diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index aa6acebc7c1ef6547451329fa23dafdc5443a5ba..87bb3a91598ee96b825f7aaff53aafb32ffe4f95 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -700,6 +700,8 @@ static int fill_frame_info(struct hsr_frame_info *frame,
                frame->is_vlan = true;
 
        if (frame->is_vlan) {
+               if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr))
+                       return -EINVAL;
                vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr;
                proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto;
        }