Merge 4.4.265 into android-4.4-p

Changes in 4.4.265
	selinux: vsock: Set SID for socket returned by accept()
	ipv6: weaken the v4mapped source check
	ext4: fix bh ref count on error paths
	rpc: fix NULL dereference on kmalloc failure
	ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
	ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
	ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
	scsi: st: Fix a use after free in st_open()
	scsi: qla2xxx: Fix broken #endif placement
	staging: comedi: cb_pcidas: fix request_irq() warn
	staging: comedi: cb_pcidas64: fix request_irq() warn
	ext4: do not iput inode under running transaction in ext4_rename()
	appletalk: Fix skb allocation size in loopback case
	net: wan/lmc: unregister device when no matching device is found
	ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
	ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
	tracing: Fix stack trace event size
	mm: fix race by making init_zero_pfn() early_initcall
	reiserfs: update reiserfs_xattrs_initialized() condition
	pinctrl: rockchip: fix restore error in resume
	extcon: Fix error handling in extcon_dev_register
	firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
	USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
	cdc-acm: fix BREAK rx code path adding necessary calls
	USB: cdc-acm: downgrade message to debug
	USB: cdc-acm: fix use-after-free after probe failure
	staging: rtl8192e: Fix incorrect source in memcpy()
	staging: rtl8192e: Change state information from u16 to u8
	Linux 4.4.265

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I23368777e608080ef12898664935fe7394c5f40d

1 files changed, 21 insertions, 12 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index ace94170f55e..1048cddcc9a3 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1575,8 +1575,8 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct ddpehdr *ddp;
-	int size;
-	struct atalk_route *rt;
+	int size, hard_header_len;
+	struct atalk_route *rt, *rt_lo = NULL;
 	int err;
 
 	if (flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
@@ -1639,7 +1639,22 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 	SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n",
 			sk, size, dev->name);
 
-	size += dev->hard_header_len;
+	hard_header_len = dev->hard_header_len;
+	/* Leave room for loopback hardware header if necessary */
+	if (usat->sat_addr.s_node == ATADDR_BCAST &&
+	    (dev->flags & IFF_LOOPBACK || !(rt->flags & RTF_GATEWAY))) {
+		struct atalk_addr at_lo;
+
+		at_lo.s_node = 0;
+		at_lo.s_net  = 0;
+
+		rt_lo = atrtr_find(&at_lo);
+
+		if (rt_lo && rt_lo->dev->hard_header_len > hard_header_len)
+			hard_header_len = rt_lo->dev->hard_header_len;
+	}
+
+	size += hard_header_len;
 	release_sock(sk);
 	skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err);
 	lock_sock(sk);
@@ -1647,7 +1662,7 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		goto out;
 
 	skb_reserve(skb, ddp_dl->header_length);
-	skb_reserve(skb, dev->hard_header_len);
+	skb_reserve(skb, hard_header_len);
 	skb->dev = dev;
 
 	SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk);
@@ -1698,18 +1713,12 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		/* loop back */
 		skb_orphan(skb);
 		if (ddp->deh_dnode == ATADDR_BCAST) {
-			struct atalk_addr at_lo;
-
-			at_lo.s_node = 0;
-			at_lo.s_net  = 0;
-
-			rt = atrtr_find(&at_lo);
-			if (!rt) {
+			if (!rt_lo) {
 				kfree_skb(skb);
 				err = -ENETUNREACH;
 				goto out;
 			}
-			dev = rt->dev;
+			dev = rt_lo->dev;
 			skb->dev = dev;
 		}
 		ddp_dl->request(ddp_dl, skb, dev->dev_addr);