--- drivers/net/bonding/bond_alb.c

+++ drivers/net/bonding/bond_alb.c

@@ -370,6 +370,9 @@ static int rlb_arp_recv(struct sk_buff *

goto out;

}

+ if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))

+ goto out;

+

if (skb->len < sizeof(struct arp_pkt)) {

pr_debug("Packet is too small to be an ARP\n");

goto out;