1 files changed, 6 insertions, 4 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 477d7f80dba6..2b9a832b29a7 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -884,7 +884,7 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 {
         struct sctp_transport *transport = (struct sctp_transport *) arg;
 
-        if (asoc->overall_error_count > asoc->max_retrans) {
+        if (asoc->overall_error_count >= asoc->max_retrans) {
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -2122,7 +2122,7 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
         struct sctp_bind_addr *bp;
         int attempts = asoc->init_err_counter + 1;
 
-        if (attempts >= asoc->max_init_attempts) {
+        if (attempts > asoc->max_init_attempts) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_STALE_COOKIE));
                 return SCTP_DISPOSITION_DELETE_TCB;
@@ -3090,6 +3090,8 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                         break;
 
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
+                if (ch_end > skb->tail)
+                        break;
 
                 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
                         ootb_shut_ack = 1;
@@ -4638,7 +4640,7 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
 
-        if (attempts < asoc->max_init_attempts) {
+        if (attempts <= asoc->max_init_attempts) {
                 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
                 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
                 if (!repl)
@@ -4695,7 +4697,7 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
 
-        if (attempts < asoc->max_init_attempts) {
+        if (attempts <= asoc->max_init_attempts) {
                 repl = sctp_make_cookie_echo(asoc, NULL);
                 if (!repl)
                         return SCTP_DISPOSITION_NOMEM;