Josh Boyer e8d34e0
The split-out series is available in the git repository at: 
Josh Boyer e8d34e0
Josh Boyer e8d34e0
  git://fedorapeople.org/home/fedora/aarapov/public_git/kernel-uprobes.git tags/rawhide_exported
Josh Boyer e8d34e0
Josh Boyer e8d34e0
Ananth N Mavinakayanahalli (1):
Josh Boyer e8d34e0
      uprobes: Pass probed vaddr to arch_uprobe_analyze_insn()
Josh Boyer e8d34e0
Josh Boyer e8d34e0
Josh Stone (1):
Josh Boyer e8d34e0
      uprobes: add exports necessary for uprobes use by modules
Josh Boyer e8d34e0
Josh Boyer e8d34e0
Oleg Nesterov (21):
Josh Boyer e8d34e0
      uprobes: Optimize is_swbp_at_addr() for current->mm
Josh Boyer e8d34e0
      uprobes: Change read_opcode() to use FOLL_FORCE
Josh Boyer e8d34e0
      uprobes: Introduce find_active_uprobe() helper
Josh Boyer e8d34e0
      uprobes: Teach find_active_uprobe() to provide the "is_swbp" info
Josh Boyer e8d34e0
      uprobes: Change register_for_each_vma() to take mm->mmap_sem for writing
Josh Boyer e8d34e0
      uprobes: Teach handle_swbp() to rely on "is_swbp" rather than uprobes_srcu
Josh Boyer e8d34e0
      uprobes: Kill uprobes_srcu/uprobe_srcu_id
Josh Boyer e8d34e0
      uprobes: Valid_vma() should reject VM_HUGETLB
Josh Boyer e8d34e0
      uprobes: __copy_insn() should ensure a_ops->readpage != NULL
Josh Boyer e8d34e0
      uprobes: Write_opcode()->__replace_page() can race with try_to_unmap()
Josh Boyer e8d34e0
      uprobes: Install_breakpoint() should fail if is_swbp_insn() == T
Josh Boyer e8d34e0
      uprobes: Rework register_for_each_vma() to make it O(n)
Josh Boyer e8d34e0
      uprobes: Change build_map_info() to try kmalloc(GFP_NOWAIT) first
Josh Boyer e8d34e0
      uprobes: Copy_insn() shouldn't depend on mm/vma/vaddr
Josh Boyer e8d34e0
      uprobes: Copy_insn() should not return -ENOMEM if __copy_insn() fails
Josh Boyer e8d34e0
      uprobes: No need to re-check vma_address() in write_opcode()
Josh Boyer e8d34e0
      uprobes: Simplify the usage of uprobe->pending_list
Josh Boyer e8d34e0
      uprobes: Don't use loff_t for the valid virtual address
Josh Boyer e8d34e0
      uprobes: __copy_insn() needs "loff_t offset"
Josh Boyer e8d34e0
      uprobes: Remove the unnecessary initialization in add_utask()
Josh Boyer e8d34e0
      uprobes: Move BUG_ON(UPROBE_SWBP_INSN_SIZE) from write_opcode() to install_breakpoint()
Josh Boyer e8d34e0
Josh Boyer e8d34e0
Peter Zijlstra (1):
Josh Boyer e8d34e0
      uprobes: Document uprobe_register() vs uprobe_mmap() race
Josh Boyer e8d34e0
Josh Boyer e8d34e0
Signed-off-by: Anton Arapov <anton@redhat.com>
Josh Boyer e8d34e0
---
Josh Boyer e8d34e0
 arch/x86/include/asm/uprobes.h |    2 +-
Josh Boyer e8d34e0
 arch/x86/kernel/ptrace.c       |    6 +
Josh Boyer e8d34e0
 arch/x86/kernel/uprobes.c      |    3 +-
Josh Boyer e8d34e0
 include/linux/sched.h          |    1 -
Josh Boyer e8d34e0
 kernel/events/uprobes.c        |  464 ++++++++++++++++++++--------------------
Josh Boyer e8d34e0
 5 files changed, 240 insertions(+), 236 deletions(-)
Josh Boyer e8d34e0
Josh Boyer e8d34e0
diff --git a/arch/x86/include/asm/uprobes.h b/arch/x86/include/asm/uprobes.h
Josh Boyer e8d34e0
index 1e9bed1..f3971bb 100644
Josh Boyer e8d34e0
--- a/arch/x86/include/asm/uprobes.h
Josh Boyer e8d34e0
+++ b/arch/x86/include/asm/uprobes.h
Josh Boyer e8d34e0
@@ -48,7 +48,7 @@ struct arch_uprobe_task {
Josh Boyer e8d34e0
 #endif
Josh Boyer e8d34e0
 };
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-extern int  arch_uprobe_analyze_insn(struct arch_uprobe *aup, struct mm_struct *mm);
Josh Boyer e8d34e0
+extern int  arch_uprobe_analyze_insn(struct arch_uprobe *aup, struct mm_struct *mm, unsigned long addr);
Josh Boyer e8d34e0
 extern int  arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs);
Josh Boyer e8d34e0
 extern int  arch_uprobe_post_xol(struct arch_uprobe *aup, struct pt_regs *regs);
Josh Boyer e8d34e0
 extern bool arch_uprobe_xol_was_trapped(struct task_struct *tsk);
Josh Boyer e8d34e0
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
Josh Boyer e8d34e0
index c4c6a5c..a6a6871 100644
Josh Boyer e8d34e0
--- a/arch/x86/kernel/ptrace.c
Josh Boyer e8d34e0
+++ b/arch/x86/kernel/ptrace.c
Josh Boyer e8d34e0
@@ -1415,6 +1415,12 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task)
Josh Boyer e8d34e0
 #endif
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+/*
Josh Boyer e8d34e0
+ * This is declared in linux/regset.h and defined in machine-dependent
Josh Boyer e8d34e0
+ * code.  We put the export here to ensure no machine forgets it.
Josh Boyer e8d34e0
+ */
Josh Boyer e8d34e0
+EXPORT_SYMBOL_GPL(task_user_regset_view);
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
 static void fill_sigtrap_info(struct task_struct *tsk,
Josh Boyer e8d34e0
 				struct pt_regs *regs,
Josh Boyer e8d34e0
 				int error_code, int si_code,
Josh Boyer e8d34e0
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
Josh Boyer e8d34e0
index dc4e910..36fd420 100644
Josh Boyer e8d34e0
--- a/arch/x86/kernel/uprobes.c
Josh Boyer e8d34e0
+++ b/arch/x86/kernel/uprobes.c
Josh Boyer e8d34e0
@@ -409,9 +409,10 @@ static int validate_insn_bits(struct arch_uprobe *auprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
  * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
Josh Boyer e8d34e0
  * @mm: the probed address space.
