3 files changed, 6 insertions, 5 deletions

diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index 76e9bf88d3b9..0effd3cba9a7 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -1819,7 +1819,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 
         /* Update the icache */
         flush_icache_range((unsigned long)ctx.target,
-                           (unsigned long)(ctx.target + ctx.idx * sizeof(u32)));
+                           (unsigned long)&ctx.target[ctx.idx]);
 
         if (bpf_jit_enable > 1)
                 /* Dump JIT code */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8577bb7f8be6..84470d1480aa 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -559,12 +559,12 @@ static int map_create(union bpf_attr *attr)
         err = bpf_map_new_fd(map, f_flags);
         if (err < 0) {
                 /* failed to allocate fd.
-                 * bpf_map_put() is needed because the above
+                 * bpf_map_put_with_uref() is needed because the above
                  * bpf_map_alloc_id() has published the map
                  * to the userspace and the userspace may
                  * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
                  */
-                bpf_map_put(map);
+                bpf_map_put_with_uref(map);
                 return err;
         }
 
@@ -1986,7 +1986,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
 
         fd = bpf_map_new_fd(map, f_flags);
         if (fd < 0)
-                bpf_map_put(map);
+                bpf_map_put_with_uref(map);
 
         return fd;
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8f295b790297..5fcce2f4209d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6920,7 +6920,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                         u32 off_reg;
 
                         aux = &env->insn_aux_data[i + delta];
-                        if (!aux->alu_state)
+                        if (!aux->alu_state ||
+                            aux->alu_state == BPF_ALU_NON_POINTER)
                                 continue;
 
                         isneg = aux->alu_state & BPF_ALU_NEG_VALUE;