[SCTP] Fix missing '+' in the computation of sack chunk size in

sctp_sm_pull_sack().
Signed-off-by: Jorge Hernandez <jhh@lucent.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>

net/sctp/sm_statefuns.c

@@ -4494,7 +4494,7 @@ struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk)
 	num_blocks = ntohs(sack->num_gap_ack_blocks);
 	num_dup_tsns = ntohs(sack->num_dup_tsns);
 	len = sizeof(struct sctp_sackhdr);
-	len = (num_blocks + num_dup_tsns) * sizeof(__u32);
+	len += (num_blocks + num_dup_tsns) * sizeof(__u32);
 	if (len > chunk->skb->len)
 		return NULL;