diff --git a/[refs] b/[refs]
index c255063aae5b..e67905afb2f8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2ba2506ca7ca62c56edaa334b0fe61eb5eab6ab0
+refs/heads/master: 27785d83e4256fedeff45256d4c827fdcb47f2ce
diff --git a/trunk/net/llc/llc_input.c b/trunk/net/llc/llc_input.c
index c40c9b2a345a..bfd2567dd365 100644
--- a/trunk/net/llc/llc_input.c
+++ b/trunk/net/llc/llc_input.c
@@ -117,8 +117,12 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
 	skb_pull(skb, llc_len);
 	if (skb->protocol == htons(ETH_P_802_2)) {
 		__be16 pdulen = eth_hdr(skb)->h_proto;
-		u16 data_size = ntohs(pdulen) - llc_len;
+		s32 data_size = ntohs(pdulen) - llc_len;
 
+		if (data_size < 0 ||
+		    ((skb_tail_pointer(skb) -
+		      (u8 *)pdu) - llc_len) < data_size)
+			return 0;
 		if (unlikely(pskb_trim_rcsum(skb, data_size)))
 			return 0;
 	}