[linux-2.6-block.git] / drivers / android / binderfs.c

/* SPDX-License-Identifier: GPL-2.0 */

#include <linux/compiler_types.h>
#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/fsnotify.h>
#include <linux/gfp.h>
#include <linux/idr.h>
#include <linux/init.h>
#include <linux/ipc_namespace.h>
#include <linux/kdev_t.h>
#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/namei.h>
#include <linux/magic.h>
#include <linux/major.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/mount.h>
#include <linux/parser.h>
#include <linux/radix-tree.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <linux/spinlock_types.h>
#include <linux/stddef.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/uaccess.h>
#include <linux/user_namespace.h>
#include <linux/xarray.h>
#include <uapi/asm-generic/errno-base.h>
#include <uapi/linux/android/binder.h>
#include <uapi/linux/android/binderfs.h>

#include "binder_internal.h"

#define FIRST_INODE 1
#define SECOND_INODE 2
#define INODE_OFFSET 3
#define INTSTRLEN 21
#define BINDERFS_MAX_MINOR (1U << MINORBITS)
/* Ensure that the initial ipc namespace always has devices available. */
#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)

static dev_t binderfs_dev;
static DEFINE_MUTEX(binderfs_minors_mutex);
static DEFINE_IDA(binderfs_minors);

/**
 * binderfs_mount_opts - mount options for binderfs
 * @max: maximum number of allocatable binderfs binder devices
 */
struct binderfs_mount_opts {
	int max;
};

enum {
	Opt_max,
	Opt_err
};

static const match_table_t tokens = {
	{ Opt_max, "max=%d" },
	{ Opt_err, NULL     }
};

/**
 * binderfs_info - information about a binderfs mount
 * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
 * @control_dentry: This records the dentry of this binderfs mount
 *                  binder-control device.
 * @root_uid:       uid that needs to be used when a new binder device is
 *                  created.
 * @root_gid:       gid that needs to be used when a new binder device is
 *                  created.
 * @mount_opts:     The mount options in use.
 * @device_count:   The current number of allocated binder devices.
 */
struct binderfs_info {
	struct ipc_namespace *ipc_ns;
	struct dentry *control_dentry;
	kuid_t root_uid;
	kgid_t root_gid;
	struct binderfs_mount_opts mount_opts;
	int device_count;
};

static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
{
	return inode->i_sb->s_fs_info;
}

bool is_binderfs_device(const struct inode *inode)
{
	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
		return true;

	return false;
}

/**
 * binderfs_binder_device_create - allocate inode from super block of a
 *                                 binderfs mount
 * @ref_inode: inode from wich the super block will be taken
 * @userp:     buffer to copy information about new device for userspace to
 * @req:       struct binderfs_device as copied from userspace
 *
 * This function allocates a new binder_device and reserves a new minor
 * number for it.
 * Minor numbers are limited and tracked globally in binderfs_minors. The
 * function will stash a struct binder_device for the specific binder
 * device in i_private of the inode.
 * It will go on to allocate a new inode from the super block of the
 * filesystem mount, stash a struct binder_device in its i_private field
 * and attach a dentry to that inode.
 *
 * Return: 0 on success, negative errno on failure
 */
static int binderfs_binder_device_create(struct inode *ref_inode,
					 struct binderfs_device __user *userp,
					 struct binderfs_device *req)
{
	int minor, ret;
	struct dentry *dentry, *root;
	struct binder_device *device;
	char *name = NULL;
	size_t name_len;
	struct inode *inode = NULL;
	struct super_block *sb = ref_inode->i_sb;
	struct binderfs_info *info = sb->s_fs_info;
#if defined(CONFIG_IPC_NS)
	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
#else
	bool use_reserve = true;
#endif

