (res = 1, cnt = 0; res && (cnt < num_sect); cnt++) {
                 if (likely(usrmem))
                         res = !copy_from_user((*buf)->data + pos,
                                               msg_sect[cnt].iov_base,
                                               msg_sect[cnt].iov_len);
                 else
-                        memcpy((*buf)->data + pos, msg_sect[cnt].iov_base,
-                               msg_sect[cnt].iov_len);
+                        skb_copy_to_linear_data_offset(*buf, pos,
+                                                       msg_sect[cnt].iov_base,
+                                                       msg_sect[cnt].iov_len);
                 pos += msg_sect[cnt].iov_len;
         }
         if (likely(res))
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 5f8217d4b452..bcd5da00737b 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -464,7 +464,7 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
         msg_set_size(rmsg, data_sz + hdr_sz);
         msg_set_nametype(rmsg, msg_nametype(msg));
         msg_set_nameinst(rmsg, msg_nameinst(msg));
-        memcpy(rbuf->data + hdr_sz, msg_data(msg), data_sz);
+        skb_copy_to_linear_data_offset(rbuf, hdr_sz, msg_data(msg), data_sz);
 
         /* send self-abort message when rejecting on a connected port */
         if (msg_connected(msg)) {
@@ -1419,7 +1419,7 @@ int tipc_send_buf(u32 ref, struct sk_buff *buf, unsigned int dsz)
                 return -ENOMEM;
 
         skb_push(buf, hsz);
-        memcpy(buf->data, (unchar *)msg, hsz);
+        skb_copy_to_linear_data(buf, msg, hsz);
         destnode = msg_destnode(msg);
         p_ptr->publ.congested = 1;
         if (!tipc_port_congested(p_ptr)) {
@@ -1555,7 +1555,7 @@ int tipc_forward_buf2name(u32 ref,
         if (skb_cow(buf, LONG_H_SIZE))
                 return -ENOMEM;
         skb_push(buf, LONG_H_SIZE);
-        memcpy(buf->data, (unchar *)msg, LONG_H_SIZE);
+        skb_copy_to_linear_data(buf, msg, LONG_H_SIZE);
         msg_dbg(buf_msg(buf),"PREP:");
         if (likely(destport || destnode)) {
                 p_ptr->sent++;
@@ -1679,7 +1679,7 @@ int tipc_forward_buf2port(u32 ref,
                 return -ENOMEM;
 
         skb_push(buf, DIR_MSG_H_SIZE);
-        memcpy(buf->data, (unchar *)msg, DIR_MSG_H_SIZE);
+        skb_copy_to_linear_data(buf, msg, DIR_MSG_H_SIZE);
         msg_dbg(msg, "buf2port: ");
         p_ptr->sent++;
         if (dest->node == tipc_own_addr)
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index c49e223084f1..7a19e0ede289 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -277,8 +277,8 @@ int wanrouter_encapsulate(struct sk_buff *skb, struct net_device *dev,
                 skb_push(skb, 7);
                 skb->data[0] = 0;
                 skb->data[1] = NLPID_SNAP;
-                memcpy(&skb->data[2], wanrouter_oui_ether,
-                       sizeof(wanrouter_oui_ether));
+                skb_copy_to_linear_data_offset(skb, 2, wanrouter_oui_ether,
+                                               sizeof(wanrouter_oui_ether));
                 *((unsigned short*)&skb->data[5]) = htons(type);
                 break;
 
diff --git a/net/x25/x25_out.c b/net/x25/x25_out.c
index bb45e21ffce9..2b96b52114d6 100644
--- a/net/x25/x25_out.c
+++ b/net/x25/x25_out.c
@@ -89,7 +89,7 @@ int x25_output(struct sock *sk, struct sk_buff *skb)
 
                         /* Duplicate the Header */
                         skb_push(skbn, header_len);
-                        memcpy(skbn->data, header, header_len);
+                        skb_copy_to_linear_data(skbn, header, header_len);
 
                         if (skb->len > 0) {
                                 if (x25->neighbour->extended)