--- drivers/net/bonding/bond_3ad.c

+++ drivers/net/bonding/bond_3ad.c

@@ -2451,6 +2451,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff

if (!(dev->flags & IFF_MASTER))

goto out;

+ if (!pskb_may_pull(skb, sizeof(struct lacpdu)))

+ goto out;

+

read_lock(&bond->lock);

slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),

orig_dev);