Josh Boyer e8d34e0
  * @arch_uprobe: the probepoint information.
Josh Boyer e8d34e0
+ * @addr: virtual address at which to install the probepoint
Josh Boyer e8d34e0
  * Return 0 on success or a -ve number on error.
Josh Boyer e8d34e0
  */
Josh Boyer e8d34e0
-int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm)
Josh Boyer e8d34e0
+int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long addr)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	int ret;
Josh Boyer e8d34e0
 	struct insn insn;
Josh Boyer e8d34e0
diff --git a/include/linux/sched.h b/include/linux/sched.h
Josh Boyer e8d34e0
index 4059c0f..c7cfa69 100644
Josh Boyer e8d34e0
--- a/include/linux/sched.h
Josh Boyer e8d34e0
+++ b/include/linux/sched.h
Josh Boyer e8d34e0
@@ -1581,7 +1581,6 @@ struct task_struct {
Josh Boyer e8d34e0
 #endif
Josh Boyer e8d34e0
 #ifdef CONFIG_UPROBES
Josh Boyer e8d34e0
 	struct uprobe_task *utask;
Josh Boyer e8d34e0
-	int uprobe_srcu_id;
Josh Boyer e8d34e0
 #endif
Josh Boyer e8d34e0
 };
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
Josh Boyer e8d34e0
index 985be4d..d9e5ba5 100644
Josh Boyer e8d34e0
--- a/kernel/events/uprobes.c
Josh Boyer e8d34e0
+++ b/kernel/events/uprobes.c
Josh Boyer e8d34e0
@@ -34,17 +34,34 @@
Josh Boyer e8d34e0
 #include <linux/kdebug.h>	/* notifier mechanism */
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 #include <linux/uprobes.h>
Josh Boyer e8d34e0
+#include <linux/export.h>
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 #define UINSNS_PER_PAGE			(PAGE_SIZE/UPROBE_XOL_SLOT_BYTES)
Josh Boyer e8d34e0
 #define MAX_UPROBE_XOL_SLOTS		UINSNS_PER_PAGE
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-static struct srcu_struct uprobes_srcu;
Josh Boyer e8d34e0
 static struct rb_root uprobes_tree = RB_ROOT;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 static DEFINE_SPINLOCK(uprobes_treelock);	/* serialize rbtree access */
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 #define UPROBES_HASH_SZ	13
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+/*
Josh Boyer e8d34e0
+ * We need separate register/unregister and mmap/munmap lock hashes because
Josh Boyer e8d34e0
+ * of mmap_sem nesting.
Josh Boyer e8d34e0
+ *
Josh Boyer e8d34e0
+ * uprobe_register() needs to install probes on (potentially) all processes
Josh Boyer e8d34e0
+ * and thus needs to acquire multiple mmap_sems (consequtively, not
Josh Boyer e8d34e0
+ * concurrently), whereas uprobe_mmap() is called while holding mmap_sem
Josh Boyer e8d34e0
+ * for the particular process doing the mmap.
Josh Boyer e8d34e0
+ *
Josh Boyer e8d34e0
+ * uprobe_register()->register_for_each_vma() needs to drop/acquire mmap_sem
Josh Boyer e8d34e0
+ * because of lock order against i_mmap_mutex. This means there's a hole in
Josh Boyer e8d34e0
+ * the register vma iteration where a mmap() can happen.
Josh Boyer e8d34e0
+ *
Josh Boyer e8d34e0
+ * Thus uprobe_register() can race with uprobe_mmap() and we can try and
Josh Boyer e8d34e0
+ * install a probe where one is already installed.
Josh Boyer e8d34e0
+ */
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
 /* serialize (un)register */
Josh Boyer e8d34e0
 static struct mutex uprobes_mutex[UPROBES_HASH_SZ];
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -61,17 +78,6 @@ static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ];
Josh Boyer e8d34e0
  */
Josh Boyer e8d34e0
 static atomic_t uprobe_events = ATOMIC_INIT(0);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-/*
Josh Boyer e8d34e0
- * Maintain a temporary per vma info that can be used to search if a vma
Josh Boyer e8d34e0
- * has already been handled. This structure is introduced since extending
Josh Boyer e8d34e0
- * vm_area_struct wasnt recommended.
Josh Boyer e8d34e0
- */
Josh Boyer e8d34e0
-struct vma_info {
Josh Boyer e8d34e0
-	struct list_head	probe_list;
Josh Boyer e8d34e0
-	struct mm_struct	*mm;
Josh Boyer e8d34e0
-	loff_t			vaddr;
Josh Boyer e8d34e0
-};
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
 struct uprobe {
Josh Boyer e8d34e0
 	struct rb_node		rb_node;	/* node in the rb tree */
Josh Boyer e8d34e0
 	atomic_t		ref;
Josh Boyer e8d34e0
@@ -100,7 +106,8 @@ static bool valid_vma(struct vm_area_struct *vma, bool is_register)
Josh Boyer e8d34e0
 	if (!is_register)
Josh Boyer e8d34e0
 		return true;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	if ((vma->vm_flags & (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)) == (VM_READ|VM_EXEC))
Josh Boyer e8d34e0
+	if ((vma->vm_flags & (VM_HUGETLB|VM_READ|VM_WRITE|VM_EXEC|VM_SHARED))
Josh Boyer e8d34e0
+				== (VM_READ|VM_EXEC))
Josh Boyer e8d34e0
 		return true;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	return false;
Josh Boyer e8d34e0
@@ -129,33 +136,17 @@ static loff_t vma_address(struct vm_area_struct *vma, loff_t offset)
Josh Boyer e8d34e0
 static int __replace_page(struct vm_area_struct *vma, struct page *page, struct page *kpage)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	struct mm_struct *mm = vma->vm_mm;
Josh Boyer e8d34e0
-	pgd_t *pgd;
Josh Boyer e8d34e0
-	pud_t *pud;
Josh Boyer e8d34e0
-	pmd_t *pmd;
Josh Boyer e8d34e0
-	pte_t *ptep;
Josh Boyer e8d34e0
-	spinlock_t *ptl;
Josh Boyer e8d34e0
 	unsigned long addr;
Josh Boyer e8d34e0
-	int err = -EFAULT;
Josh Boyer e8d34e0
+	spinlock_t *ptl;
Josh Boyer e8d34e0
