Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
pull-request: bpf 2019-07-03

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Fix the interpreter to properly handle BPF_ALU32 | BPF_ARSH
   on BE architectures, from Jiong.

2) Fix several bugs in the x32 BPF JIT for handling shifts by 0,
   from Luke and Xi.

3) Fix NULL pointer deref in btf_type_is_resolve_source_only(),
   from Stanislav.

4) Properly handle the check that forwarding is enabled on the device
   in bpf_ipv6_fib_lookup() helper code, from Anton.

5) Fix UAPI bpf_prog_info fields alignment for archs that have 16 bit
   alignment such as m68k, from Baruch.

6) Fix kernel hanging in unregister_netdevice loop while unregistering
   device bound to XDP socket, from Ilya.

7) Properly terminate tail update in xskq_produce_flush_desc(), from Nathan.

8) Fix broken always_inline handling in test_lwt_seg6local, from Jiri.

9) Fix bpftool to use correct argument in cgroup errors, from Jakub.

10) Fix detaching dummy prog in XDP redirect sample code, from Prashant.

11) Add Jonathan to AF_XDP reviewers, from Björn.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

16 files changed, 230 insertions, 296 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 3c4d72755127..54691cc484da 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -17274,6 +17274,7 @@ N:	xdp
 XDP SOCKETS (AF_XDP)
 M:      Björn Töpel <bjorn.topel@intel.com>
 M:      Magnus Karlsson <magnus.karlsson@intel.com>
+R:      Jonathan Lemon <jonathan.lemon@gmail.com>
 L:      netdev@vger.kernel.org
 L:      bpf@vger.kernel.org
 S:      Maintained
diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index b29e82f190c7..1d12d2174085 100644
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -724,9 +724,6 @@ static inline void emit_ia32_lsh_r64(const u8 dst[], const u8 src[],
 {
         u8 *prog = *pprog;
         int cnt = 0;
-        static int jmp_label1 = -1;
-        static int jmp_label2 = -1;
-        static int jmp_label3 = -1;
         u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
         u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
 
@@ -745,79 +742,23 @@ static inline void emit_ia32_lsh_r64(const u8 dst[], const u8 src[],
                 /* mov ecx,src_lo */
                 EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
 
-        /* cmp ecx,32 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
-        /* Jumps when >= 32 */
-        if (is_imm8(jmp_label(jmp_label1, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
-
-        /* < 32 */
-        /* shl dreg_hi,cl */
-        EMIT2(0xD3, add_1reg(0xE0, dreg_hi));
-        /* mov ebx,dreg_lo */
-        EMIT2(0x8B, add_2reg(0xC0, dreg_lo, IA32_EBX));
+        /* shld dreg_hi,dreg_lo,cl */
+        EMIT3(0x0F, 0xA5, add_2reg(0xC0, dreg_hi, dreg_lo));
         /* shl dreg_lo,cl */
         EMIT2(0xD3, add_1reg(0xE0, dreg_lo));
 
-        /* IA32_ECX = -IA32_ECX + 32 */
-        /* neg ecx */
-        EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-        /* add ecx,32 */
-        EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+        /* if ecx >= 32, mov dreg_lo into dreg_hi and clear dreg_lo */
 
-        /* shr ebx,cl */
-        EMIT2(0xD3, add_1reg(0xE8, IA32_EBX));
-        /* or dreg_hi,ebx */
-        EMIT2(0x09, add_2reg(0xC0, dreg_hi, IA32_EBX));
-
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
-
-        /* >= 32 */
-        if (jmp_label1 == -1)
-                jmp_label1 = cnt;
-
-        /* cmp ecx,64 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
-        /* Jumps when >= 64 */
-        if (is_imm8(jmp_label(jmp_label2, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
+        /* cmp ecx,32 */
+        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+        /* skip the next two instructions (4 bytes) when < 32 */
+        EMIT2(IA32_JB, 4);
 
-        /* >= 32 && < 64 */
-        /* sub ecx,32 */
-        EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
-        /* shl dreg_lo,cl */
-        EMIT2(0xD3, add_1reg(0xE0, dreg_lo));
         /* mov dreg_hi,dreg_lo */
         EMIT2(0x89, add_2reg(0xC0, dreg_hi, dreg_lo));
-
         /* xor dreg_lo,dreg_lo */
         EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
 
