1 files changed, 9 insertions, 7 deletions

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0e06a278d2a9..ba9ad32fc447 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
         union sctp_addr saddr;
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
         struct sctp_association *asoc;
         struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
         __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
         *app = NULL; *tpp = NULL;
 
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
          * discard the packet.
          */
         if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-                          + sizeof(__be32) ||
+                /* chunk header + first 4 octects of init header */
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                     chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                         goto out;
-                }
+
         } else if (vtag != asoc->c.peer_vtag) {
                 goto out;
         }