diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 1e82c51657a7e21fa07bd3916bf98256c34e7dbf..93ebd14b48ed73f3f5d9f28c73424d7bba4ba4cb 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3637,7 +3637,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
 		}
 
 		ch = (struct sctp_chunkhdr *)ch_end;
-	} while (ch_end < skb_tail_pointer(skb));
+	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
 
 	if (ootb_shut_ack)
 		return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);