diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index d64c3ae33298..90de27284251 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -137,6 +137,7 @@ int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code, size_t paylen) { struct sctp_errhdr err; + int chunklen, padlen; __u16 len; /* Cause code constants are now defined in network order. */ @@ -144,7 +145,13 @@ int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code, len = sizeof(err) + paylen; err.length = htons(len); - if (skb_tailroom(chunk->skb) < len) + /* sctp_addto_chunk() pads the chunk up to a 4-byte boundary before + * appending the cause, so account for that padding here as well. + */ + chunklen = ntohs(chunk->chunk_hdr->length); + padlen = SCTP_PAD4(chunklen) - chunklen; + + if (skb_tailroom(chunk->skb) < padlen + len) return -ENOSPC; chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);