diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 9840cd4..96f4dda 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -113,7 +113,8 @@ static void netlink_gen_payload_mask(struct netlink_linearize_ctx *ctx,
 	mpz_t mask;
 
 	offset = expr->payload.offset % BITS_PER_BYTE;
-	shift = (expr->len % BITS_PER_BYTE) - offset;
+	len = expr->len % BITS_PER_BYTE;
+	shift = BITS_PER_BYTE - (offset + len);
 	masklen = expr->len + shift;
 
 	if (masklen > 128)
@@ -291,7 +292,7 @@ static void netlink_gen_range(struct netlink_linearize_ctx *ctx,
 
 static void payload_shift_value(const struct expr *left, struct expr *right)
 {
-	unsigned int shift, offset;
+	unsigned int shift, offset, len;
 
 	if (right->ops->type != EXPR_VALUE ||
 	    left->ops->type != EXPR_PAYLOAD)
@@ -300,7 +301,8 @@ static void payload_shift_value(const struct expr *left, struct expr *right)
 	if (left->payload.offset % BITS_PER_BYTE ||
 	    (left->payload.offset + left->len) % BITS_PER_BYTE) {
 		offset = left->payload.offset % BITS_PER_BYTE;
-		shift = (left->len % BITS_PER_BYTE) - offset;
+		len = left->len % BITS_PER_BYTE;
+		shift = BITS_PER_BYTE - (offset + len);
 		mpz_lshift_ui(right->value, shift);
 	}
 }