imamnurby/smpl_train_seed8 huggingface dataset:
--- initial
+++ final
@@ -1,60 +1,60 @@
 static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, const struct ovs_conntrack_info *info, struct sk_buff *skb) {
   /* If we are recirculating packets to match on conntrack fields and
    * committing with a separate conntrack action,  then we don't need to
    * actually run the packet through conntrack twice unless it's for a
    * different zone.
    */
   bool cached = skb_nfct_cached(net, key, info, skb);
   enum ip_conntrack_info ctinfo;
   struct nf_conn *ct;
   if (!cached) {
     struct nf_conn *tmpl = info->ct;
     int err;
     /* Associate skb with specified zone. */
     if (tmpl) {
-      if (skb->nfct) nf_conntrack_put(skb->nfct);
+      if (skb_nfct(skb)) nf_conntrack_put(skb_nfct(skb));
       nf_conntrack_get(&tmpl->ct_general);
       skb->nfct = &tmpl->ct_general;
       skb->nfctinfo = IP_CT_NEW;
     }
     err = nf_conntrack_in(net, info->family, NF_INET_PRE_ROUTING, skb);
     if (err != NF_ACCEPT) return -ENOENT;
     /* Clear CT state NAT flags to mark that we have not yet done
      * NAT after the nf_conntrack_in() call.  We can actually clear
      * the whole state, as it will be re-initialized below.
      */
     key->ct.state = 0;
     /* Update the key, but keep the NAT flags. */
     ovs_ct_update_key(skb, info, key, true, true);
   }
   ct = nf_ct_get(skb, &ctinfo);
   if (ct) {
     /* Packets starting a new connection must be NATted before the
      * helper, so that the helper knows about the NAT.  We enforce
      * this by delaying both NAT and helper calls for unconfirmed
      * connections until the committing CT action.  For later
      * packets NAT and Helper may be called in either order.
      *
      * NAT will be done only if the CT action has NAT, and only
      * once per packet (per zone), as guarded by the NAT bits in
      * the key->ct.state.
      */
     if (info->nat && !(key->ct.state & OVS_CS_F_NAT_MASK) && (nf_ct_is_confirmed(ct) || info->commit) && ovs_ct_nat(net, key, info, skb, ct, ctinfo) != NF_ACCEPT) { return -EINVAL; }
     /* Userspace may decide to perform a ct lookup without a helper
      * specified followed by a (recirculate and) commit with one.
      * Therefore, for unconfirmed connections which we will commit,
      * we need to attach the helper here.
      */
     if (!nf_ct_is_confirmed(ct) && info->commit && info->helper && !nfct_help(ct)) {
       int err = __nf_ct_try_assign_helper(ct, info->ct, GFP_ATOMIC);
       if (err) return err;
     }
     /* Call the helper only if:
      * - nf_conntrack_in() was executed above ("!cached") for a
      *   confirmed connection, or
      * - When committing an unconfirmed connection.
      */
     if ((nf_ct_is_confirmed(ct) ? !cached : info->commit) && ovs_ct_helper(skb, info->family) != NF_ACCEPT) { return -EINVAL; }
   }
   return 0;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,27 +1,27 @@
 static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key, const struct ovs_conntrack_info *info, struct sk_buff *skb) {
   struct nf_conntrack_expect *exp;
   /* If we pass an expected packet through nf_conntrack_in() the
    * expectation is typically removed, but the packet could still be
    * lost in upcall processing.  To prevent this from happening we
    * perform an explicit expectation lookup.  Expected connections are
    * always new, and will be passed through conntrack only when they are
    * committed, as it is OK to remove the expectation at that time.
    */
   exp = ovs_ct_expect_find(net, &info->zone, info->family, skb);
   if (exp) {
     u8 state;
     /* NOTE: New connections are NATted and Helped only when
      * committed, so we are not calling into NAT here.