	/* Reserve new minor number for the new device. */
	mutex_lock(&binderfs_minors_mutex);
	if (++info->device_count <= info->mount_opts.max)
		minor = ida_alloc_max(&binderfs_minors,
				      use_reserve ? BINDERFS_MAX_MINOR :
						    BINDERFS_MAX_MINOR_CAPPED,
				      GFP_KERNEL);
	else
		minor = -ENOSPC;
	if (minor < 0) {
		--info->device_count;
		mutex_unlock(&binderfs_minors_mutex);
		return minor;
	}
	mutex_unlock(&binderfs_minors_mutex);

	ret = -ENOMEM;
	device = kzalloc(sizeof(*device), GFP_KERNEL);
	if (!device)
		goto err;

	inode = new_inode(sb);
	if (!inode)
		goto err;

	inode->i_ino = minor + INODE_OFFSET;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	init_special_inode(inode, S_IFCHR | 0600,
			   MKDEV(MAJOR(binderfs_dev), minor));
	inode->i_fop = &binder_fops;
	inode->i_uid = info->root_uid;
	inode->i_gid = info->root_gid;

	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
	name_len = strlen(req->name);
	/* Make sure to include terminating NUL byte */
	name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
	if (!name)
		goto err;

	device->binderfs_inode = inode;
	device->context.binder_context_mgr_uid = INVALID_UID;
	device->context.name = name;
	device->miscdev.name = name;
	device->miscdev.minor = minor;
	mutex_init(&device->context.context_mgr_node_lock);

	req->major = MAJOR(binderfs_dev);
	req->minor = minor;

	ret = copy_to_user(userp, req, sizeof(*req));
	if (ret) {
		ret = -EFAULT;
		goto err;
	}

	root = sb->s_root;
	inode_lock(d_inode(root));

	/* look it up */
	dentry = lookup_one_len(name, root, name_len);
	if (IS_ERR(dentry)) {
		inode_unlock(d_inode(root));
		ret = PTR_ERR(dentry);
		goto err;
	}

	if (d_really_is_positive(dentry)) {
		/* already exists */
		dput(dentry);
		inode_unlock(d_inode(root));
		ret = -EEXIST;
		goto err;
	}

	inode->i_private = device;
	d_instantiate(dentry, inode);
	fsnotify_create(root->d_inode, dentry);
	inode_unlock(d_inode(root));

	return 0;

err:
	kfree(name);
	kfree(device);
	mutex_lock(&binderfs_minors_mutex);
	--info->device_count;
	ida_free(&binderfs_minors, minor);
	mutex_unlock(&binderfs_minors_mutex);
	iput(inode);

	return ret;
}

/**
 * binderfs_ctl_ioctl - handle binder device node allocation requests
 *
 * The request handler for the binder-control device. All requests operate on
 * the binderfs mount the binder-control device resides in:
 * - BINDER_CTL_ADD
 *   Allocate a new binder device.
 *
 * Return: 0 on success, negative errno on failure
 */
static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
			     unsigned long arg)
{
	int ret = -EINVAL;
	struct inode *inode = file_inode(file);
	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
	struct binderfs_device device_req;

	switch (cmd) {
	case BINDER_CTL_ADD:
		ret = copy_from_user(&device_req, device, sizeof(device_req));
		if (ret) {
			ret = -EFAULT;
			break;
		}

		ret = binderfs_binder_device_create(inode, device, &device_req);
		break;
	default:
		break;
	}

	return ret;
}

static void binderfs_evict_inode(struct inode *inode)
{
	struct binder_device *device = inode->i_private;
	struct binderfs_info *info = BINDERFS_I(inode);

	clear_inode(inode);

	if (!device)
		return;

	mutex_lock(&binderfs_minors_mutex);
	--info->device_count;
	ida_free(&binderfs_minors, device->miscdev.minor);
	mutex_unlock(&binderfs_minors_mutex);

	kfree(device->context.name);
	kfree(device);
}

/**
 * binderfs_parse_mount_opts - parse binderfs mount options
 * @data: options to set (can be NULL in which case defaults are used)
 */
static int binderfs_parse_mount_opts(char *data,
				     struct binderfs_mount_opts *opts)
{
	char *p;
	opts->max = BINDERFS_MAX_MINOR;

	while ((p = strsep(&data, ",")) != NULL) {
		substring_t args[MAX_OPT_ARGS];
		int token;
		int max_devices;