+	pte_t *ptep;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	addr = page_address_in_vma(page, vma);
Josh Boyer e8d34e0
 	if (addr == -EFAULT)
Josh Boyer e8d34e0
-		goto out;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	pgd = pgd_offset(mm, addr);
Josh Boyer e8d34e0
-	if (!pgd_present(*pgd))
Josh Boyer e8d34e0
-		goto out;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	pud = pud_offset(pgd, addr);
Josh Boyer e8d34e0
-	if (!pud_present(*pud))
Josh Boyer e8d34e0
-		goto out;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	pmd = pmd_offset(pud, addr);
Josh Boyer e8d34e0
-	if (!pmd_present(*pmd))
Josh Boyer e8d34e0
-		goto out;
Josh Boyer e8d34e0
+		return -EFAULT;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
Josh Boyer e8d34e0
+	ptep = page_check_address(page, mm, addr, &ptl, 0);
Josh Boyer e8d34e0
 	if (!ptep)
Josh Boyer e8d34e0
-		goto out;
Josh Boyer e8d34e0
+		return -EAGAIN;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	get_page(kpage);
Josh Boyer e8d34e0
 	page_add_new_anon_rmap(kpage, vma, addr);
Josh Boyer e8d34e0
@@ -174,10 +165,8 @@ static int __replace_page(struct vm_area_struct *vma, struct page *page, struct
Josh Boyer e8d34e0
 		try_to_free_swap(page);
Josh Boyer e8d34e0
 	put_page(page);
Josh Boyer e8d34e0
 	pte_unmap_unlock(ptep, ptl);
Josh Boyer e8d34e0
-	err = 0;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-out:
Josh Boyer e8d34e0
-	return err;
Josh Boyer e8d34e0
+	return 0;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /**
Josh Boyer e8d34e0
@@ -222,9 +211,8 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 	void *vaddr_old, *vaddr_new;
Josh Boyer e8d34e0
 	struct vm_area_struct *vma;
Josh Boyer e8d34e0
 	struct uprobe *uprobe;
Josh Boyer e8d34e0
-	loff_t addr;
Josh Boyer e8d34e0
 	int ret;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
+retry:
Josh Boyer e8d34e0
 	/* Read the page with vaddr into memory */
Josh Boyer e8d34e0
 	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &old_page, &vma);
Josh Boyer e8d34e0
 	if (ret <= 0)
Josh Boyer e8d34e0
@@ -246,10 +234,6 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 	if (mapping != vma->vm_file->f_mapping)
Josh Boyer e8d34e0
 		goto put_out;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	addr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
-	if (vaddr != (unsigned long)addr)
Josh Boyer e8d34e0
-		goto put_out;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
 	ret = -ENOMEM;
Josh Boyer e8d34e0
 	new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vaddr);
Josh Boyer e8d34e0
 	if (!new_page)
Josh Boyer e8d34e0
@@ -267,11 +251,7 @@ static int write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 	vaddr_new = kmap_atomic(new_page);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	memcpy(vaddr_new, vaddr_old, PAGE_SIZE);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	/* poke the new insn in, ASSUMES we don't cross page boundary */
Josh Boyer e8d34e0
-	vaddr &= ~PAGE_MASK;
Josh Boyer e8d34e0
-	BUG_ON(vaddr + UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
Josh Boyer e8d34e0
-	memcpy(vaddr_new + vaddr, &opcode, UPROBE_SWBP_INSN_SIZE);
Josh Boyer e8d34e0
+	memcpy(vaddr_new + (vaddr & ~PAGE_MASK), &opcode, UPROBE_SWBP_INSN_SIZE);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	kunmap_atomic(vaddr_new);
Josh Boyer e8d34e0
 	kunmap_atomic(vaddr_old);
Josh Boyer e8d34e0
@@ -291,6 +271,8 @@ unlock_out:
Josh Boyer e8d34e0
 put_out:
Josh Boyer e8d34e0
 	put_page(old_page);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+	if (unlikely(ret == -EAGAIN))
Josh Boyer e8d34e0
+		goto retry;
Josh Boyer e8d34e0
 	return ret;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -312,7 +294,7 @@ static int read_opcode(struct mm_struct *mm, unsigned long vaddr, uprobe_opcode_
Josh Boyer e8d34e0
 	void *vaddr_new;
Josh Boyer e8d34e0
 	int ret;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 0, &page, NULL);
Josh Boyer e8d34e0
+	ret = get_user_pages(NULL, mm, vaddr, 1, 0, 1, &page, NULL);
Josh Boyer e8d34e0
 	if (ret <= 0)
Josh Boyer e8d34e0
 		return ret;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -333,10 +315,20 @@ static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
Josh Boyer e8d34e0
 	uprobe_opcode_t opcode;
Josh Boyer e8d34e0
 	int result;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+	if (current->mm == mm) {
Josh Boyer e8d34e0
+		pagefault_disable();
Josh Boyer e8d34e0
+		result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
Josh Boyer e8d34e0
+								sizeof(opcode));
Josh Boyer e8d34e0
+		pagefault_enable();
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+		if (likely(result == 0))
Josh Boyer e8d34e0
+			goto out;
Josh Boyer e8d34e0
+	}
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
 	result = read_opcode(mm, vaddr, &opcode);
Josh Boyer e8d34e0
 	if (result)
Josh Boyer e8d34e0
 		return result;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
+out:
Josh Boyer e8d34e0
 	if (is_swbp_insn(&opcode))
Josh Boyer e8d34e0
 		return 1;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -355,7 +347,9 @@ static int is_swbp_at_addr(struct mm_struct *mm, unsigned long vaddr)
Josh Boyer e8d34e0
 int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	int result;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
+	/*
Josh Boyer e8d34e0
+	 * See the comment near uprobes_hash().
