diff options
Diffstat (limited to 'net/sctp/input.c')
-rw-r--r-- | net/sctp/input.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sctp/input.c b/net/sctp/input.c index 1ff47b18724a..18b97eedc1fa 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c | |||
@@ -612,7 +612,7 @@ int sctp_rcv_ootb(struct sk_buff *skb) | |||
612 | break; | 612 | break; |
613 | 613 | ||
614 | ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); | 614 | ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); |
615 | if (ch_end > skb->tail) | 615 | if (ch_end > skb_tail_pointer(skb)) |
616 | break; | 616 | break; |
617 | 617 | ||
618 | /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the | 618 | /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the |
@@ -644,7 +644,7 @@ int sctp_rcv_ootb(struct sk_buff *skb) | |||
644 | } | 644 | } |
645 | 645 | ||
646 | ch = (sctp_chunkhdr_t *) ch_end; | 646 | ch = (sctp_chunkhdr_t *) ch_end; |
647 | } while (ch_end < skb->tail); | 647 | } while (ch_end < skb_tail_pointer(skb)); |
648 | 648 | ||
649 | return 0; | 649 | return 0; |
650 | 650 | ||