diff --git a/[refs] b/[refs]
index 5d359c59a6f5..22229be61e3b 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d007da1fa6f0ad5e01ceae4a1f60cdbb23ecd706
+refs/heads/master: b6ccc67d8e42e38936df330b26ee6d022dda8a64
diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c
index 142257307fa2..7c6a34e21eee 100644
--- a/trunk/net/core/skbuff.c
+++ b/trunk/net/core/skbuff.c
@@ -644,11 +644,10 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
 	/* Copy only real data... and, alas, header. This should be
 	 * optimized for the cases when header is void. */
-	memcpy(data + nhead, skb->head,
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
-		skb->tail);
+	memcpy(data + nhead, skb->head, skb->tail);
 #else
-		skb->tail - skb->head);
+	memcpy(data + nhead, skb->head, skb->tail - skb->head);
 #endif
 	memcpy(data + size, skb_end_pointer(skb),
 	       sizeof(struct skb_shared_info));