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
-
-        /* >= 64 */
-        if (jmp_label2 == -1)
-                jmp_label2 = cnt;
-        /* xor dreg_lo,dreg_lo */
-        EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
-        /* xor dreg_hi,dreg_hi */
-        EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
-
-        if (jmp_label3 == -1)
-                jmp_label3 = cnt;
-
         if (dstk) {
                 /* mov dword ptr [ebp+off],dreg_lo */
                 EMIT3(0x89, add_2reg(0x40, IA32_EBP, dreg_lo),
@@ -836,9 +777,6 @@ static inline void emit_ia32_arsh_r64(const u8 dst[], const u8 src[],
 {
         u8 *prog = *pprog;
         int cnt = 0;
-        static int jmp_label1 = -1;
-        static int jmp_label2 = -1;
-        static int jmp_label3 = -1;
         u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
         u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
 
@@ -857,79 +795,23 @@ static inline void emit_ia32_arsh_r64(const u8 dst[], const u8 src[],
                 /* mov ecx,src_lo */
                 EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
 
-        /* cmp ecx,32 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
-        /* Jumps when >= 32 */
-        if (is_imm8(jmp_label(jmp_label1, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
-
-        /* < 32 */
-        /* lshr dreg_lo,cl */
-        EMIT2(0xD3, add_1reg(0xE8, dreg_lo));
-        /* mov ebx,dreg_hi */
-        EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
-        /* ashr dreg_hi,cl */
+        /* shrd dreg_lo,dreg_hi,cl */
+        EMIT3(0x0F, 0xAD, add_2reg(0xC0, dreg_lo, dreg_hi));
+        /* sar dreg_hi,cl */
         EMIT2(0xD3, add_1reg(0xF8, dreg_hi));
 
-        /* IA32_ECX = -IA32_ECX + 32 */
-        /* neg ecx */
-        EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-        /* add ecx,32 */
-        EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
-
-        /* shl ebx,cl */
-        EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
-        /* or dreg_lo,ebx */
-        EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
+        /* if ecx >= 32, mov dreg_hi to dreg_lo and set/clear dreg_hi depending on sign */
 
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
-
-        /* >= 32 */
-        if (jmp_label1 == -1)
-                jmp_label1 = cnt;
-
-        /* cmp ecx,64 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
-        /* Jumps when >= 64 */
-        if (is_imm8(jmp_label(jmp_label2, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
+        /* cmp ecx,32 */
+        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+        /* skip the next two instructions (5 bytes) when < 32 */
+        EMIT2(IA32_JB, 5);
 
-        /* >= 32 && < 64 */
-        /* sub ecx,32 */
-        EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
-        /* ashr dreg_hi,cl */
-        EMIT2(0xD3, add_1reg(0xF8, dreg_hi));
         /* mov dreg_lo,dreg_hi */
         EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
-
-        /* ashr dreg_hi,imm8 */
+        /* sar dreg_hi,31 */
         EMIT3(0xC1, add_1reg(0xF8, dreg_hi), 31);
 
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
-
-        /* >= 64 */
-        if (jmp_label2 == -1)
-                jmp_label2 = cnt;
-        /* ashr dreg_hi,imm8 */
-        EMIT3(0xC1, add_1reg(0xF8, dreg_hi), 31);
-        /* mov dreg_lo,dreg_hi */
-        EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
-
-        if (jmp_label3 == -1)
-                jmp_label3 = cnt;
-
         if (dstk) {
                 /* mov dword ptr [ebp+off],dreg_lo */
                 EMIT3(0x89, add_2reg(0x40, IA32_EBP, dreg_lo),
@@ -948,9 +830,6 @@ static inline void emit_ia32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
 {
         u8 *prog = *pprog;
         int cnt = 0;
-        static int jmp_label1 = -1;
-        static int jmp_label2 = -1;
-        static int jmp_label3 = -1;
         u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
         u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
 
@@ -969,77 +848,23 @@ static inline void emit_ia32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
                 /* mov ecx,src_lo */
                 EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
 
