The subh->err_hdr should point to the error header, not the data.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
        padlen = len % 4;
        err.length  = htons(len);
        len += padlen;
-       sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
-       chunk->subh.err_hdr = sctp_addto_chunk(chunk, paylen, payload);
+       chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
+       sctp_addto_chunk(chunk, paylen, payload);
 }
 
 /* 3.3.2 Initiation (INIT) (1)