      */
     state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
     __ovs_ct_update_key(key, state, &info->zone, exp->master);
   } else {
     struct nf_conn *ct;
     int err;
     err = __ovs_ct_lookup(net, key, info, skb);
     if (err) return err;
-    ct = (struct nf_conn *)skb->nfct;
+    ct = (struct nf_conn *)skb_nfct(skb);
     if (ct) nf_ct_deliver_cached_events(ct);
   }
   return 0;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,25 +1,25 @@
 static void synproxy_send_client_ack(struct net *net, const struct sk_buff *skb, const struct tcphdr *th, const struct synproxy_options *opts) {
   struct sk_buff *nskb;
   struct ipv6hdr *iph, *niph;
   struct tcphdr *nth;
   unsigned int tcp_hdr_size;
   iph = ipv6_hdr(skb);
   tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
   nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER, GFP_ATOMIC);
   if (nskb == NULL) return;
   skb_reserve(nskb, MAX_TCP_HEADER);
   niph = synproxy_build_ip(net, nskb, &iph->saddr, &iph->daddr);
   skb_reset_transport_header(nskb);
   nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
   nth->source = th->source;
   nth->dest = th->dest;
   nth->seq = htonl(ntohl(th->seq) + 1);
   nth->ack_seq = th->ack_seq;
   tcp_flag_word(nth) = TCP_FLAG_ACK;
   nth->doff = tcp_hdr_size / 4;
   nth->window = htons(ntohs(th->window) >> opts->wscale);
   nth->check = 0;
   nth->urg_ptr = 0;
   synproxy_build_options(nth, opts);
-  synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
+  synproxy_send_tcp(net, skb, nskb, skb_nfct(skb), IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,27 +1,27 @@
 static void synproxy_send_client_synack(struct net *net, const struct sk_buff *skb, const struct tcphdr *th, const struct synproxy_options *opts) {
   struct sk_buff *nskb;
   struct ipv6hdr *iph, *niph;
   struct tcphdr *nth;
   unsigned int tcp_hdr_size;
   u16 mss = opts->mss;
   iph = ipv6_hdr(skb);
   tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
   nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER, GFP_ATOMIC);
   if (nskb == NULL) return;
   skb_reserve(nskb, MAX_TCP_HEADER);
   niph = synproxy_build_ip(net, nskb, &iph->daddr, &iph->saddr);
   skb_reset_transport_header(nskb);
   nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
   nth->source = th->dest;
   nth->dest = th->source;
   nth->seq = htonl(__cookie_v6_init_sequence(iph, th, &mss));
   nth->ack_seq = htonl(ntohl(th->seq) + 1);
   tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
   if (opts->options & XT_SYNPROXY_OPT_ECN) tcp_flag_word(nth) |= TCP_FLAG_ECE;
   nth->doff = tcp_hdr_size / 4;
   nth->window = 0;
   nth->check = 0;
   nth->urg_ptr = 0;
   synproxy_build_options(nth, opts);
-  synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
+  synproxy_send_tcp(net, skb, nskb, skb_nfct(skb), IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,25 +1,25 @@
 static void synproxy_send_client_ack(struct net *net, const struct sk_buff *skb, const struct tcphdr *th, const struct synproxy_options *opts) {
   struct sk_buff *nskb;
   struct iphdr *iph, *niph;
   struct tcphdr *nth;
   unsigned int tcp_hdr_size;
   iph = ip_hdr(skb);
   tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
   nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER, GFP_ATOMIC);
   if (nskb == NULL) return;
   skb_reserve(nskb, MAX_TCP_HEADER);
   niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
   skb_reset_transport_header(nskb);
   nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
   nth->source = th->source;
   nth->dest = th->dest;
   nth->seq = htonl(ntohl(th->seq) + 1);
   nth->ack_seq = th->ack_seq;
   tcp_flag_word(nth) = TCP_FLAG_ACK;
   nth->doff = tcp_hdr_size / 4;
   nth->window = htons(ntohs(th->window) >> opts->wscale);
   nth->check = 0;
   nth->urg_ptr = 0;
   synproxy_build_options(nth, opts);
-  synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
+  synproxy_send_tcp(net, skb, nskb, skb_nfct(skb), IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,27 +1,27 @@
 static void synproxy_send_client_synack(struct net *net, const struct sk_buff *skb, const struct tcphdr *th, const struct synproxy_options *opts) {
   struct sk_buff *nskb;
   struct iphdr *iph, *niph;
   struct tcphdr *nth;
   unsigned int tcp_hdr_size;
   u16 mss = opts->mss;
   iph = ip_hdr(skb);