-        /* cmp ecx,32 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
-        /* Jumps when >= 32 */
-        if (is_imm8(jmp_label(jmp_label1, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
-
-        /* < 32 */
-        /* lshr dreg_lo,cl */
-        EMIT2(0xD3, add_1reg(0xE8, dreg_lo));
-        /* mov ebx,dreg_hi */
-        EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
+        /* shrd dreg_lo,dreg_hi,cl */
+        EMIT3(0x0F, 0xAD, add_2reg(0xC0, dreg_lo, dreg_hi));
         /* shr dreg_hi,cl */
         EMIT2(0xD3, add_1reg(0xE8, dreg_hi));
 
-        /* IA32_ECX = -IA32_ECX + 32 */
-        /* neg ecx */
-        EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-        /* add ecx,32 */
-        EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
-
-        /* shl ebx,cl */
-        EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
-        /* or dreg_lo,ebx */
-        EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
-
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+        /* if ecx >= 32, mov dreg_hi to dreg_lo and clear dreg_hi */
 
-        /* >= 32 */
-        if (jmp_label1 == -1)
-                jmp_label1 = cnt;
-        /* cmp ecx,64 */
-        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
-        /* Jumps when >= 64 */
-        if (is_imm8(jmp_label(jmp_label2, 2)))
-                EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
-        else
-                EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
+        /* cmp ecx,32 */
+        EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+        /* skip the next two instructions (4 bytes) when < 32 */
+        EMIT2(IA32_JB, 4);
 
-        /* >= 32 && < 64 */
-        /* sub ecx,32 */
-        EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
-        /* shr dreg_hi,cl */
-        EMIT2(0xD3, add_1reg(0xE8, dreg_hi));
         /* mov dreg_lo,dreg_hi */
         EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
         /* xor dreg_hi,dreg_hi */
         EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
 
-        /* goto out; */
-        if (is_imm8(jmp_label(jmp_label3, 2)))
-                EMIT2(0xEB, jmp_label(jmp_label3, 2));
-        else
-                EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
-
-        /* >= 64 */
-        if (jmp_label2 == -1)
-                jmp_label2 = cnt;
-        /* xor dreg_lo,dreg_lo */
-        EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
-        /* xor dreg_hi,dreg_hi */
-        EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
-
-        if (jmp_label3 == -1)
-                jmp_label3 = cnt;
-
         if (dstk) {
                 /* mov dword ptr [ebp+off],dreg_lo */
                 EMIT3(0x89, add_2reg(0x40, IA32_EBP, dreg_lo),
@@ -1069,27 +894,10 @@ static inline void emit_ia32_lsh_i64(const u8 dst[], const u32 val,
         }
         /* Do LSH operation */
         if (val < 32) {
-                /* shl dreg_hi,imm8 */
-                EMIT3(0xC1, add_1reg(0xE0, dreg_hi), val);
-                /* mov ebx,dreg_lo */
-                EMIT2(0x8B, add_2reg(0xC0, dreg_lo, IA32_EBX));
+                /* shld dreg_hi,dreg_lo,imm8 */
+                EMIT4(0x0F, 0xA4, add_2reg(0xC0, dreg_hi, dreg_lo), val);
                 /* shl dreg_lo,imm8 */
                 EMIT3(0xC1, add_1reg(0xE0, dreg_lo), val);
-
-                /* IA32_ECX = 32 - val */
-                /* mov ecx,val */
-                EMIT2(0xB1, val);
-                /* movzx ecx,ecx */
-                EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
-                /* neg ecx */
-                EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-                /* add ecx,32 */
-                EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
-
-                /* shr ebx,cl */
-                EMIT2(0xD3, add_1reg(0xE8, IA32_EBX));
-                /* or dreg_hi,ebx */
-                EMIT2(0x09, add_2reg(0xC0, dreg_hi, IA32_EBX));
         } else if (val >= 32 && val < 64) {
                 u32 value = val - 32;
 
@@ -1135,27 +943,10 @@ static inline void emit_ia32_rsh_i64(const u8 dst[], const u32 val,
 
