How to get next TCP segment in linux kernel module?

I know I can get the pointer of TCP packet data like this:

char *data = (char *)tcphdr + 4 * tcph->doff;

But, once data was segmented, I cannot get full data by this. So, how to get next sk_buff of next segment?

My simple code is here:

#include ...

static struct nf_hook_ops nfho;

unsigned int hook_funcion(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
{

	// check if it is TCP packet

	char *data = (char *)tcphdr + 4 * tcph->doff;

	// do something here

	return NF_ACCEPT;
}

static int __init hook_init(void)
{
	int ret;

	nfho.hook = hook_funcion;
	nfho.pf = NFPROTO_IPV4;
	nfho.hooknum = NF_INET_POST_ROUTING;
	nfho.priority = NF_IP_PRI_LAST;
	ret = nf_register_hook(&nfho);
	printk("xmurp-test start\n");
	printk("nf_register_hook returnd %d\n", ret);

	return 0;
}

static void __exit hook_exit(void)
{
	nf_unregister_hook(&nfho);
	printk("xmurp-test stop\n");
}

module_init(hook_init);
module_exit(hook_exit);

By sequence number. But it isn't reliable because TCP packets may be out of order