Josh Boyer e8d34e0
+	 */
Josh Boyer e8d34e0
 	result = is_swbp_at_addr(mm, vaddr);
Josh Boyer e8d34e0
 	if (result == 1)
Josh Boyer e8d34e0
 		return -EEXIST;
Josh Boyer e8d34e0
@@ -520,7 +514,6 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
Josh Boyer e8d34e0
 	uprobe->inode = igrab(inode);
Josh Boyer e8d34e0
 	uprobe->offset = offset;
Josh Boyer e8d34e0
 	init_rwsem(&uprobe->consumer_rwsem);
Josh Boyer e8d34e0
-	INIT_LIST_HEAD(&uprobe->pending_list);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	/* add to uprobes_tree, sorted on inode:offset */
Josh Boyer e8d34e0
 	cur_uprobe = insert_uprobe(uprobe);
Josh Boyer e8d34e0
@@ -588,20 +581,22 @@ static bool consumer_del(struct uprobe *uprobe, struct uprobe_consumer *uc)
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 static int
Josh Boyer e8d34e0
-__copy_insn(struct address_space *mapping, struct vm_area_struct *vma, char *insn,
Josh Boyer e8d34e0
-			unsigned long nbytes, unsigned long offset)
Josh Boyer e8d34e0
+__copy_insn(struct address_space *mapping, struct file *filp, char *insn,
Josh Boyer e8d34e0
+			unsigned long nbytes, loff_t offset)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
-	struct file *filp = vma->vm_file;
Josh Boyer e8d34e0
 	struct page *page;
Josh Boyer e8d34e0
 	void *vaddr;
Josh Boyer e8d34e0
-	unsigned long off1;
Josh Boyer e8d34e0
-	unsigned long idx;
Josh Boyer e8d34e0
+	unsigned long off;
Josh Boyer e8d34e0
+	pgoff_t idx;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	if (!filp)
Josh Boyer e8d34e0
 		return -EINVAL;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	idx = (unsigned long)(offset >> PAGE_CACHE_SHIFT);
Josh Boyer e8d34e0
-	off1 = offset &= ~PAGE_MASK;
Josh Boyer e8d34e0
+	if (!mapping->a_ops->readpage)
Josh Boyer e8d34e0
+		return -EIO;
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+	idx = offset >> PAGE_CACHE_SHIFT;
Josh Boyer e8d34e0
+	off = offset & ~PAGE_MASK;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	/*
Josh Boyer e8d34e0
 	 * Ensure that the page that has the original instruction is
Josh Boyer e8d34e0
@@ -612,22 +607,20 @@ __copy_insn(struct address_space *mapping, struct vm_area_struct *vma, char *ins
Josh Boyer e8d34e0
 		return PTR_ERR(page);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	vaddr = kmap_atomic(page);
Josh Boyer e8d34e0
-	memcpy(insn, vaddr + off1, nbytes);
Josh Boyer e8d34e0
+	memcpy(insn, vaddr + off, nbytes);
Josh Boyer e8d34e0
 	kunmap_atomic(vaddr);
Josh Boyer e8d34e0
 	page_cache_release(page);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	return 0;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-static int
Josh Boyer e8d34e0
-copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
Josh Boyer e8d34e0
+static int copy_insn(struct uprobe *uprobe, struct file *filp)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	struct address_space *mapping;
Josh Boyer e8d34e0
 	unsigned long nbytes;
Josh Boyer e8d34e0
 	int bytes;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	addr &= ~PAGE_MASK;
Josh Boyer e8d34e0
-	nbytes = PAGE_SIZE - addr;
Josh Boyer e8d34e0
+	nbytes = PAGE_SIZE - (uprobe->offset & ~PAGE_MASK);
Josh Boyer e8d34e0
 	mapping = uprobe->inode->i_mapping;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	/* Instruction at end of binary; copy only available bytes */
Josh Boyer e8d34e0
@@ -638,13 +631,13 @@ copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	/* Instruction at the page-boundary; copy bytes in second page */
Josh Boyer e8d34e0
 	if (nbytes < bytes) {
Josh Boyer e8d34e0
-		if (__copy_insn(mapping, vma, uprobe->arch.insn + nbytes,
Josh Boyer e8d34e0
-				bytes - nbytes, uprobe->offset + nbytes))
Josh Boyer e8d34e0
-			return -ENOMEM;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
+		int err = __copy_insn(mapping, filp, uprobe->arch.insn + nbytes,
Josh Boyer e8d34e0
+				bytes - nbytes, uprobe->offset + nbytes);
Josh Boyer e8d34e0
+		if (err)
Josh Boyer e8d34e0
+			return err;
Josh Boyer e8d34e0
 		bytes = nbytes;
Josh Boyer e8d34e0
 	}
Josh Boyer e8d34e0
-	return __copy_insn(mapping, vma, uprobe->arch.insn, bytes, uprobe->offset);
Josh Boyer e8d34e0
+	return __copy_insn(mapping, filp, uprobe->arch.insn, bytes, uprobe->offset);
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
@@ -672,9 +665,8 @@ copy_insn(struct uprobe *uprobe, struct vm_area_struct *vma, unsigned long addr)
Josh Boyer e8d34e0
  */
Josh Boyer e8d34e0
 static int
Josh Boyer e8d34e0
 install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
-			struct vm_area_struct *vma, loff_t vaddr)
Josh Boyer e8d34e0
+			struct vm_area_struct *vma, unsigned long vaddr)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
-	unsigned long addr;
Josh Boyer e8d34e0
 	int ret;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	/*
Josh Boyer e8d34e0
@@ -687,20 +679,22 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 	if (!uprobe->consumers)
Josh Boyer e8d34e0
 		return -EEXIST;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	addr = (unsigned long)vaddr;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
 	if (!(uprobe->flags & UPROBE_COPY_INSN)) {
Josh Boyer e8d34e0
-		ret = copy_insn(uprobe, vma, addr);
Josh Boyer e8d34e0
+		ret = copy_insn(uprobe, vma->vm_file);
Josh Boyer e8d34e0
 		if (ret)
Josh Boyer e8d34e0
 			return ret;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 		if (is_swbp_insn((uprobe_opcode_t *)uprobe->arch.insn))
Josh Boyer e8d34e0
-			return -EEXIST;
Josh Boyer e8d34e0
+			return -ENOTSUPP;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-		ret = arch_uprobe_analyze_insn(&uprobe->arch, mm);
Josh Boyer e8d34e0
+		ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
Josh Boyer e8d34e0
 		if (ret)
Josh Boyer e8d34e0
 			return ret;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+		/* write_opcode() assumes we don't cross page boundary */
Josh Boyer e8d34e0
+		BUG_ON((uprobe->offset & ~PAGE_MASK) +
Josh Boyer e8d34e0
+				UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
 		uprobe->flags |= UPROBE_COPY_INSN;
Josh Boyer e8d34e0
 	}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -713,7 +707,7 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 	 * Hence increment before and decrement on failure.
