695 	struct sctp_chunkhdr *ch, _ch;  in sctp_rcv_ootb()  local
704 		ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);  in sctp_rcv_ootb()
707 		if (!ch || ntohs(ch->length) < sizeof(_ch))  in sctp_rcv_ootb()
710 		ch_end = offset + SCTP_PAD4(ntohs(ch->length));  in sctp_rcv_ootb()
718 		if (SCTP_CID_ABORT == ch->type)  in sctp_rcv_ootb()
725 		if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type)  in sctp_rcv_ootb()
733 		if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data)  in sctp_rcv_ootb()
1188 					struct sctp_chunkhdr *ch,  in __sctp_rcv_asconf_lookup()  argument
1193 	struct sctp_addip_chunk *asconf = (struct sctp_addip_chunk *)ch;  in __sctp_rcv_asconf_lookup()
1198 	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))  in __sctp_rcv_asconf_lookup()
1230 	struct sctp_chunkhdr *ch;  in __sctp_rcv_walk_lookup()  local
1238 	ch = (struct sctp_chunkhdr *)skb->data;  in __sctp_rcv_walk_lookup()
1241 		if (ntohs(ch->length) < sizeof(*ch))  in __sctp_rcv_walk_lookup()
1244 		ch_end = ((__u8 *)ch) + SCTP_PAD4(ntohs(ch->length));  in __sctp_rcv_walk_lookup()
1248 		switch (ch->type) {  in __sctp_rcv_walk_lookup()
1268 						net, ch, laddr,  in __sctp_rcv_walk_lookup()
1279 		ch = (struct sctp_chunkhdr *)ch_end;  in __sctp_rcv_walk_lookup()
1281 	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));  in __sctp_rcv_walk_lookup()
1297 	struct sctp_chunkhdr *ch;  in __sctp_rcv_lookup_harder()  local
1307 	ch = (struct sctp_chunkhdr *)skb->data;  in __sctp_rcv_lookup_harder()
1314 	if (SCTP_PAD4(ntohs(ch->length)) > skb->len)  in __sctp_rcv_lookup_harder()
1318 	if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK)  in __sctp_rcv_lookup_harder()