diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 7544a0c686b49603ecebb8cf03141a40b391bc55..957cc5c3653dfe53215b4b1e61dabed082dce6b2 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -767,14 +767,10 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 				const struct sk_buff *skb,
 				const struct iovec *iv, int len)
 {
-	int ret, off;
+	int ret;
 	int vnet_hdr_len = 0;
 	int vlan_offset = 0;
 	int copied;
-	struct {
-		__be16 h_vlan_proto;
-		__be16 h_vlan_TCI;
-	} veth;
 
 	if (q->flags & IFF_VNET_HDR) {
 		struct virtio_net_hdr vnet_hdr;
@@ -789,13 +785,16 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 		if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
 			return -EFAULT;
 	}
-	off = copied = vnet_hdr_len;
+	copied = vnet_hdr_len;
 
 	if (!vlan_tx_tag_present(skb))
 		len = min_t(int, skb->len, len);
 	else {
 		int copy;
-
+		struct {
+			__be16 h_vlan_proto;
+			__be16 h_vlan_TCI;
+		} veth;
 		veth.h_vlan_proto = skb->vlan_proto;
 		veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
 
@@ -803,22 +802,22 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 		len = min_t(int, skb->len + VLAN_HLEN, len);
 
 		copy = min_t(int, vlan_offset, len);
-		ret = skb_copy_datagram_const_iovec(skb, 0, iv, off, copy);
+		ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
 		len -= copy;
-		off += copy;
+		copied += copy;
 		if (ret || !len)
 			goto done;
 
 		copy = min_t(int, sizeof(veth), len);
-		ret = memcpy_toiovecend(iv, (void *)&veth, off, copy);
+		ret = memcpy_toiovecend(iv, (void *)&veth, copied, copy);
 		len -= copy;
-		off += copy;
+		copied += copy;
 		if (ret || !len)
 			goto done;
 	}
 
-	ret = skb_copy_datagram_const_iovec(skb, vlan_offset, iv, off, len);
-	copied += skb->len + (vlan_offset ? sizeof(veth) : 0);
+	ret = skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
+	copied += len;
 
 done:
 	return ret ? ret : copied;
@@ -876,7 +875,7 @@ static ssize_t macvtap_aio_read(struct kiocb *iocb, const struct iovec *iv,
 	}
 
 	ret = macvtap_do_read(q, iocb, iv, len, file->f_flags & O_NONBLOCK);
-	ret = min_t(ssize_t, ret, len);
+	ret = min_t(ssize_t, ret, len); /* XXX copied from tun.c. Why? */
 	if (ret > 0)
 		iocb->ki_pos = ret;
 out:
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index dd1bd7aedc3c58e07e28a4ee63034d5b038d0073..e26cbea1ce68dde18805a67be9e5ed861558036d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1183,11 +1183,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 			    const struct iovec *iv, int len)
 {
 	struct tun_pi pi = { 0, skb->protocol };
-	struct {
-		__be16 h_vlan_proto;
-		__be16 h_vlan_TCI;
-	} veth;
-	ssize_t total = 0, off = 0;
+	ssize_t total = 0;
 	int vlan_offset = 0;
 
 	if (!(tun->flags & TUN_NO_PI)) {
@@ -1252,11 +1248,14 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 		total += tun->vnet_hdr_sz;
 	}
 
-	off = total;
 	if (!vlan_tx_tag_present(skb)) {
 		len = min_t(int, skb->len, len);
 	} else {
 		int copy, ret;
+		struct {
+			__be16 h_vlan_proto;
+			__be16 h_vlan_TCI;
+		} veth;
 
 		veth.h_vlan_proto = skb->vlan_proto;
 		veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
@@ -1265,22 +1264,22 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 		len = min_t(int, skb->len + VLAN_HLEN, len);
 
 		copy = min_t(int, vlan_offset, len);
-		ret = skb_copy_datagram_const_iovec(skb, 0, iv, off, copy);
+		ret = skb_copy_datagram_const_iovec(skb, 0, iv, total, copy);
 		len -= copy;
-		off += copy;
+		total += copy;
 		if (ret || !len)
 			goto done;
 
 		copy = min_t(int, sizeof(veth), len);
-		ret = memcpy_toiovecend(iv, (void *)&veth, off, copy);
+		ret = memcpy_toiovecend(iv, (void *)&veth, total, copy);
 		len -= copy;
-		off += copy;
+		total += copy;
 		if (ret || !len)
 			goto done;
 	}
 
-	skb_copy_datagram_const_iovec(skb, vlan_offset, iv, off, len);
-	total += skb->len + (vlan_offset ? sizeof(veth) : 0);
+	skb_copy_datagram_const_iovec(skb, vlan_offset, iv, total, len);
+	total += len;
 
 done:
 	tun->dev->stats.tx_packets++;