Josh Boyer e8d34e0
 	 */
Josh Boyer e8d34e0
 	atomic_inc(&mm->uprobes_state.count);
Josh Boyer e8d34e0
-	ret = set_swbp(&uprobe->arch, mm, addr);
Josh Boyer e8d34e0
+	ret = set_swbp(&uprobe->arch, mm, vaddr);
Josh Boyer e8d34e0
 	if (ret)
Josh Boyer e8d34e0
 		atomic_dec(&mm->uprobes_state.count);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -721,27 +715,21 @@ install_breakpoint(struct uprobe *uprobe, struct mm_struct *mm,
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 static void
Josh Boyer e8d34e0
-remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, loff_t vaddr)
Josh Boyer e8d34e0
+remove_breakpoint(struct uprobe *uprobe, struct mm_struct *mm, unsigned long vaddr)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
-	if (!set_orig_insn(&uprobe->arch, mm, (unsigned long)vaddr, true))
Josh Boyer e8d34e0
+	if (!set_orig_insn(&uprobe->arch, mm, vaddr, true))
Josh Boyer e8d34e0
 		atomic_dec(&mm->uprobes_state.count);
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
- * There could be threads that have hit the breakpoint and are entering the
Josh Boyer e8d34e0
- * notifier code and trying to acquire the uprobes_treelock. The thread
Josh Boyer e8d34e0
- * calling delete_uprobe() that is removing the uprobe from the rb_tree can
Josh Boyer e8d34e0
- * race with these threads and might acquire the uprobes_treelock compared
Josh Boyer e8d34e0
- * to some of the breakpoint hit threads. In such a case, the breakpoint
Josh Boyer e8d34e0
- * hit threads will not find the uprobe. The current unregistering thread
Josh Boyer e8d34e0
- * waits till all other threads have hit a breakpoint, to acquire the
Josh Boyer e8d34e0
- * uprobes_treelock before the uprobe is removed from the rbtree.
Josh Boyer e8d34e0
+ * There could be threads that have already hit the breakpoint. They
Josh Boyer e8d34e0
+ * will recheck the current insn and restart if find_uprobe() fails.
Josh Boyer e8d34e0
+ * See find_active_uprobe().
Josh Boyer e8d34e0
  */
Josh Boyer e8d34e0
 static void delete_uprobe(struct uprobe *uprobe)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	unsigned long flags;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	synchronize_srcu(&uprobes_srcu);
Josh Boyer e8d34e0
 	spin_lock_irqsave(&uprobes_treelock, flags);
Josh Boyer e8d34e0
 	rb_erase(&uprobe->rb_node, &uprobes_tree);
Josh Boyer e8d34e0
 	spin_unlock_irqrestore(&uprobes_treelock, flags);
Josh Boyer e8d34e0
@@ -750,139 +738,135 @@ static void delete_uprobe(struct uprobe *uprobe)
Josh Boyer e8d34e0
 	atomic_dec(&uprobe_events);
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-static struct vma_info *
Josh Boyer e8d34e0
-__find_next_vma_info(struct address_space *mapping, struct list_head *head,
Josh Boyer e8d34e0
-			struct vma_info *vi, loff_t offset, bool is_register)
Josh Boyer e8d34e0
+struct map_info {
Josh Boyer e8d34e0
+	struct map_info *next;
Josh Boyer e8d34e0
+	struct mm_struct *mm;
Josh Boyer e8d34e0
+	unsigned long vaddr;
Josh Boyer e8d34e0
+};
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+static inline struct map_info *free_map_info(struct map_info *info)
Josh Boyer e8d34e0
+{
Josh Boyer e8d34e0
+	struct map_info *next = info->next;
Josh Boyer e8d34e0
+	kfree(info);
Josh Boyer e8d34e0
+	return next;
Josh Boyer e8d34e0
+}
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+static struct map_info *
Josh Boyer e8d34e0
+build_map_info(struct address_space *mapping, loff_t offset, bool is_register)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
+	unsigned long pgoff = offset >> PAGE_SHIFT;
Josh Boyer e8d34e0
 	struct prio_tree_iter iter;
Josh Boyer e8d34e0
 	struct vm_area_struct *vma;
Josh Boyer e8d34e0
-	struct vma_info *tmpvi;
Josh Boyer e8d34e0
-	unsigned long pgoff;
Josh Boyer e8d34e0
-	int existing_vma;
Josh Boyer e8d34e0
-	loff_t vaddr;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	pgoff = offset >> PAGE_SHIFT;
Josh Boyer e8d34e0
+	struct map_info *curr = NULL;
Josh Boyer e8d34e0
+	struct map_info *prev = NULL;
Josh Boyer e8d34e0
+	struct map_info *info;
Josh Boyer e8d34e0
+	int more = 0;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+ again:
Josh Boyer e8d34e0
+	mutex_lock(&mapping->i_mmap_mutex);
Josh Boyer e8d34e0
 	vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
Josh Boyer e8d34e0
 		if (!valid_vma(vma, is_register))
Josh Boyer e8d34e0
 			continue;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-		existing_vma = 0;
Josh Boyer e8d34e0
-		vaddr = vma_address(vma, offset);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		list_for_each_entry(tmpvi, head, probe_list) {
Josh Boyer e8d34e0
-			if (tmpvi->mm == vma->vm_mm && tmpvi->vaddr == vaddr) {
Josh Boyer e8d34e0
-				existing_vma = 1;
Josh Boyer e8d34e0
-				break;
Josh Boyer e8d34e0
-			}
Josh Boyer e8d34e0
+		if (!prev && !more) {
Josh Boyer e8d34e0
+			/*
Josh Boyer e8d34e0
+			 * Needs GFP_NOWAIT to avoid i_mmap_mutex recursion through
Josh Boyer e8d34e0
+			 * reclaim. This is optimistic, no harm done if it fails.
Josh Boyer e8d34e0
+			 */
Josh Boyer e8d34e0
+			prev = kmalloc(sizeof(struct map_info),
Josh Boyer e8d34e0
+					GFP_NOWAIT | __GFP_NOMEMALLOC | __GFP_NOWARN);
Josh Boyer e8d34e0
+			if (prev)
Josh Boyer e8d34e0
+				prev->next = NULL;
Josh Boyer e8d34e0
 		}
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		/*
Josh Boyer e8d34e0
-		 * Another vma needs a probe to be installed. However skip
Josh Boyer e8d34e0
-		 * installing the probe if the vma is about to be unlinked.
Josh Boyer e8d34e0
-		 */
Josh Boyer e8d34e0
-		if (!existing_vma && atomic_inc_not_zero(&vma->vm_mm->mm_users)) {
Josh Boyer e8d34e0
-			vi->mm = vma->vm_mm;
Josh Boyer e8d34e0
-			vi->vaddr = vaddr;
Josh Boyer e8d34e0
-			list_add(&vi->probe_list, head);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-			return vi;
Josh Boyer e8d34e0
+		if (!prev) {
Josh Boyer e8d34e0
+			more++;
Josh Boyer e8d34e0
+			continue;
Josh Boyer e8d34e0
 		}
Josh Boyer e8d34e0
-	}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	return NULL;
Josh Boyer e8d34e0
-}
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-/*
Josh Boyer e8d34e0
- * Iterate in the rmap prio tree  and find a vma where a probe has not
Josh Boyer e8d34e0
- * yet been inserted.