		if (!*p)
			continue;

		token = match_token(p, tokens, args);
		switch (token) {
		case Opt_max:
			if (match_int(&args[0], &max_devices) ||
			    (max_devices < 0 ||
			     (max_devices > BINDERFS_MAX_MINOR)))
				return -EINVAL;

			opts->max = max_devices;
			break;
		default:
			pr_err("Invalid mount options\n");
			return -EINVAL;
		}
	}

	return 0;
}

static int binderfs_remount(struct super_block *sb, int *flags, char *data)
{
	struct binderfs_info *info = sb->s_fs_info;
	return binderfs_parse_mount_opts(data, &info->mount_opts);
}

static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
{
	struct binderfs_info *info;

	info = root->d_sb->s_fs_info;
	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
		seq_printf(seq, ",max=%d", info->mount_opts.max);

	return 0;
}

static const struct super_operations binderfs_super_ops = {
	.evict_inode    = binderfs_evict_inode,
	.remount_fs	= binderfs_remount,
	.show_options	= binderfs_show_mount_opts,
	.statfs         = simple_statfs,
};

static inline bool is_binderfs_control_device(const struct dentry *dentry)
{
	struct binderfs_info *info = dentry->d_sb->s_fs_info;
	return info->control_dentry == dentry;
}

static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
			   struct inode *new_dir, struct dentry *new_dentry,
			   unsigned int flags)
{
	if (is_binderfs_control_device(old_dentry) ||
	    is_binderfs_control_device(new_dentry))
		return -EPERM;

	return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
}

static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
{
	if (is_binderfs_control_device(dentry))
		return -EPERM;

	return simple_unlink(dir, dentry);
}

static const struct file_operations binder_ctl_fops = {
	.owner		= THIS_MODULE,
	.open		= nonseekable_open,
	.unlocked_ioctl	= binder_ctl_ioctl,
	.compat_ioctl	= binder_ctl_ioctl,
	.llseek		= noop_llseek,
};

/**
 * binderfs_binder_ctl_create - create a new binder-control device
 * @sb: super block of the binderfs mount
 *
 * This function creates a new binder-control device node in the binderfs mount
 * referred to by @sb.
 *
 * Return: 0 on success, negative errno on failure
 */
static int binderfs_binder_ctl_create(struct super_block *sb)
{
	int minor, ret;
	struct dentry *dentry;
	struct binder_device *device;
	struct inode *inode = NULL;
	struct dentry *root = sb->s_root;
	struct binderfs_info *info = sb->s_fs_info;
#if defined(CONFIG_IPC_NS)
	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
#else
	bool use_reserve = true;
#endif

	device = kzalloc(sizeof(*device), GFP_KERNEL);
	if (!device)
		return -ENOMEM;

	/* If we have already created a binder-control node, return. */
	if (info->control_dentry) {
		ret = 0;
		goto out;
	}

	ret = -ENOMEM;
	inode = new_inode(sb);
	if (!inode)
		goto out;

	/* Reserve a new minor number for the new device. */
	mutex_lock(&binderfs_minors_mutex);
	minor = ida_alloc_max(&binderfs_minors,
			      use_reserve ? BINDERFS_MAX_MINOR :
					    BINDERFS_MAX_MINOR_CAPPED,
			      GFP_KERNEL);
	mutex_unlock(&binderfs_minors_mutex);
	if (minor < 0) {
		ret = minor;
		goto out;
	}

	inode->i_ino = SECOND_INODE;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	init_special_inode(inode, S_IFCHR | 0600,
			   MKDEV(MAJOR(binderfs_dev), minor));
	inode->i_fop = &binder_ctl_fops;
	inode->i_uid = info->root_uid;
	inode->i_gid = info->root_gid;

	device->binderfs_inode = inode;
	device->miscdev.minor = minor;

	dentry = d_alloc_name(root, "binder-control");
	if (!dentry)
		goto out;

	inode->i_private = device;
	info->control_dentry = dentry;
	d_add(dentry, inode);

	return 0;

out:
	kfree(device);
	iput(inode);

	return ret;
}

static const struct inode_operations binderfs_dir_inode_operations = {
	.lookup = simple_lookup,
	.rename = binderfs_rename,
	.unlink = binderfs_unlink,
};

static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
{
	int ret;
	struct binderfs_info *info;
	struct inode *inode = NULL;

	sb->s_blocksize = PAGE_SIZE;
	sb->s_blocksize_bits = PAGE_SHIFT;