         /* Do RSH operation */
         if (val < 32) {
-                /* shr dreg_lo,imm8 */
-                EMIT3(0xC1, add_1reg(0xE8, dreg_lo), val);
-                /* mov ebx,dreg_hi */
-                EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
+                /* shrd dreg_lo,dreg_hi,imm8 */
+                EMIT4(0x0F, 0xAC, add_2reg(0xC0, dreg_lo, dreg_hi), val);
                 /* shr dreg_hi,imm8 */
                 EMIT3(0xC1, add_1reg(0xE8, dreg_hi), val);
-
-                /* IA32_ECX = 32 - val */
-                /* mov ecx,val */
-                EMIT2(0xB1, val);
-                /* movzx ecx,ecx */
-                EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
-                /* neg ecx */
-                EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-                /* add ecx,32 */
-                EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
-
-                /* shl ebx,cl */
-                EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
-                /* or dreg_lo,ebx */
-                EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
         } else if (val >= 32 && val < 64) {
                 u32 value = val - 32;
 
@@ -1200,27 +991,10 @@ static inline void emit_ia32_arsh_i64(const u8 dst[], const u32 val,
         }
         /* Do RSH operation */
         if (val < 32) {
-                /* shr dreg_lo,imm8 */
-                EMIT3(0xC1, add_1reg(0xE8, dreg_lo), val);
-                /* mov ebx,dreg_hi */
-                EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
+                /* shrd dreg_lo,dreg_hi,imm8 */
+                EMIT4(0x0F, 0xAC, add_2reg(0xC0, dreg_lo, dreg_hi), val);
                 /* ashr dreg_hi,imm8 */
                 EMIT3(0xC1, add_1reg(0xF8, dreg_hi), val);
-
-                /* IA32_ECX = 32 - val */
-                /* mov ecx,val */
-                EMIT2(0xB1, val);
-                /* movzx ecx,ecx */
-                EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
-                /* neg ecx */
-                EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
-                /* add ecx,32 */
-                EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
-
-                /* shl ebx,cl */
-                EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
-                /* or dreg_lo,ebx */
-                EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
         } else if (val >= 32 && val < 64) {
                 u32 value = val - 32;
 
diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
index d074b6d60f8a..7da155164947 100644
--- a/include/net/xdp_sock.h
+++ b/include/net/xdp_sock.h
@@ -61,6 +61,11 @@ struct xdp_sock {
         struct xsk_queue *tx ____cacheline_aligned_in_smp;
         struct list_head list;
         bool zc;
+        enum {
+                XSK_READY = 0,
+                XSK_BOUND,
+                XSK_UNBOUND,
+        } state;
         /* Protects multiple processes in the control path */
         struct mutex mutex;
         /* Mutual exclusion of NAPI TX thread and sendmsg error paths
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index a8b823c30b43..29a5bc3d5c66 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3143,6 +3143,7 @@ struct bpf_prog_info {
         char name[BPF_OBJ_NAME_LEN];
         __u32 ifindex;
         __u32 gpl_compatible:1;
+        __u32 :31; /* alignment pad */
         __u64 netns_dev;
         __u64 netns_ino;
         __u32 nr_jited_ksyms;
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index cad09858a5f2..546ebee39e2a 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1928,8 +1928,8 @@ static int btf_array_resolve(struct btf_verifier_env *env,
         /* Check array->index_type */
         index_type_id = array->index_type;
         index_type = btf_type_by_id(btf, index_type_id);
-        if (btf_type_is_resolve_source_only(index_type) ||
-            btf_type_nosize_or_null(index_type)) {
+        if (btf_type_nosize_or_null(index_type) ||
+            btf_type_is_resolve_source_only(index_type)) {
                 btf_verifier_log_type(env, v->t, "Invalid index");
                 return -EINVAL;
         }
@@ -1948,8 +1948,8 @@ static int btf_array_resolve(struct btf_verifier_env *env,
         /* Check array->type */
         elem_type_id = array->type;
         elem_type = btf_type_by_id(btf, elem_type_id);
-        if (btf_type_is_resolve_source_only(elem_type) ||
-            btf_type_nosize_or_null(elem_type)) {
+        if (btf_type_nosize_or_null(elem_type) ||
+            btf_type_is_resolve_source_only(elem_type)) {
                 btf_verifier_log_type(env, v->t,
                                       "Invalid elem");
                 return -EINVAL;
@@ -2170,8 +2170,8 @@ static int btf_struct_resolve(struct btf_verifier_env *env,
                 const struct btf_type *member_type = btf_type_by_id(env->btf,
                                                                 member_type_id);
 