Josh Boyer e8d34e0
- */
Josh Boyer e8d34e0
-static struct vma_info *
Josh Boyer e8d34e0
-find_next_vma_info(struct address_space *mapping, struct list_head *head,
Josh Boyer e8d34e0
-		loff_t offset, bool is_register)
Josh Boyer e8d34e0
-{
Josh Boyer e8d34e0
-	struct vma_info *vi, *retvi;
Josh Boyer e8d34e0
+		if (!atomic_inc_not_zero(&vma->vm_mm->mm_users))
Josh Boyer e8d34e0
+			continue;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	vi = kzalloc(sizeof(struct vma_info), GFP_KERNEL);
Josh Boyer e8d34e0
-	if (!vi)
Josh Boyer e8d34e0
-		return ERR_PTR(-ENOMEM);
Josh Boyer e8d34e0
+		info = prev;
Josh Boyer e8d34e0
+		prev = prev->next;
Josh Boyer e8d34e0
+		info->next = curr;
Josh Boyer e8d34e0
+		curr = info;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	mutex_lock(&mapping->i_mmap_mutex);
Josh Boyer e8d34e0
-	retvi = __find_next_vma_info(mapping, head, vi, offset, is_register);
Josh Boyer e8d34e0
+		info->mm = vma->vm_mm;
Josh Boyer e8d34e0
+		info->vaddr = vma_address(vma, offset);
Josh Boyer e8d34e0
+	}
Josh Boyer e8d34e0
 	mutex_unlock(&mapping->i_mmap_mutex);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	if (!retvi)
Josh Boyer e8d34e0
-		kfree(vi);
Josh Boyer e8d34e0
+	if (!more)
Josh Boyer e8d34e0
+		goto out;
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+	prev = curr;
Josh Boyer e8d34e0
+	while (curr) {
Josh Boyer e8d34e0
+		mmput(curr->mm);
Josh Boyer e8d34e0
+		curr = curr->next;
Josh Boyer e8d34e0
+	}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	return retvi;
Josh Boyer e8d34e0
+	do {
Josh Boyer e8d34e0
+		info = kmalloc(sizeof(struct map_info), GFP_KERNEL);
Josh Boyer e8d34e0
+		if (!info) {
Josh Boyer e8d34e0
+			curr = ERR_PTR(-ENOMEM);
Josh Boyer e8d34e0
+			goto out;
Josh Boyer e8d34e0
+		}
Josh Boyer e8d34e0
+		info->next = prev;
Josh Boyer e8d34e0
+		prev = info;
Josh Boyer e8d34e0
+	} while (--more);
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+	goto again;
Josh Boyer e8d34e0
+ out:
Josh Boyer e8d34e0
+	while (prev)
Josh Boyer e8d34e0
+		prev = free_map_info(prev);
Josh Boyer e8d34e0
+	return curr;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 static int register_for_each_vma(struct uprobe *uprobe, bool is_register)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
-	struct list_head try_list;
Josh Boyer e8d34e0
-	struct vm_area_struct *vma;
Josh Boyer e8d34e0
-	struct address_space *mapping;
Josh Boyer e8d34e0
-	struct vma_info *vi, *tmpvi;
Josh Boyer e8d34e0
-	struct mm_struct *mm;
Josh Boyer e8d34e0
-	loff_t vaddr;
Josh Boyer e8d34e0
-	int ret;
Josh Boyer e8d34e0
+	struct map_info *info;
Josh Boyer e8d34e0
+	int err = 0;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	mapping = uprobe->inode->i_mapping;
Josh Boyer e8d34e0
-	INIT_LIST_HEAD(&try_list);
Josh Boyer e8d34e0
+	info = build_map_info(uprobe->inode->i_mapping,
Josh Boyer e8d34e0
+					uprobe->offset, is_register);
Josh Boyer e8d34e0
+	if (IS_ERR(info))
Josh Boyer e8d34e0
+		return PTR_ERR(info);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	ret = 0;
Josh Boyer e8d34e0
+	while (info) {
Josh Boyer e8d34e0
+		struct mm_struct *mm = info->mm;
Josh Boyer e8d34e0
+		struct vm_area_struct *vma;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	for (;;) {
Josh Boyer e8d34e0
-		vi = find_next_vma_info(mapping, &try_list, uprobe->offset, is_register);
Josh Boyer e8d34e0
-		if (!vi)
Josh Boyer e8d34e0
-			break;
Josh Boyer e8d34e0
+		if (err)
Josh Boyer e8d34e0
+			goto free;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-		if (IS_ERR(vi)) {
Josh Boyer e8d34e0
-			ret = PTR_ERR(vi);
Josh Boyer e8d34e0
-			break;
Josh Boyer e8d34e0
-		}
Josh Boyer e8d34e0
+		down_write(&mm->mmap_sem);
Josh Boyer e8d34e0
+		vma = find_vma(mm, (unsigned long)info->vaddr);
Josh Boyer e8d34e0
+		if (!vma || !valid_vma(vma, is_register))
Josh Boyer e8d34e0
+			goto unlock;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-		mm = vi->mm;
Josh Boyer e8d34e0
-		down_read(&mm->mmap_sem);
Josh Boyer e8d34e0
-		vma = find_vma(mm, (unsigned long)vi->vaddr);
Josh Boyer e8d34e0
-		if (!vma || !valid_vma(vma, is_register)) {
Josh Boyer e8d34e0
-			list_del(&vi->probe_list);
Josh Boyer e8d34e0
-			kfree(vi);
Josh Boyer e8d34e0
-			up_read(&mm->mmap_sem);
Josh Boyer e8d34e0
-			mmput(mm);
Josh Boyer e8d34e0
-			continue;
Josh Boyer e8d34e0
-		}
Josh Boyer e8d34e0
-		vaddr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
 		if (vma->vm_file->f_mapping->host != uprobe->inode ||
Josh Boyer e8d34e0
-						vaddr != vi->vaddr) {
Josh Boyer e8d34e0
-			list_del(&vi->probe_list);
Josh Boyer e8d34e0
-			kfree(vi);
Josh Boyer e8d34e0
-			up_read(&mm->mmap_sem);
Josh Boyer e8d34e0
-			mmput(mm);
Josh Boyer e8d34e0
-			continue;
Josh Boyer e8d34e0
-		}
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		if (is_register)
Josh Boyer e8d34e0
-			ret = install_breakpoint(uprobe, mm, vma, vi->vaddr);
Josh Boyer e8d34e0
-		else
Josh Boyer e8d34e0
-			remove_breakpoint(uprobe, mm, vi->vaddr);
Josh Boyer e8d34e0
+		    vma_address(vma, uprobe->offset) != info->vaddr)
Josh Boyer e8d34e0
+			goto unlock;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-		up_read(&mm->mmap_sem);
Josh Boyer e8d34e0
-		mmput(mm);
Josh Boyer e8d34e0
 		if (is_register) {
Josh Boyer e8d34e0
-			if (ret && ret == -EEXIST)
Josh Boyer e8d34e0
-				ret = 0;
Josh Boyer e8d34e0
-			if (ret)
Josh Boyer e8d34e0
-				break;
Josh Boyer e8d34e0
+			err = install_breakpoint(uprobe, mm, vma, info->vaddr);
Josh Boyer e8d34e0
+			/*
Josh Boyer e8d34e0
+			 * We can race against uprobe_mmap(), see the
Josh Boyer e8d34e0
+			 * comment near uprobe_hash().