	/*
	 * The binderfs filesystem can be mounted by userns root in a
	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
	 * set in s_iflags to prevent security issues where userns root can
	 * just create random device nodes via mknod() since it owns the
	 * filesystem mount. But binderfs does not allow to create any files
	 * including devices nodes. The only way to create binder devices nodes
	 * is through the binder-control device which userns root is explicitly
	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
	 * necessary and safe.
	 */
	sb->s_iflags &= ~SB_I_NODEV;
	sb->s_iflags |= SB_I_NOEXEC;
	sb->s_magic = BINDERFS_SUPER_MAGIC;
	sb->s_op = &binderfs_super_ops;
	sb->s_time_gran = 1;

	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
	if (!sb->s_fs_info)
		return -ENOMEM;
	info = sb->s_fs_info;

	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);

	ret = binderfs_parse_mount_opts(data, &info->mount_opts);
	if (ret)
		return ret;

	info->root_gid = make_kgid(sb->s_user_ns, 0);
	if (!gid_valid(info->root_gid))
		info->root_gid = GLOBAL_ROOT_GID;
	info->root_uid = make_kuid(sb->s_user_ns, 0);
	if (!uid_valid(info->root_uid))
		info->root_uid = GLOBAL_ROOT_UID;

	inode = new_inode(sb);
	if (!inode)
		return -ENOMEM;

	inode->i_ino = FIRST_INODE;
	inode->i_fop = &simple_dir_operations;
	inode->i_mode = S_IFDIR | 0755;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	inode->i_op = &binderfs_dir_inode_operations;
	set_nlink(inode, 2);

	sb->s_root = d_make_root(inode);
	if (!sb->s_root)
		return -ENOMEM;

	return binderfs_binder_ctl_create(sb);
}

static struct dentry *binderfs_mount(struct file_system_type *fs_type,
				     int flags, const char *dev_name,
				     void *data)
{
	return mount_nodev(fs_type, flags, data, binderfs_fill_super);
}

static void binderfs_kill_super(struct super_block *sb)
{
	struct binderfs_info *info = sb->s_fs_info;

	kill_litter_super(sb);

	if (info && info->ipc_ns)
		put_ipc_ns(info->ipc_ns);

	kfree(info);
}

static struct file_system_type binder_fs_type = {
	.name		= "binder",
	.mount		= binderfs_mount,
	.kill_sb	= binderfs_kill_super,
	.fs_flags	= FS_USERNS_MOUNT,
};

int __init init_binderfs(void)
{
	int ret;

	/* Allocate new major number for binderfs. */
	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
				  "binder");
	if (ret)
		return ret;

	ret = register_filesystem(&binder_fs_type);
	if (ret) {
		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
		return ret;
	}