-                if (btf_type_is_resolve_source_only(member_type) ||
-                    btf_type_nosize_or_null(member_type)) {
+                if (btf_type_nosize_or_null(member_type) ||
+                    btf_type_is_resolve_source_only(member_type)) {
                         btf_verifier_log_member(env, v->t, member,
                                                 "Invalid member");
                         return -EINVAL;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 080e2bb644cc..f2148db91439 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1364,10 +1364,10 @@ select_insn:
                 insn++;
                 CONT;
         ALU_ARSH_X:
-                DST = (u64) (u32) ((*(s32 *) &DST) >> SRC);
+                DST = (u64) (u32) (((s32) DST) >> SRC);
                 CONT;
         ALU_ARSH_K:
-                DST = (u64) (u32) ((*(s32 *) &DST) >> IMM);
+                DST = (u64) (u32) (((s32) DST) >> IMM);
                 CONT;
         ALU64_ARSH_X:
                 (*(s64 *) &DST) >>= SRC;
diff --git a/net/core/filter.c b/net/core/filter.c
index f615e42cf4ef..3fdf1b21be36 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4737,7 +4737,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
                 return -ENODEV;
 
         idev = __in6_dev_get_safely(dev);
-        if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
+        if (unlikely(!idev || !idev->cnf.forwarding))
                 return BPF_FIB_LKUP_RET_FWD_DISABLED;
 
         if (flags & BPF_FIB_LOOKUP_OUTPUT) {
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 9c6de4f114f8..20c91f02d3d8 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -105,6 +105,9 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
 
         umem->dev = dev;
         umem->queue_id = queue_id;
+
+        dev_hold(dev);
+
         if (force_copy)
                 /* For copy-mode, we are done. */
                 goto out_rtnl_unlock;
@@ -124,7 +127,6 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
                 goto err_unreg_umem;
         rtnl_unlock();
 
-        dev_hold(dev);
         umem->zc = true;
         return 0;
 
@@ -138,11 +140,13 @@ out_rtnl_unlock:
         return err;
 }
 
-static void xdp_umem_clear_dev(struct xdp_umem *umem)
+void xdp_umem_clear_dev(struct xdp_umem *umem)
 {
         struct netdev_bpf bpf;
         int err;
 
+        ASSERT_RTNL();
+
         if (!umem->dev)
                 return;
 
@@ -151,22 +155,17 @@ static void xdp_umem_clear_dev(struct xdp_umem *umem)
                 bpf.xsk.umem = NULL;
                 bpf.xsk.queue_id = umem->queue_id;
 
-                rtnl_lock();
                 err = umem->dev->netdev_ops->ndo_bpf(umem->dev, &bpf);
-                rtnl_unlock();
 
                 if (err)
                         WARN(1, "failed to disable umem!\n");
         }
 
-        rtnl_lock();
         xdp_clear_umem_at_qid(umem->dev, umem->queue_id);
-        rtnl_unlock();
 
-        if (umem->zc) {
-                dev_put(umem->dev);
-                umem->zc = false;
-        }
+        dev_put(umem->dev);
+        umem->dev = NULL;
+        umem->zc = false;
 }
 
 static void xdp_umem_unpin_pages(struct xdp_umem *umem)
@@ -194,7 +193,9 @@ static void xdp_umem_unaccount_pages(struct xdp_umem *umem)
 
 static void xdp_umem_release(struct xdp_umem *umem)
 {
+        rtnl_lock();
         xdp_umem_clear_dev(umem);
+        rtnl_unlock();
 
         ida_simple_remove(&umem_ida, umem->id);
 