   tcp_hdr_size = sizeof(*nth) + synproxy_options_size(opts);
   nskb = alloc_skb(sizeof(*niph) + tcp_hdr_size + MAX_TCP_HEADER, GFP_ATOMIC);
   if (nskb == NULL) return;
   skb_reserve(nskb, MAX_TCP_HEADER);
   niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
   skb_reset_transport_header(nskb);
   nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
   nth->source = th->dest;
   nth->dest = th->source;
   nth->seq = htonl(__cookie_v4_init_sequence(iph, th, &mss));
   nth->ack_seq = htonl(ntohl(th->seq) + 1);
   tcp_flag_word(nth) = TCP_FLAG_SYN | TCP_FLAG_ACK;
   if (opts->options & XT_SYNPROXY_OPT_ECN) tcp_flag_word(nth) |= TCP_FLAG_ECE;
   nth->doff = tcp_hdr_size / 4;
   nth->window = 0;
   nth->check = 0;
   nth->urg_ptr = 0;
   synproxy_build_options(nth, opts);
-  synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
+  synproxy_send_tcp(net, skb, nskb, skb_nfct(skb), IP_CT_ESTABLISHED_REPLY, niph, nth, tcp_hdr_size);
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,34 +1,34 @@
 static int icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, unsigned int hooknum) {
   struct nf_conntrack_tuple innertuple, origtuple;
   const struct nf_conntrack_l4proto *innerproto;
   const struct nf_conntrack_tuple_hash *h;
   const struct nf_conntrack_zone *zone;
   enum ip_conntrack_info ctinfo;
   struct nf_conntrack_zone tmp;
-  NF_CT_ASSERT(skb->nfct == NULL);
+  NF_CT_ASSERT(skb_nfct(skb) == NULL);
   zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
   /* Are they talking about one of our connections? */
   if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb) + ip_hdrlen(skb) + sizeof(struct icmphdr), PF_INET, net, &origtuple)) {
     pr_debug("icmp_error_message: failed to get tuple\n");
     return -NF_ACCEPT;
   }
   /* rcu_read_lock()ed by nf_hook_thresh */
   innerproto = __nf_ct_l4proto_find(PF_INET, origtuple.dst.protonum);
   /* Ordinarily, we'd expect the inverted tupleproto, but it's
      been preserved inside the ICMP. */
   if (!nf_ct_invert_tuple(&innertuple, &origtuple, &nf_conntrack_l3proto_ipv4, innerproto)) {
     pr_debug("icmp_error_message: no match\n");
     return -NF_ACCEPT;
   }
   ctinfo = IP_CT_RELATED;
   h = nf_conntrack_find_get(net, zone, &innertuple);
   if (!h) {
     pr_debug("icmp_error_message: no match\n");
     return -NF_ACCEPT;
   }
   if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) ctinfo += IP_CT_IS_REPLY;
   /* Update skb to refer to this connection */
   skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
   skb->nfctinfo = ctinfo;
   return NF_ACCEPT;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,24 +1,24 @@
 static int icmpv6_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, unsigned int dataoff, u8 pf, unsigned int hooknum) {
   const struct icmp6hdr *icmp6h;
   struct icmp6hdr _ih;
   int type;
   icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
   if (icmp6h == NULL) {
     if (LOG_INVALID(net, IPPROTO_ICMPV6)) nf_log_packet(net, PF_INET6, 0, skb, NULL, NULL, NULL, "nf_ct_icmpv6: short packet ");
     return -NF_ACCEPT;
   }
   if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING && nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
     if (LOG_INVALID(net, IPPROTO_ICMPV6)) nf_log_packet(net, PF_INET6, 0, skb, NULL, NULL, NULL, "nf_ct_icmpv6: ICMPv6 checksum failed ");
     return -NF_ACCEPT;
   }
   type = icmp6h->icmp6_type - 130;
   if (type >= 0 && type < sizeof(noct_valid_new) && noct_valid_new[type]) {
     skb->nfct = &nf_ct_untracked_get()->ct_general;
     skb->nfctinfo = IP_CT_NEW;
-    nf_conntrack_get(skb->nfct);
+    nf_conntrack_get(skb_nfct(skb));
     return NF_ACCEPT;
   }
   /* is not error message ? */
   if (icmp6h->icmp6_type >= 128) return NF_ACCEPT;
   return icmpv6_error_message(net, tmpl, skb, dataoff, hooknum);
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,33 +1,33 @@
 static int icmpv6_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, unsigned int icmp6off, unsigned int hooknum) {
   struct nf_conntrack_tuple intuple, origtuple;
   const struct nf_conntrack_tuple_hash *h;
   const struct nf_conntrack_l4proto *inproto;
   enum ip_conntrack_info ctinfo;
   struct nf_conntrack_zone tmp;
-  NF_CT_ASSERT(skb->nfct == NULL);
+  NF_CT_ASSERT(skb_nfct(skb) == NULL);
   /* Are they talking about one of our connections? */