	return ret;
}
Commit	Line	Data
3ad20fe3 CB	1	/* SPDX-License-Identifier: GPL-2.0 */
	2
	3	#include <linux/compiler_types.h>
	4	#include <linux/errno.h>
	5	#include <linux/fs.h>
	6	#include <linux/fsnotify.h>
	7	#include <linux/gfp.h>
	8	#include <linux/idr.h>
	9	#include <linux/init.h>
	10	#include <linux/ipc_namespace.h>
	11	#include <linux/kdev_t.h>
	12	#include <linux/kernel.h>
	13	#include <linux/list.h>
01b3f1fc	14	#include <linux/namei.h>
3ad20fe3 CB	15	#include <linux/magic.h>
	16	#include <linux/major.h>
	17	#include <linux/miscdevice.h>
	18	#include <linux/module.h>
	19	#include <linux/mutex.h>
	20	#include <linux/mount.h>
	21	#include <linux/parser.h>
	22	#include <linux/radix-tree.h>
	23	#include <linux/sched.h>
849d540d	24	#include <linux/seq_file.h>
3ad20fe3 CB	25	#include <linux/slab.h>
	26	#include <linux/spinlock_types.h>
	27	#include <linux/stddef.h>
	28	#include <linux/string.h>
	29	#include <linux/types.h>
	30	#include <linux/uaccess.h>
	31	#include <linux/user_namespace.h>
	32	#include <linux/xarray.h>
	33	#include <uapi/asm-generic/errno-base.h>
	34	#include <uapi/linux/android/binder.h>
c13295ad	35	#include <uapi/linux/android/binderfs.h>
3ad20fe3 CB	36
	37	#include "binder_internal.h"
	38
	39	#define FIRST_INODE 1
	40	#define SECOND_INODE 2
	41	#define INODE_OFFSET 3
	42	#define INTSTRLEN 21
	43	#define BINDERFS_MAX_MINOR (1U << MINORBITS)
36bdf3ca CB	44	/* Ensure that the initial ipc namespace always has devices available. */
36bdf3ca CB	45	#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
3ad20fe3	46
3ad20fe3 CB	47	static dev_t binderfs_dev;
	48	static DEFINE_MUTEX(binderfs_minors_mutex);
	49	static DEFINE_IDA(binderfs_minors);
	50
849d540d CB	51	/**
	52	* binderfs_mount_opts - mount options for binderfs
	53	* @max: maximum number of allocatable binderfs binder devices
	54	*/
	55	struct binderfs_mount_opts {
	56	int max;
	57	};
	58
	59	enum {
	60	Opt_max,
	61	Opt_err
	62	};
	63
	64	static const match_table_t tokens = {
	65	{ Opt_max, "max=%d" },
	66	{ Opt_err, NULL }
	67	};
	68
3ad20fe3 CB	69	/**
	70	* binderfs_info - information about a binderfs mount
	71	* @ipc_ns: The ipc namespace the binderfs mount belongs to.
	72	* @control_dentry: This records the dentry of this binderfs mount
	73	* binder-control device.
	74	* @root_uid: uid that needs to be used when a new binder device is
	75	* created.
	76	* @root_gid: gid that needs to be used when a new binder device is
	77	* created.
849d540d CB	78	* @mount_opts: The mount options in use.
849d540d CB	79	* @device_count: The current number of allocated binder devices.
3ad20fe3 CB	80	*/
	81	struct binderfs_info {
	82	struct ipc_namespace *ipc_ns;
	83	struct dentry *control_dentry;
	84	kuid_t root_uid;
	85	kgid_t root_gid;
849d540d CB	86	struct binderfs_mount_opts mount_opts;
849d540d CB	87	int device_count;
3ad20fe3 CB	88	};
	89
	90	static inline struct binderfs_info BINDERFS_I(const struct inode inode)
	91	{
	92	return inode->i_sb->s_fs_info;
	93	}
	94
	95	bool is_binderfs_device(const struct inode *inode)
	96	{
	97	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
	98	return true;
	99
	100	return false;
	101	}
	102
	103	/**
	104	* binderfs_binder_device_create - allocate inode from super block of a
	105	* binderfs mount
	106	* @ref_inode: inode from wich the super block will be taken
	107	* @userp: buffer to copy information about new device for userspace to
	108	* @req: struct binderfs_device as copied from userspace
	109	*
01b3f1fc	110	* This function allocates a new binder_device and reserves a new minor
3ad20fe3 CB	111	* number for it.
	112	* Minor numbers are limited and tracked globally in binderfs_minors. The