diff --git a/net/xdp/xdp_umem.h b/net/xdp/xdp_umem.h
index 27603227601b..a63a9fb251f5 100644
--- a/net/xdp/xdp_umem.h
+++ b/net/xdp/xdp_umem.h
@@ -10,6 +10,7 @@
 
 int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
                         u16 queue_id, u16 flags);
+void xdp_umem_clear_dev(struct xdp_umem *umem);
 bool xdp_umem_validate_queues(struct xdp_umem *umem);
 void xdp_get_umem(struct xdp_umem *umem);
 void xdp_put_umem(struct xdp_umem *umem);
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index a14e8864e4fa..f53a6ef7c155 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -335,6 +335,22 @@ static int xsk_init_queue(u32 entries, struct xsk_queue **queue,
         return 0;
 }
 
+static void xsk_unbind_dev(struct xdp_sock *xs)
+{
+        struct net_device *dev = xs->dev;
+
+        if (!dev || xs->state != XSK_BOUND)
+                return;
+
+        xs->state = XSK_UNBOUND;
+
+        /* Wait for driver to stop using the xdp socket. */
+        xdp_del_sk_umem(xs->umem, xs);
+        xs->dev = NULL;
+        synchronize_net();
+        dev_put(dev);
+}
+
 static int xsk_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -354,15 +370,7 @@ static int xsk_release(struct socket *sock)
         sock_prot_inuse_add(net, sk->sk_prot, -1);
         local_bh_enable();
 
-        if (xs->dev) {
-                struct net_device *dev = xs->dev;
-
-                /* Wait for driver to stop using the xdp socket. */
-                xdp_del_sk_umem(xs->umem, xs);
-                xs->dev = NULL;
-                synchronize_net();
-                dev_put(dev);
-        }
+        xsk_unbind_dev(xs);
 
         xskq_destroy(xs->rx);
         xskq_destroy(xs->tx);
@@ -412,7 +420,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
                 return -EINVAL;
 
         mutex_lock(&xs->mutex);
-        if (xs->dev) {
+        if (xs->state != XSK_READY) {
                 err = -EBUSY;
                 goto out_release;
         }
@@ -492,6 +500,8 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 out_unlock:
         if (err)
                 dev_put(dev);
+        else
+                xs->state = XSK_BOUND;
 out_release:
         mutex_unlock(&xs->mutex);
         return err;
@@ -520,6 +530,10 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
                         return -EFAULT;
 
                 mutex_lock(&xs->mutex);
+                if (xs->state != XSK_READY) {
+                        mutex_unlock(&xs->mutex);
+                        return -EBUSY;
+                }
                 q = (optname == XDP_TX_RING) ? &xs->tx : &xs->rx;
                 err = xsk_init_queue(entries, q, false);
                 mutex_unlock(&xs->mutex);
@@ -534,7 +548,7 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
                         return -EFAULT;
 
                 mutex_lock(&xs->mutex);
-                if (xs->umem) {
+                if (xs->state != XSK_READY || xs->umem) {
                         mutex_unlock(&xs->mutex);
                         return -EBUSY;
                 }
@@ -561,6 +575,10 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
                         return -EFAULT;
 
                 mutex_lock(&xs->mutex);
+                if (xs->state != XSK_READY) {
+                        mutex_unlock(&xs->mutex);
+                        return -EBUSY;
+                }
                 if (!xs->umem) {
                         mutex_unlock(&xs->mutex);
                         return -EINVAL;
@@ -662,6 +680,9 @@ static int xsk_mmap(struct file *file, struct socket *sock,
         unsigned long pfn;
         struct page *qpg;
 
+        if (xs->state != XSK_READY)
+                return -EBUSY;
+
         if (offset == XDP_PGOFF_RX_RING) {
                 q = READ_ONCE(xs->rx);
         } else if (offset == XDP_PGOFF_TX_RING) {
@@ -693,6 +714,38 @@ static int xsk_mmap(struct file *file, struct socket *sock,
                                size, vma->vm_page_prot);
 }
 
