bonding: validate ip header before check IPPROTO_IGMP

bonding: validate ip header before check IPPROTO_IGMP

commit 9d1bc24b52fb8c5d859f9a47084bf1179470e04c upstream.

bond_xmit_roundrobin() checks for IGMP packets but it parses
the IP header even before checking skb->protocol.

We should validate the IP header with pskb_may_pull() before
using iph->protocol.

Reported-and-tested-by: syzbot+e5be16aa39ad6e755391@syzkaller.appspotmail.com
Fixes: a2fd940f4cff ("bonding: fix broken multicast with round-robin mode")
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
 - Keep using ACCESS_ONCE(), dev_kfree_skb_any(), …_can_tx()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>