fix up alsa patches and add another one

4 files changed, 55 insertions, 43 deletions

diff --git a/alsa-hda-ca0132-keep-power-on-during-processing-dsp-response.patch b/alsa-hda-ca0132-keep-power-on-during-processing-dsp-response.patch
deleted file mode 100644
index 5ee46b6..0000000
--- a/alsa-hda-ca0132-keep-power-on-during-processing-dsp-response.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 377bc0cfabce0244632dada19060839ced4e6949 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Fri, 13 Dec 2019 09:51:09 +0100
-Subject: ALSA: hda/ca0132 - Keep power on during processing DSP response
-
-From: Takashi Iwai <tiwai@suse.de>
-
-commit 377bc0cfabce0244632dada19060839ced4e6949 upstream.
-
-We need to keep power on while processing the DSP response via unsol
-event.  Each snd_hda_codec_read() call does the power management, so
-it should work normally, but still it's safer to keep the power up for
-the whole function.
-
-Fixes: a73d511c4867 ("ALSA: hda/ca0132: Add unsol handler for DSP and jack detection")
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/20191213085111.22855-2-tiwai@suse.de
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/pci/hda/patch_ca0132.c |    2 ++
- 1 file changed, 2 insertions(+)
-
---- a/sound/pci/hda/patch_ca0132.c
-+++ b/sound/pci/hda/patch_ca0132.c
-@@ -4400,12 +4400,14 @@ static void ca0132_process_dsp_response(
- 	struct ca0132_spec *spec = codec->spec;
- 
- 	codec_dbg(codec, "ca0132_process_dsp_response\n");
-+	snd_hda_power_up_pm(codec);
- 	if (spec->wait_scp) {
- 		if (dspio_get_response_data(codec) >= 0)
- 			spec->wait_scp = 0;
- 	}
- 
- 	dspio_clear_response_queue(codec);
-+	snd_hda_power_down_pm(codec);
- }
- 
- static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
diff --git a/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch b/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch
index 4dac2f8..6384d18 100644
--- a/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch
+++ b/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch
@@ -35,7 +35,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  		runtime->boundary *= 2;
  
 +	/* clear the buffer for avoiding possible kernel info leaks */
-+	if (runtime->dma_area && !substream->ops->copy_user)
++	if (runtime->dma_area)
 +		memset(runtime->dma_area, 0, runtime->dma_bytes);
 +
  	snd_pcm_timer_resolution_change(substream);
diff --git a/series b/series
index 2ce464b..933be50 100644
--- a/series
+++ b/series
@@ -1,7 +1,6 @@
 btrfs-do-not-leak-reloc-root-if-we-fail-to-read-the-fs-root.patch
 btrfs-handle-enoent-in-btrfs_uuid_tree_iterate.patch
 alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch
-alsa-hda-ca0132-keep-power-on-during-processing-dsp-response.patch
 alsa-hda-ca0132-avoid-endless-loop.patch
 af_packet-set-defaule-value-for-tmo.patch
 mod_devicetable-fix-phy-module-format.patch
@@ -16,3 +15,4 @@ filldir-remove-warn_on_once-for-bad-directory-entries.patch
 netfilter-ebtables-compat-reject-all-padding-in-matches-watchers.patch
 6pack-mkiss-fix-possible-deadlock.patch
 net-icmp-fix-data-race-in-cmp_global_allow.patch
+tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch
diff --git a/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch b/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch
new file mode 100644
index 0000000..3bd25c0
--- /dev/null
+++ b/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch
@@ -0,0 +1,53 @@
+From foo@baz Thu 02 Jan 2020 12:28:41 PM CET
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 12 Dec 2019 12:55:29 -0800
+Subject: tcp: do not send empty skb from tcp_write_xmit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 1f85e6267caca44b30c54711652b0726fadbb131 ]
+
+Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from
+write queue in error cases") in linux-4.14 stable triggered
+various bugs. One of them has been fixed in commit ba2ddb43f270
+("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but
+we still have crashes in some occasions.
+
+Root-cause is that when tcp_sendmsg() has allocated a fresh
+skb and could not append a fragment before being blocked
+in sk_stream_wait_memory(), tcp_write_xmit() might be called
+and decide to send this fresh and empty skb.
+
+Sending an empty packet is not only silly, it might have caused
+many issues we had in the past with tp->packets_out being
+out of sync.
+
+Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Christoph Paasch <cpaasch@apple.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2065,6 +2065,14 @@ static bool tcp_write_xmit(struct sock *
+ 		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
+ 			break;
+ 
++		/* Argh, we hit an empty skb(), presumably a thread
++		 * is sleeping in sendmsg()/sk_stream_wait_memory().
++		 * We do not want to send a pure-ack packet and have
++		 * a strange looking rtx queue with empty packet(s).
++		 */
++		if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq)
++			break;
++
+ 		if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
+ 			break;
+