Josh Boyer e8d34e0
+			 */
Josh Boyer e8d34e0
+			if (err == -EEXIST)
Josh Boyer e8d34e0
+				err = 0;
Josh Boyer e8d34e0
+		} else {
Josh Boyer e8d34e0
+			remove_breakpoint(uprobe, mm, info->vaddr);
Josh Boyer e8d34e0
 		}
Josh Boyer e8d34e0
+ unlock:
Josh Boyer e8d34e0
+		up_write(&mm->mmap_sem);
Josh Boyer e8d34e0
+ free:
Josh Boyer e8d34e0
+		mmput(mm);
Josh Boyer e8d34e0
+		info = free_map_info(info);
Josh Boyer e8d34e0
 	}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	list_for_each_entry_safe(vi, tmpvi, &try_list, probe_list) {
Josh Boyer e8d34e0
-		list_del(&vi->probe_list);
Josh Boyer e8d34e0
-		kfree(vi);
Josh Boyer e8d34e0
-	}
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	return ret;
Josh Boyer e8d34e0
+	return err;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 static int __uprobe_register(struct uprobe *uprobe)
Josh Boyer e8d34e0
@@ -945,6 +929,7 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	return ret;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
+EXPORT_SYMBOL_GPL(uprobe_register);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
  * uprobe_unregister - unregister a already registered probe.
Josh Boyer e8d34e0
@@ -976,6 +961,7 @@ void uprobe_unregister(struct inode *inode, loff_t offset, struct uprobe_consume
Josh Boyer e8d34e0
 	if (uprobe)
Josh Boyer e8d34e0
 		put_uprobe(uprobe);
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
+EXPORT_SYMBOL_GPL(uprobe_unregister);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
  * Of all the nodes that correspond to the given inode, return the node
Josh Boyer e8d34e0
@@ -1048,7 +1034,7 @@ static void build_probe_list(struct inode *inode, struct list_head *head)
Josh Boyer e8d34e0
 int uprobe_mmap(struct vm_area_struct *vma)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	struct list_head tmp_list;
Josh Boyer e8d34e0
-	struct uprobe *uprobe, *u;
Josh Boyer e8d34e0
+	struct uprobe *uprobe;
Josh Boyer e8d34e0
 	struct inode *inode;
Josh Boyer e8d34e0
 	int ret, count;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -1066,12 +1052,9 @@ int uprobe_mmap(struct vm_area_struct *vma)
Josh Boyer e8d34e0
 	ret = 0;
Josh Boyer e8d34e0
 	count = 0;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	list_for_each_entry_safe(uprobe, u, &tmp_list, pending_list) {
Josh Boyer e8d34e0
-		loff_t vaddr;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		list_del(&uprobe->pending_list);
Josh Boyer e8d34e0
+	list_for_each_entry(uprobe, &tmp_list, pending_list) {
Josh Boyer e8d34e0
 		if (!ret) {
Josh Boyer e8d34e0
-			vaddr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
+			loff_t vaddr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 			if (vaddr < vma->vm_start || vaddr >= vma->vm_end) {
Josh Boyer e8d34e0
 				put_uprobe(uprobe);
Josh Boyer e8d34e0
@@ -1079,8 +1062,10 @@ int uprobe_mmap(struct vm_area_struct *vma)
Josh Boyer e8d34e0
 			}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 			ret = install_breakpoint(uprobe, vma->vm_mm, vma, vaddr);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-			/* Ignore double add: */
Josh Boyer e8d34e0
+			/*
Josh Boyer e8d34e0
+			 * We can race against uprobe_register(), see the
Josh Boyer e8d34e0
+			 * comment near uprobe_hash().
Josh Boyer e8d34e0
+			 */
Josh Boyer e8d34e0
 			if (ret == -EEXIST) {
Josh Boyer e8d34e0
 				ret = 0;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -1115,7 +1100,7 @@ int uprobe_mmap(struct vm_area_struct *vma)
Josh Boyer e8d34e0
 void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned long end)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	struct list_head tmp_list;
Josh Boyer e8d34e0
-	struct uprobe *uprobe, *u;
Josh Boyer e8d34e0
+	struct uprobe *uprobe;
Josh Boyer e8d34e0
 	struct inode *inode;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	if (!atomic_read(&uprobe_events) || !valid_vma(vma, false))
Josh Boyer e8d34e0
@@ -1132,11 +1117,8 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon
Josh Boyer e8d34e0
 	mutex_lock(uprobes_mmap_hash(inode));
Josh Boyer e8d34e0
 	build_probe_list(inode, &tmp_list);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	list_for_each_entry_safe(uprobe, u, &tmp_list, pending_list) {
Josh Boyer e8d34e0
-		loff_t vaddr;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		list_del(&uprobe->pending_list);
Josh Boyer e8d34e0
-		vaddr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
+	list_for_each_entry(uprobe, &tmp_list, pending_list) {
Josh Boyer e8d34e0
+		loff_t vaddr = vma_address(vma, uprobe->offset);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 		if (vaddr >= start && vaddr < end) {
Josh Boyer e8d34e0
 			/*
Josh Boyer e8d34e0
@@ -1378,9 +1360,6 @@ void uprobe_free_utask(struct task_struct *t)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	struct uprobe_task *utask = t->utask;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	if (t->uprobe_srcu_id != -1)
Josh Boyer e8d34e0
-		srcu_read_unlock_raw(&uprobes_srcu, t->uprobe_srcu_id);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
 	if (!utask)
Josh Boyer e8d34e0
 		return;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -1398,7 +1377,6 @@ void uprobe_free_utask(struct task_struct *t)
Josh Boyer e8d34e0
 void uprobe_copy_process(struct task_struct *t)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
 	t->utask = NULL;