+static int xsk_notifier(struct notifier_block *this,
+                        unsigned long msg, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct net *net = dev_net(dev);
+        struct sock *sk;
+
+        switch (msg) {
+        case NETDEV_UNREGISTER:
+                mutex_lock(&net->xdp.lock);
+                sk_for_each(sk, &net->xdp.list) {
+                        struct xdp_sock *xs = xdp_sk(sk);
+
+                        mutex_lock(&xs->mutex);
+                        if (xs->dev == dev) {
+                                sk->sk_err = ENETDOWN;
+                                if (!sock_flag(sk, SOCK_DEAD))
+                                        sk->sk_error_report(sk);
+
+                                xsk_unbind_dev(xs);
+
+                                /* Clear device references in umem. */
+                                xdp_umem_clear_dev(xs->umem);
+                        }
+                        mutex_unlock(&xs->mutex);
+                }
+                mutex_unlock(&net->xdp.lock);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
 static struct proto xsk_proto = {
         .name =         "XDP",
         .owner =        THIS_MODULE,
@@ -764,6 +817,7 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
         sock_set_flag(sk, SOCK_RCU_FREE);
 
         xs = xdp_sk(sk);
+        xs->state = XSK_READY;
         mutex_init(&xs->mutex);
         spin_lock_init(&xs->tx_completion_lock);
 
@@ -784,6 +838,10 @@ static const struct net_proto_family xsk_family_ops = {
         .owner  = THIS_MODULE,
 };
 
+static struct notifier_block xsk_netdev_notifier = {
+        .notifier_call  = xsk_notifier,
+};
+
 static int __net_init xsk_net_init(struct net *net)
 {
         mutex_init(&net->xdp.lock);
@@ -816,8 +874,15 @@ static int __init xsk_init(void)
         err = register_pernet_subsys(&xsk_net_ops);
         if (err)
                 goto out_sk;
+
+        err = register_netdevice_notifier(&xsk_netdev_notifier);
+        if (err)
+                goto out_pernet;
+
         return 0;
 
+out_pernet:
+        unregister_pernet_subsys(&xsk_net_ops);
 out_sk:
         sock_unregister(PF_XDP);
 out_proto:
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 88b9ae24658d..cba4a640d5e8 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -288,7 +288,7 @@ static inline void xskq_produce_flush_desc(struct xsk_queue *q)
         /* Order producer and data */
         smp_wmb(); /* B, matches C */
 
-        q->prod_tail = q->prod_head,
+        q->prod_tail = q->prod_head;
         WRITE_ONCE(q->ring->producer, q->prod_tail);
 }
 
diff --git a/samples/bpf/xdp_redirect_user.c b/samples/bpf/xdp_redirect_user.c
index 09747bee6668..003c0c6e38c5 100644
--- a/samples/bpf/xdp_redirect_user.c
+++ b/samples/bpf/xdp_redirect_user.c
@@ -189,7 +189,7 @@ int main(int argc, char **argv)
         }
 
         memset(&info, 0, sizeof(info));
-        ret = bpf_obj_get_info_by_fd(prog_fd, &info, &info_len);
+        ret = bpf_obj_get_info_by_fd(dummy_prog_fd, &info, &info_len);
         if (ret) {
                 printf("can't get prog info - %s\n", strerror(errno));
                 return ret;
diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index 73ec8ea33fb4..a13fb7265d1a 100644
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -168,7 +168,7 @@ static int do_show(int argc, char **argv)
 
         cgroup_fd = open(argv[0], O_RDONLY);
         if (cgroup_fd < 0) {
-                p_err("can't open cgroup %s", argv[1]);
+                p_err("can't open cgroup %s", argv[0]);
                 goto exit;
         }
 
@@ -356,7 +356,7 @@ static int do_attach(int argc, char **argv)
 
         cgroup_fd = open(argv[0], O_RDONLY);
         if (cgroup_fd < 0) {
-                p_err("can't open cgroup %s", argv[1]);
+                p_err("can't open cgroup %s", argv[0]);
                 goto exit;
         }
 
@@ -414,7 +414,7 @@ static int do_detach(int argc, char **argv)
 
         cgroup_fd = open(argv[0], O_RDONLY);
         if (cgroup_fd < 0) {
-                p_err("can't open cgroup %s", argv[1]);
+                p_err("can't open cgroup %s", argv[0]);
                 goto exit;
         }
 