   if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb) + sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr), PF_INET6, net, &origtuple)) {
     pr_debug("icmpv6_error: Can't get tuple\n");
     return -NF_ACCEPT;
   }
   /* rcu_read_lock()ed by nf_hook_thresh */
   inproto = __nf_ct_l4proto_find(PF_INET6, origtuple.dst.protonum);
   /* Ordinarily, we'd expect the inverted tupleproto, but it's
      been preserved inside the ICMP. */
   if (!nf_ct_invert_tuple(&intuple, &origtuple, &nf_conntrack_l3proto_ipv6, inproto)) {
     pr_debug("icmpv6_error: Can't invert tuple\n");
     return -NF_ACCEPT;
   }
   ctinfo = IP_CT_RELATED;
   h = nf_conntrack_find_get(net, nf_ct_zone_tmpl(tmpl, skb, &tmp), &intuple);
   if (!h) {
     pr_debug("icmpv6_error: no match\n");
     return -NF_ACCEPT;
   } else {
     if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) ctinfo += IP_CT_IS_REPLY;
   }
   /* Update skb to refer to this connection */
   skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
   skb->nfctinfo = ctinfo;
   return NF_ACCEPT;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,17 +1,17 @@
 static unsigned int ipv4_conntrack_defrag(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) {
   struct sock *sk = skb->sk;
   if (sk && sk_fullsock(sk) && (sk->sk_family == PF_INET) && inet_sk(sk)->nodefrag) return NF_ACCEPT;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
 #if !IS_ENABLED(CONFIG_NF_NAT)
   /* Previously seen (loopback)?  Ignore.  Do this before
      fragment check. */
-  if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) return NF_ACCEPT;
+  if (skb_nfct(skb) && !nf_ct_is_template((struct nf_conn *)skb_nfct(skb))) return NF_ACCEPT;
 #endif
 #endif
   /* Gather fragments. */
   if (ip_is_fragment(ip_hdr(skb))) {
     enum ip_defrag_users user = nf_ct_defrag_user(state->hook, skb);
     if (nf_ct_ipv4_gather_frags(state->net, skb, user)) return NF_STOLEN;
   }
   return NF_ACCEPT;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,15 +1,15 @@
 static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum, struct sk_buff *skb) {
   u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
-  if (skb->nfct) {
+  if (skb_nfct(skb)) {
     enum ip_conntrack_info ctinfo;
     const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
     zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
   }
 #endif
   if (nf_bridge_in_prerouting(skb)) return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
   if (hooknum == NF_INET_PRE_ROUTING)
     return IP_DEFRAG_CONNTRACK_IN + zone_id;
   else
     return IP_DEFRAG_CONNTRACK_OUT + zone_id;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,11 +1,11 @@
 static unsigned int ipv6_defrag(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) {
   int err;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
   /* Previously seen (loopback)?	*/
-  if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct)) return NF_ACCEPT;
+  if (skb_nfct(skb) && !nf_ct_is_template((struct nf_conn *)skb_nfct(skb))) return NF_ACCEPT;
 #endif
   err = nf_ct_frag6_gather(state->net, skb, nf_ct6_defrag_user(state->hook, skb));
   /* queued */
   if (err == -EINPROGRESS) return NF_STOLEN;
   return err == 0 ? NF_ACCEPT : NF_DROP;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,15 +1,15 @@
 static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, struct sk_buff *skb) {
   u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
-  if (skb->nfct) {
+  if (skb_nfct(skb)) {
     enum ip_conntrack_info ctinfo;
     const struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
     zone_id = nf_ct_zone_id(nf_ct_zone(ct), CTINFO2DIR(ctinfo));
   }
 #endif
   if (nf_bridge_in_prerouting(skb)) return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id;
   if (hooknum == NF_INET_PRE_ROUTING)
     return IP6_DEFRAG_CONNTRACK_IN + zone_id;
   else
     return IP6_DEFRAG_CONNTRACK_OUT + zone_id;
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,37 +1,37 @@
 void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, const struct in_addr *gw, int oif) {
   struct iphdr *iph;
   if (this_cpu_read(nf_skb_duplicated)) return;
   /*
    * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
    * the original skb, which should continue on its way as if nothing has
    * happened. The copy should be independently delivered to the gateway.
