2 files changed, 3 insertions, 2 deletions

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f5aa87e1e0c8..d89876b806a0 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -202,10 +202,11 @@ struct skb_shared_info {
          */
         atomic_t        dataref;
 
-        skb_frag_t      frags[MAX_SKB_FRAGS];
         /* Intermediate layers must ensure that destructor_arg
          * remains valid until skb destructor */
         void *          destructor_arg;
+        /* must be last field, see pskb_expand_head() */
+        skb_frag_t      frags[MAX_SKB_FRAGS];
 };
 
 /* We divide dataref into two halves.  The higher 16 bits hold references
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 76d33ca5f037..7da58a25ad92 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -817,7 +817,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
         memcpy(data + nhead, skb->head, skb->tail - skb->head);
 #endif
         memcpy(data + size, skb_end_pointer(skb),
-               sizeof(struct skb_shared_info));
+               offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
                 get_page(skb_shinfo(skb)->frags[i].page);