Josh Boyer e8d34e0
-	t->uprobe_srcu_id = -1;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
@@ -1417,7 +1395,6 @@ static struct uprobe_task *add_utask(void)
Josh Boyer e8d34e0
 	if (unlikely(!utask))
Josh Boyer e8d34e0
 		return NULL;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	utask->active_uprobe = NULL;
Josh Boyer e8d34e0
 	current->utask = utask;
Josh Boyer e8d34e0
 	return utask;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
@@ -1479,41 +1456,64 @@ static bool can_skip_sstep(struct uprobe *uprobe, struct pt_regs *regs)
Josh Boyer e8d34e0
 	return false;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
+static struct uprobe *find_active_uprobe(unsigned long bp_vaddr, int *is_swbp)
Josh Boyer e8d34e0
+{
Josh Boyer e8d34e0
+	struct mm_struct *mm = current->mm;
Josh Boyer e8d34e0
+	struct uprobe *uprobe = NULL;
Josh Boyer e8d34e0
+	struct vm_area_struct *vma;
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+	down_read(&mm->mmap_sem);
Josh Boyer e8d34e0
+	vma = find_vma(mm, bp_vaddr);
Josh Boyer e8d34e0
+	if (vma && vma->vm_start <= bp_vaddr) {
Josh Boyer e8d34e0
+		if (valid_vma(vma, false)) {
Josh Boyer e8d34e0
+			struct inode *inode;
Josh Boyer e8d34e0
+			loff_t offset;
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+			inode = vma->vm_file->f_mapping->host;
Josh Boyer e8d34e0
+			offset = bp_vaddr - vma->vm_start;
Josh Boyer e8d34e0
+			offset += (vma->vm_pgoff << PAGE_SHIFT);
Josh Boyer e8d34e0
+			uprobe = find_uprobe(inode, offset);
Josh Boyer e8d34e0
+		}
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+		if (!uprobe)
Josh Boyer e8d34e0
+			*is_swbp = is_swbp_at_addr(mm, bp_vaddr);
Josh Boyer e8d34e0
+	} else {
Josh Boyer e8d34e0
+		*is_swbp = -EFAULT;
Josh Boyer e8d34e0
+	}
Josh Boyer e8d34e0
+	up_read(&mm->mmap_sem);
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
+	return uprobe;
Josh Boyer e8d34e0
+}
Josh Boyer e8d34e0
+
Josh Boyer e8d34e0
 /*
Josh Boyer e8d34e0
  * Run handler and ask thread to singlestep.
Josh Boyer e8d34e0
  * Ensure all non-fatal signals cannot interrupt thread while it singlesteps.
Josh Boyer e8d34e0
  */
Josh Boyer e8d34e0
 static void handle_swbp(struct pt_regs *regs)
Josh Boyer e8d34e0
 {
Josh Boyer e8d34e0
-	struct vm_area_struct *vma;
Josh Boyer e8d34e0
 	struct uprobe_task *utask;
Josh Boyer e8d34e0
 	struct uprobe *uprobe;
Josh Boyer e8d34e0
-	struct mm_struct *mm;
Josh Boyer e8d34e0
 	unsigned long bp_vaddr;
Josh Boyer e8d34e0
+	int uninitialized_var(is_swbp);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
-	uprobe = NULL;
Josh Boyer e8d34e0
 	bp_vaddr = uprobe_get_swbp_addr(regs);
Josh Boyer e8d34e0
-	mm = current->mm;
Josh Boyer e8d34e0
-	down_read(&mm->mmap_sem);
Josh Boyer e8d34e0
-	vma = find_vma(mm, bp_vaddr);
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	if (vma && vma->vm_start <= bp_vaddr && valid_vma(vma, false)) {
Josh Boyer e8d34e0
-		struct inode *inode;
Josh Boyer e8d34e0
-		loff_t offset;
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-		inode = vma->vm_file->f_mapping->host;
Josh Boyer e8d34e0
-		offset = bp_vaddr - vma->vm_start;
Josh Boyer e8d34e0
-		offset += (vma->vm_pgoff << PAGE_SHIFT);
Josh Boyer e8d34e0
-		uprobe = find_uprobe(inode, offset);
Josh Boyer e8d34e0
-	}
Josh Boyer e8d34e0
-
Josh Boyer e8d34e0
-	srcu_read_unlock_raw(&uprobes_srcu, current->uprobe_srcu_id);
Josh Boyer e8d34e0
-	current->uprobe_srcu_id = -1;
Josh Boyer e8d34e0
-	up_read(&mm->mmap_sem);
Josh Boyer e8d34e0
+	uprobe = find_active_uprobe(bp_vaddr, &is_swbp);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	if (!uprobe) {
Josh Boyer e8d34e0
-		/* No matching uprobe; signal SIGTRAP. */
Josh Boyer e8d34e0
-		send_sig(SIGTRAP, current, 0);
Josh Boyer e8d34e0
+		if (is_swbp > 0) {
Josh Boyer e8d34e0
+			/* No matching uprobe; signal SIGTRAP. */
Josh Boyer e8d34e0
+			send_sig(SIGTRAP, current, 0);
Josh Boyer e8d34e0
+		} else {
Josh Boyer e8d34e0
+			/*
Josh Boyer e8d34e0
+			 * Either we raced with uprobe_unregister() or we can't
Josh Boyer e8d34e0
+			 * access this memory. The latter is only possible if
Josh Boyer e8d34e0
+			 * another thread plays with our ->mm. In both cases
Josh Boyer e8d34e0
+			 * we can simply restart. If this vma was unmapped we
Josh Boyer e8d34e0
+			 * can pretend this insn was not executed yet and get
Josh Boyer e8d34e0
+			 * the (correct) SIGSEGV after restart.
Josh Boyer e8d34e0
+			 */
Josh Boyer e8d34e0
+			instruction_pointer_set(regs, bp_vaddr);
Josh Boyer e8d34e0
+		}
Josh Boyer e8d34e0
 		return;
Josh Boyer e8d34e0
 	}
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
@@ -1620,7 +1620,6 @@ int uprobe_pre_sstep_notifier(struct pt_regs *regs)
Josh Boyer e8d34e0
 		utask->state = UTASK_BP_HIT;
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	set_thread_flag(TIF_UPROBE);
Josh Boyer e8d34e0
-	current->uprobe_srcu_id = srcu_read_lock_raw(&uprobes_srcu);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	return 1;
Josh Boyer e8d34e0
 }
Josh Boyer e8d34e0
@@ -1655,7 +1654,6 @@ static int __init init_uprobes(void)
Josh Boyer e8d34e0
 		mutex_init(&uprobes_mutex[i]);
Josh Boyer e8d34e0
 		mutex_init(&uprobes_mmap_mutex[i]);
Josh Boyer e8d34e0
 	}
Josh Boyer e8d34e0
-	init_srcu_struct(&uprobes_srcu);
Josh Boyer e8d34e0
 
Josh Boyer e8d34e0
 	return register_die_notifier(&uprobe_exception_nb);
Josh Boyer e8d34e0
 }