aboutsummaryrefslogtreecommitdiffstats
path: root/net/sctp/sm_statefuns.c
diff options
context:
space:
mode:
Diffstat (limited to 'net/sctp/sm_statefuns.c')
-rw-r--r--net/sctp/sm_statefuns.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index bf502c499c81..438e5dc5c714 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3115,7 +3115,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3115 break; 3115 break;
3116 3116
3117 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length)); 3117 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
3118 if (ch_end > skb->tail) 3118 if (ch_end > skb_tail_pointer(skb))
3119 break; 3119 break;
3120 3120
3121 if (SCTP_CID_SHUTDOWN_ACK == ch->type) 3121 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
@@ -3130,7 +3130,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
3130 return sctp_sf_pdiscard(ep, asoc, type, arg, commands); 3130 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
3131 3131
3132 ch = (sctp_chunkhdr_t *) ch_end; 3132 ch = (sctp_chunkhdr_t *) ch_end;
3133 } while (ch_end < skb->tail); 3133 } while (ch_end < skb_tail_pointer(skb));
3134 3134
3135 if (ootb_shut_ack) 3135 if (ootb_shut_ack)
3136 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands); 3136 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);