4 files changed, 70 insertions, 15 deletions

diff --git a/runtime/uprobes2/uprobes.c b/runtime/uprobes2/uprobes.c
index af187fc9..07ad3984 100644
--- a/runtime/uprobes2/uprobes.c
+++ b/runtime/uprobes2/uprobes.c
@@ -29,6 +29,12 @@
 #include <linux/utrace.h>
 #include <linux/regset.h>
 #define UPROBES_IMPLEMENTATION 1
+
+/* PR9974: Adapt to struct renaming. */
+#ifdef UTRACE_API_VERSION
+#define utrace_attached_engine utrace_engine
+#endif
+
 #include "uprobes.h"
 #include <linux/tracehook.h>
 #include <linux/mm.h>
@@ -949,10 +955,15 @@ static int defer_registration(struct uprobe *u, int regflag,
  */
 static struct pid *uprobe_get_tg_leader(pid_t p)
 {
-	struct pid *pid;
+	struct pid *pid = NULL;
 
 	rcu_read_lock();
-	pid = find_vpid(p);
+	/*
+	 * We need this check because unmap_u[ret]probe() can be called
+	 * from a report_death callback, where current->proxy is NULL.
+	 */
+	if (current->nsproxy)
+		pid = find_vpid(p);
 	if (pid) {
 		struct task_struct *t = pid_task(pid, PIDTYPE_PID);
 		if (t)
@@ -1132,8 +1143,7 @@ fail_tsk:
 }
 EXPORT_SYMBOL_GPL(register_uprobe);
 
-/* See Documentation/uprobes.txt. */
-void unregister_uprobe(struct uprobe *u)
+void __unregister_uprobe(struct uprobe *u, bool remove_bkpt)
 {
 	struct pid *p;
 	struct uprobe_process *uproc;
@@ -1187,10 +1197,13 @@ void unregister_uprobe(struct uprobe *u)
 	if (!list_empty(&ppt->uprobe_list))
 		goto done;
 
-	/*
-	 * The last uprobe at ppt's probepoint is being unregistered.
-	 * Queue the breakpoint for removal.
-	 */
+	/* The last uprobe at ppt's probepoint is being unregistered. */
+	if (!remove_bkpt) {
+		uprobe_free_probept(ppt);
+		goto done;
+	}
+
+	/* Queue the breakpoint for removal. */
 	ppt->state = UPROBE_REMOVING;
 	list_add_tail(&ppt->pd_node, &uproc->pending_uprobes);
 
@@ -1215,8 +1228,20 @@ done:
 	up_write(&uproc->rwsem);
 	uprobe_put_process(uproc, false);
 }
+
+/* See Documentation/uprobes.txt. */
+void unregister_uprobe(struct uprobe *u)
+{
+	__unregister_uprobe(u, true);
+}
 EXPORT_SYMBOL_GPL(unregister_uprobe);
 
+void unmap_uprobe(struct uprobe *u)
+{
+	__unregister_uprobe(u, false);
+}
+EXPORT_SYMBOL_GPL(unmap_uprobe);
+
 /* Find a surviving thread in uproc.  Runs with uproc->rwsem locked. */
 static struct task_struct *find_surviving_thread(struct uprobe_process *uproc)
 {
@@ -2214,7 +2239,8 @@ static u32 uprobe_report_exit(enum utrace_resume_action action,
 			}
 		}
 		up_read(&uproc->rwsem);
-		if (utask->state == UPTASK_TRAMPOLINE_HIT)
+		if (utask->state == UPTASK_TRAMPOLINE_HIT ||
+						utask->state == UPTASK_BP_HIT)
 			uprobe_decref_process(uproc);
 	}
 
@@ -2712,6 +2738,14 @@ void unregister_uretprobe(struct uretprobe *rp)
 }
 EXPORT_SYMBOL_GPL(unregister_uretprobe);
 
+void unmap_uretprobe(struct uretprobe *rp)
+{
+	if (!rp)
+		return;
+	unmap_uprobe(&rp->u);
+}
+EXPORT_SYMBOL_GPL(unmap_uretprobe);
+
 /*
  * uproc->ssol_area has been successfully set up.  Establish the
  * uretprobe trampoline in the next available slot following the
diff --git a/runtime/uprobes2/uprobes.h b/runtime/uprobes2/uprobes.h
index 11d01f5c..ae0692f0 100644
--- a/runtime/uprobes2/uprobes.h
+++ b/runtime/uprobes2/uprobes.h
@@ -23,6 +23,14 @@
 #include <linux/types.h>
 #include <linux/list.h>
 
