4 files changed, 10 insertions, 10 deletions

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 1ff47b18724a..18b97eedc1fa 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -612,7 +612,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
                         break;
 
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
-                if (ch_end > skb->tail)
+                if (ch_end > skb_tail_pointer(skb))
                         break;
 
                 /* RFC 8.4, 2) If the OOTB packet contains an ABORT chunk, the
@@ -644,7 +644,7 @@ int sctp_rcv_ootb(struct sk_buff *skb)
                 }
 
                 ch = (sctp_chunkhdr_t *) ch_end;
-        } while (ch_end < skb->tail);
+        } while (ch_end < skb_tail_pointer(skb));
 
         return 0;
 
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30629e17781..88aa22407549 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -159,16 +159,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
          * the skb->tail.
          */
         if (unlikely(skb_is_nonlinear(chunk->skb))) {
-                if (chunk->chunk_end > chunk->skb->tail)
-                        chunk->chunk_end = chunk->skb->tail;
+                if (chunk->chunk_end > skb_tail_pointer(chunk->skb))
+                        chunk->chunk_end = skb_tail_pointer(chunk->skb);
         }
         skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
         chunk->subh.v = NULL; /* Subheader is no longer valid.  */
 
-        if (chunk->chunk_end < chunk->skb->tail) {
+        if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
                 /* This is not a singleton */
                 chunk->singleton = 0;
-        } else if (chunk->chunk_end > chunk->skb->tail) {
+        } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
                 /* RFC 2960, Section 6.10  Bundling
                  *
                  * Partial chunks MUST NOT be placed in an SCTP packet.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 60c5b59d4c65..759ea3d19976 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1143,7 +1143,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
 
         /* Adjust the chunk length field.  */
         chunk->chunk_hdr->length = htons(chunklen + padlen + len);
-        chunk->chunk_end = chunk->skb->tail;
+        chunk->chunk_end = skb_tail_pointer(chunk->skb);
 
         return target;
 }
@@ -1168,7 +1168,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
         /* Adjust the chunk length field.  */
         chunk->chunk_hdr->length =
                 htons(ntohs(chunk->chunk_hdr->length) + len);
-        chunk->chunk_end = chunk->skb->tail;
+        chunk->chunk_end = skb_tail_pointer(chunk->skb);
 
 out:
         return err;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index bf502c499c81..438e5dc5c714 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3115,7 +3115,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                         break;
 
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
-                if (ch_end > skb->tail)
+                if (ch_end > skb_tail_pointer(skb))
                         break;
 
                 if (SCTP_CID_SHUTDOWN_ACK == ch->type)
@@ -3130,7 +3130,7 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                         return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
                 ch = (sctp_chunkhdr_t *) ch_end;
-        } while (ch_end < skb->tail);
+        } while (ch_end < skb_tail_pointer(skb));
 
         if (ootb_shut_ack)
                 sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);