diff options
Diffstat (limited to 'net/sctp/sm_statefuns.c')
-rw-r--r-- | net/sctp/sm_statefuns.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index bf502c499c81..438e5dc5c714 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c | |||
@@ -3115,7 +3115,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep, | |||
3115 | break; | 3115 | break; |
3116 | 3116 | ||
3117 | ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); | 3117 | ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); |
3118 | if (ch_end > skb->tail) | 3118 | if (ch_end > skb_tail_pointer(skb)) |
3119 | break; | 3119 | break; |
3120 | 3120 | ||
3121 | if (SCTP_CID_SHUTDOWN_ACK == ch->type) | 3121 | if (SCTP_CID_SHUTDOWN_ACK == ch->type) |
@@ -3130,7 +3130,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep, | |||
3130 | return sctp_sf_pdiscard(ep, asoc, type, arg, commands); | 3130 | return sctp_sf_pdiscard(ep, asoc, type, arg, commands); |
3131 | 3131 | ||
3132 | ch = (sctp_chunkhdr_t *) ch_end; | 3132 | ch = (sctp_chunkhdr_t *) ch_end; |
3133 | } while (ch_end < skb->tail); | 3133 | } while (ch_end < skb_tail_pointer(skb)); |
3134 | 3134 | ||
3135 | if (ootb_shut_ack) | 3135 | if (ootb_shut_ack) |
3136 | sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands); | 3136 | sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands); |