+/* Adapt to struct renaming. */
+#ifdef UTRACE_API_VERSION
+#define utrace_attached_engine utrace_engine
+#endif
+
+/* Version 2 includes unmap_u[ret]probe(). */
+#define UPROBES_API_VERSION 2
+
 struct pt_regs;
 
 enum uprobe_type {
@@ -77,6 +85,9 @@ extern void unregister_uprobe(struct uprobe *u);
 /* For runtime, assume uprobes support includes uretprobes. */
 extern int register_uretprobe(struct uretprobe *rp);
 extern void unregister_uretprobe(struct uretprobe *rp);
+/* For PRs 9940, 6852... */
+extern void unmap_uprobe(struct uprobe *u);
+extern void unmap_uretprobe(struct uretprobe *rp);
 
 #ifdef UPROBES_IMPLEMENTATION
 
diff --git a/runtime/uprobes2/uprobes_x86.c b/runtime/uprobes2/uprobes_x86.c
index effb7444..8c80293d 100644
--- a/runtime/uprobes2/uprobes_x86.c
+++ b/runtime/uprobes2/uprobes_x86.c
@@ -50,8 +50,8 @@ static const u64 good_insns_64[256 / 64] = {
 	W(0x50, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 50 */
 	W(0x60, 0,0,0,1,1,1,0,0,1,1,1,1,0,0,0,0)| /* 60 */
 	W(0x70, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* 70 */
-	W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
-	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1)| /* 90 */
+	W(0x80, 1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
+	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
 	W(0xa0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* a0 */
 	W(0xb0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* b0 */
 	W(0xc0, 1,1,1,1,0,0,1,1,1,1,1,1,0,0,0,0)| /* c0 */
@@ -76,7 +76,7 @@ static const u64 good_insns_32[256 / 64] = {
 	W(0x60, 1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,0)| /* 60 */
 	W(0x70, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* 70 */
 	W(0x80, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 80 */
-	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,0,1,1,1,1)| /* 90 */
+	W(0x90, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* 90 */
 	W(0xa0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1)| /* a0 */
 	W(0xb0, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1), /* b0 */
 	W(0xc0, 1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0)| /* c0 */
@@ -124,7 +124,7 @@ static const u64 good_2byte_insns[256 / 64] = {
  * 0f - lar, lsl, syscall, clts, sysret, sysenter, sysexit, invd, wbinvd, ud2
  *
  * invalid opcodes in 64-bit mode:
- * 06, 0e, 16, 1e, 27, 2f, 37, 3f, 60-62, c4-c5, d4-d5
+ * 06, 0e, 16, 1e, 27, 2f, 37, 3f, 60-62, 82, c4-c5, d4-d5
  *
  * 63 - we support this opcode in x86_64 but not in i386.
  * opcodes we may need to refine support for:
@@ -146,7 +146,6 @@ static const u64 good_2byte_insns[256 / 64] = {
  * 26, 2e, 36, 3e - es:, cs:, ss:, ds: segment prefixes --
  * 	but 64 and 65 (fs: and gs:) seem to be used, so we support them
  * 67 - addr16 prefix
- * 9b - wait/fwait
  * ce - into
  * f0 - lock prefix
  */
diff --git a/runtime/uprobes2/uprobes_x86.h b/runtime/uprobes2/uprobes_x86.h
index ca3f4873..a07fa0d3 100644
--- a/runtime/uprobes2/uprobes_x86.h
+++ b/runtime/uprobes2/uprobes_x86.h
@@ -93,11 +93,22 @@ static inline unsigned long arch_get_cur_sp(struct pt_regs *regs)
 	return (unsigned long) regs->sp;
 }
 
+/*
+ * On x86_32, if a function returns a struct or union, the return
+ * value is copied into an area created by the caller.  The address
+ * of this area is passed on the stack as a "hidden" first argument.
+ * When such a function returns, it uses a "ret $4" instruction to pop
+ * not only the return address but also the hidden arg.  To accommodate
+ * such functions, we add 4 bytes of slop when predicting the return
+ * address. See PR #10078.
+ */
+#define STRUCT_RETURN_SLOP 4
+
 static inline unsigned long arch_predict_sp_at_ret(struct pt_regs *regs,
 		struct task_struct *tsk)
 {
 	if (test_tsk_thread_flag(tsk, TIF_IA32))
-		return (unsigned long) (regs->sp + 4);
+		return (unsigned long) (regs->sp + 4 + STRUCT_RETURN_SLOP);
 	else
 		return (unsigned long) (regs->sp + 8);
 }