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index a8b823c30b43..29a5bc3d5c66 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3143,6 +3143,7 @@ struct bpf_prog_info {
         char name[BPF_OBJ_NAME_LEN];
         __u32 ifindex;
         __u32 gpl_compatible:1;
+        __u32 :31; /* alignment pad */
         __u64 netns_dev;
         __u64 netns_ino;
         __u32 nr_jited_ksyms;
diff --git a/tools/testing/selftests/bpf/progs/test_lwt_seg6local.c b/tools/testing/selftests/bpf/progs/test_lwt_seg6local.c
index 0575751bc1bc..e2f6ed0a583d 100644
--- a/tools/testing/selftests/bpf/progs/test_lwt_seg6local.c
+++ b/tools/testing/selftests/bpf/progs/test_lwt_seg6local.c
@@ -61,7 +61,7 @@ struct sr6_tlv_t {
         unsigned char value[0];
 } BPF_PACKET_HEADER;
 
-__attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
+static __always_inline struct ip6_srh_t *get_srh(struct __sk_buff *skb)
 {
         void *cursor, *data_end;
         struct ip6_srh_t *srh;
@@ -95,7 +95,7 @@ __attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
         return srh;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
                    uint32_t old_pad, uint32_t pad_off)
 {
@@ -125,7 +125,7 @@ int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
         return 0;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
                           uint32_t *tlv_off, uint32_t *pad_size,
                           uint32_t *pad_off)
@@ -184,7 +184,7 @@ int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
         return 0;
 }
 
-__attribute__((always_inline))
+static __always_inline
 int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
             struct sr6_tlv_t *itlv, uint8_t tlv_size)
 {
@@ -228,7 +228,7 @@ int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
         return update_tlv_pad(skb, new_pad, pad_size, pad_off);
 }
 
-__attribute__((always_inline))
+static __always_inline
 int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
                uint32_t tlv_off)
 {
@@ -266,7 +266,7 @@ int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
         return update_tlv_pad(skb, new_pad, pad_size, pad_off);
 }
 
-__attribute__((always_inline))
+static __always_inline
 int has_egr_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh)
 {
         int tlv_offset = sizeof(struct ip6_t) + sizeof(struct ip6_srh_t) +
diff --git a/tools/testing/selftests/bpf/verifier/basic_instr.c b/tools/testing/selftests/bpf/verifier/basic_instr.c
index ed91a7b9a456..071dbc889e8c 100644
--- a/tools/testing/selftests/bpf/verifier/basic_instr.c
+++ b/tools/testing/selftests/bpf/verifier/basic_instr.c
@@ -91,6 +91,91 @@
         .result = ACCEPT,
 },
 {
+        "lsh64 by 0 imm",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 1),
+        BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 0),
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
+        "rsh64 by 0 imm",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 0x100000000LL),
+        BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
+        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 0),
+        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
+        "arsh64 by 0 imm",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 0x100000000LL),
+        BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
+        BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 0),
+        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
+        "lsh64 by 0 reg",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 1),
+        BPF_LD_IMM64(BPF_REG_2, 0),
+        BPF_ALU64_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
+        BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
+        "rsh64 by 0 reg",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 0x100000000LL),
+        BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
+        BPF_LD_IMM64(BPF_REG_3, 0),
+        BPF_ALU64_REG(BPF_RSH, BPF_REG_1, BPF_REG_3),
+        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
+        "arsh64 by 0 reg",
+        .insns = {
+        BPF_LD_IMM64(BPF_REG_0, 1),
+        BPF_LD_IMM64(BPF_REG_1, 0x100000000LL),
+        BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
+        BPF_LD_IMM64(BPF_REG_3, 0),
+        BPF_ALU64_REG(BPF_ARSH, BPF_REG_1, BPF_REG_3),
+        BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
+        BPF_MOV64_IMM(BPF_REG_0, 2),
+        BPF_EXIT_INSN(),
+        },
+        .result = ACCEPT,
+        .retval = 1,
+},
+{
         "invalid 64-bit BPF_END",
         .insns = {
         BPF_MOV32_IMM(BPF_REG_0, 0),