Merge tag 'v5.2-rc6' into for-5.3/block

Merge 5.2-rc6 into for-5.3/block, so we get the same page merge leak
fix. Otherwise we end up having conflicts with future patches between
for-5.3/block and master that touch this area. In particular, it makes
the bio_full() fix hard to backport to stable.

* tag 'v5.2-rc6': (482 commits)
  Linux 5.2-rc6
  Revert "iommu/vt-d: Fix lock inversion between iommu->lock and device_domain_lock"
  Bluetooth: Fix regression with minimum encryption key size alignment
  tcp: refine memory limit test in tcp_fragment()
  x86/vdso: Prevent segfaults due to hoisted vclock reads
  SUNRPC: Fix a credential refcount leak
  Revert "SUNRPC: Declare RPC timers as TIMER_DEFERRABLE"
  net :sunrpc :clnt :Fix xps refcount imbalance on the error path
  NFS4: Only set creation opendata if O_CREAT
  ARM: 8867/1: vdso: pass --be8 to linker if necessary
  KVM: nVMX: reorganize initial steps of vmx_set_nested_state
  KVM: PPC: Book3S HV: Invalidate ERAT when flushing guest TLB entries
  habanalabs: use u64_to_user_ptr() for reading user pointers
  nfsd: replace Jeff by Chuck as nfsd co-maintainer
  inet: clear num_timeout reqsk_alloc()
  PCI/P2PDMA: Ignore root complex whitelist when an IOMMU is present
  net: mvpp2: debugfs: Add pmap to fs dump
  ipv6: Default fib6_type to RTN_UNICAST when not set
  net: hns3: Fix inconsistent indenting
  net/af_iucv: always register net_device notifier
  ...

1 files changed, 15 insertions, 6 deletions

diff --git a/lib/test_stackinit.c b/lib/test_stackinit.c
index e97dc54b4fdf..2d7d257a430e 100644
--- a/lib/test_stackinit.c
+++ b/lib/test_stackinit.c
@@ -12,7 +12,7 @@
 
 /* Exfiltration buffer. */
 #define MAX_VAR_SIZE    128
-static char check_buf[MAX_VAR_SIZE];
+static u8 check_buf[MAX_VAR_SIZE];
 
 /* Character array to trigger stack protector in all functions. */
 #define VAR_BUFFER       32
@@ -106,9 +106,18 @@ static noinline __init int test_ ## name (void)			\
                                                                 \
         /* Fill clone type with zero for per-field init. */     \
         memset(&zero, 0x00, sizeof(zero));                      \
+        /* Clear entire check buffer for 0xFF overlap test. */  \
+        memset(check_buf, 0x00, sizeof(check_buf));             \
         /* Fill stack with 0xFF. */                             \
         ignored = leaf_ ##name((unsigned long)&ignored, 1,      \
                                 FETCH_ARG_ ## which(zero));     \
+        /* Verify all bytes overwritten with 0xFF. */           \
+        for (sum = 0, i = 0; i < target_size; i++)              \
+                sum += (check_buf[i] != 0xFF);                  \
+        if (sum) {                                              \
+                pr_err(#name ": leaf fill was not 0xFF!?\n");   \
+                return 1;                                       \
+        }                                                       \
         /* Clear entire check buffer for later bit tests. */    \
         memset(check_buf, 0x00, sizeof(check_buf));             \
         /* Extract stack-defined variable contents. */          \
@@ -126,9 +135,9 @@ static noinline __init int test_ ## name (void)			\
                 return 1;                                       \
         }                                                       \
                                                                 \
-        /* Look for any set bits in the check region. */        \
-        for (i = 0; i < sizeof(check_buf); i++)                 \
-                sum += (check_buf[i] != 0);                     \
+        /* Look for any bytes still 0xFF in check region. */    \
+        for (sum = 0, i = 0; i < target_size; i++)              \
+                sum += (check_buf[i] == 0xFF);                  \
                                                                 \
         if (sum == 0)                                           \
                 pr_info(#name " ok\n");                         \
@@ -162,13 +171,13 @@ static noinline __init int leaf_ ## name(unsigned long sp,	\
          * Keep this buffer around to make sure we've got a     \
          * stack frame of SOME kind...                          \
          */                                                     \
-        memset(buf, (char)(sp && 0xff), sizeof(buf));           \
+        memset(buf, (char)(sp & 0xff), sizeof(buf));            \
         /* Fill variable with 0xFF. */                          \
         if (fill) {                                             \
                 fill_start = &var;                              \
                 fill_size = sizeof(var);                        \
                 memset(fill_start,                              \
-                       (char)((sp && 0xff) | forced_mask),      \
+                       (char)((sp & 0xff) | forced_mask),       \
                        fill_size);                              \
         }                                                       \
                                                                 \