diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d7a865ef370b6968c095510ae16b5196e30e54b9..e816aaba8e5f2ed06f8832f79553b6c976e75bb8 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1481,7 +1481,7 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
        skb->truesize += skb->data_len;
 
        for (i = 1; i < it->nr_segs; i++) {
-               const struct iovec *iov = iter_iov(it);
+               const struct iovec *iov = iter_iov(it) + i;
                size_t fragsz = iov->iov_len;
                struct page *page;
                void *frag;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6841e61a6bd0b66e7b1df0545697604479c6b7a1..23a25dc505a7992d61609cc68dbcd0894892f983 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1115,6 +1115,14 @@ static void skb_release_data(struct sk_buff *skb, enum skb_drop_reason reason)
                        goto free_head;
        }
 
+       if (shinfo->nr_frags > MAX_SKB_FRAGS) {
+               pr_err("nr_frags=%u\n", shinfo->nr_frags);
+               DEBUG_NET_WARN_ON_ONCE(shinfo->nr_frags > MAX_SKB_FRAGS);
+       }
+       if (shinfo->nr_frags && !skb->data_len) {
+               pr_err("skb->data_len is zero but nr_frags=%u\n", shinfo->nr_frags);
+               DEBUG_NET_WARN_ON_ONCE(shinfo->nr_frags && !skb->data_len);
+       }
        for (i = 0; i < shinfo->nr_frags; i++)
                __skb_frag_unref(&shinfo->frags[i], skb->pp_recycle);