    */
   skb = pskb_copy(skb, GFP_ATOMIC);
   if (skb == NULL) return;
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
   /* Avoid counting cloned packets towards the original connection. */
   nf_reset(skb);
   skb->nfct = &nf_ct_untracked_get()->ct_general;
   skb->nfctinfo = IP_CT_NEW;
-  nf_conntrack_get(skb->nfct);
+  nf_conntrack_get(skb_nfct(skb));
 #endif
   /*
    * If we are in PREROUTING/INPUT, decrease the TTL to mitigate potential
    * loops between two hosts.
    *
    * Set %IP_DF so that the original source is notified of a potentially
    * decreased MTU on the clone route. IPv6 does this too.
    *
    * IP header checksum will be recalculated at ip_local_out.
    */
   iph = ip_hdr(skb);
   iph->frag_off |= htons(IP_DF);
   if (hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_IN) --iph->ttl;
   if (nf_dup_ipv4_route(net, skb, gw, oif)) {
     __this_cpu_write(nf_skb_duplicated, true);
     ip_local_out(net, skb->sk, skb);
     __this_cpu_write(nf_skb_duplicated, false);
   } else {
     kfree_skb(skb);
   }
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,27 +1,27 @@
 static void mangle_contents(struct sk_buff *skb, unsigned int dataoff, unsigned int match_offset, unsigned int match_len, const char *rep_buffer, unsigned int rep_len) {
   unsigned char *data;
   BUG_ON(skb_is_nonlinear(skb));
   data = skb_network_header(skb) + dataoff;
   /* move post-replacement */
   memmove(data + match_offset + rep_len, data + match_offset + match_len, skb_tail_pointer(skb) - (skb_network_header(skb) + dataoff + match_offset + match_len));
   /* insert data from buffer */
   memcpy(data + match_offset, rep_buffer, rep_len);
   /* update skb info */
   if (rep_len > match_len) {
     pr_debug("nf_nat_mangle_packet: Extending packet by "
              "%u from %u bytes\n",
              rep_len - match_len, skb->len);
     skb_put(skb, rep_len - match_len);
   } else {
     pr_debug("nf_nat_mangle_packet: Shrinking packet from "
              "%u from %u bytes\n",
              match_len - rep_len, skb->len);
     __skb_trim(skb, skb->len + rep_len - match_len);
   }
-  if (nf_ct_l3num((struct nf_conn *)skb->nfct) == NFPROTO_IPV4) {
+  if (nf_ct_l3num((struct nf_conn *)skb_nfct(skb)) == NFPROTO_IPV4) {
     /* fix IP hdr checksum information */
     ip_hdr(skb)->tot_len = htons(skb->len);
     ip_send_check(ip_hdr(skb));
   } else
     ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,16 +1,16 @@
 static void skb_release_head_state(struct sk_buff *skb) {
   skb_dst_drop(skb);
 #ifdef CONFIG_XFRM
   secpath_put(skb->sp);
 #endif
   if (skb->destructor) {
     WARN_ON(in_irq());
     skb->destructor(skb);
   }
 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
-  nf_conntrack_put(skb->nfct);
+  nf_conntrack_put(skb_nfct(skb));
 #endif
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
   nf_bridge_put(skb->nf_bridge);
 #endif
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)
--- initial
+++ final
@@ -1,9 +1,9 @@
 void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) {
   void (*attach)(struct sk_buff *, const struct sk_buff *);
-  if (skb->nfct) {
+  if (skb_nfct(skb)) {
     rcu_read_lock();
     attach = rcu_dereference(ip_ct_attach);
     if (attach) attach(new, skb);
     rcu_read_unlock();
   }
 }<sep>@@
struct sk_buff *skb;
expression e;
statement S1, S2;
@@
(
  skb->nfct = e
|
-       skb->nfct
+       skb_nfct(skb)
)