	113	* function will stash a struct binder_device for the specific binder
	114	* device in i_private of the inode.
	115	* It will go on to allocate a new inode from the super block of the
	116	* filesystem mount, stash a struct binder_device in its i_private field
	117	* and attach a dentry to that inode.
	118	*
	119	* Return: 0 on success, negative errno on failure
	120	*/
	121	static int binderfs_binder_device_create(struct inode *ref_inode,
	122	struct binderfs_device __user *userp,
	123	struct binderfs_device *req)
	124	{
	125	int minor, ret;
01b3f1fc	126	struct dentry dentry, root;
3ad20fe3	127	struct binder_device *device;
3ad20fe3	128	char *name = NULL;
01b3f1fc	129	size_t name_len;
3ad20fe3 CB	130	struct inode *inode = NULL;
	131	struct super_block *sb = ref_inode->i_sb;
	132	struct binderfs_info *info = sb->s_fs_info;
7fefaadd	133	#if defined(CONFIG_IPC_NS)
36bdf3ca	134	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
7fefaadd CB	135	#else
	136	bool use_reserve = true;
	137	#endif
3ad20fe3 CB	138
	139	/* Reserve new minor number for the new device. */
	140	mutex_lock(&binderfs_minors_mutex);
849d540d	141	if (++info->device_count <= info->mount_opts.max)
36bdf3ca CB	142	minor = ida_alloc_max(&binderfs_minors,
	143	use_reserve ? BINDERFS_MAX_MINOR :
	144	BINDERFS_MAX_MINOR_CAPPED,
849d540d CB	145	GFP_KERNEL);
	146	else
	147	minor = -ENOSPC;
	148	if (minor < 0) {
	149	--info->device_count;
	150	mutex_unlock(&binderfs_minors_mutex);
3ad20fe3	151	return minor;
849d540d CB	152	}
849d540d CB	153	mutex_unlock(&binderfs_minors_mutex);
3ad20fe3 CB	154
	155	ret = -ENOMEM;
	156	device = kzalloc(sizeof(*device), GFP_KERNEL);
	157	if (!device)
	158	goto err;
	159
	160	inode = new_inode(sb);
	161	if (!inode)
	162	goto err;
	163
	164	inode->i_ino = minor + INODE_OFFSET;
	165	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	166	init_special_inode(inode, S_IFCHR \| 0600,
	167	MKDEV(MAJOR(binderfs_dev), minor));
	168	inode->i_fop = &binder_fops;
	169	inode->i_uid = info->root_uid;
	170	inode->i_gid = info->root_gid;
	171
01b3f1fc CB	172	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
	173	name_len = strlen(req->name);
	174	/* Make sure to include terminating NUL byte */
	175	name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
3ad20fe3 CB	176	if (!name)
	177	goto err;
	178
3ad20fe3 CB	179	device->binderfs_inode = inode;
	180	device->context.binder_context_mgr_uid = INVALID_UID;
	181	device->context.name = name;
	182	device->miscdev.name = name;
	183	device->miscdev.minor = minor;
	184	mutex_init(&device->context.context_mgr_node_lock);
	185
	186	req->major = MAJOR(binderfs_dev);
	187	req->minor = minor;
	188
	189	ret = copy_to_user(userp, req, sizeof(*req));
	190	if (ret) {
	191	ret = -EFAULT;
	192	goto err;
	193	}
	194
	195	root = sb->s_root;
	196	inode_lock(d_inode(root));
01b3f1fc CB	197
	198	/* look it up */
	199	dentry = lookup_one_len(name, root, name_len);
	200	if (IS_ERR(dentry)) {
3ad20fe3	201	inode_unlock(d_inode(root));
01b3f1fc	202	ret = PTR_ERR(dentry);
3ad20fe3 CB	203	goto err;
	204	}
	205
01b3f1fc CB	206	if (d_really_is_positive(dentry)) {
	207	/* already exists */
	208	dput(dentry);
	209	inode_unlock(d_inode(root));
	210	ret = -EEXIST;
	211	goto err;
3ad20fe3 CB	212	}
	213
	214	inode->i_private = device;
01684db9	215	d_instantiate(dentry, inode);
3ad20fe3 CB	216	fsnotify_create(root->d_inode, dentry);
	217	inode_unlock(d_inode(root));
	218
	219	return 0;
	220
	221	err:
	222	kfree(name);
	223	kfree(device);
	224	mutex_lock(&binderfs_minors_mutex);
849d540d	225	--info->device_count;
3ad20fe3 CB	226	ida_free(&binderfs_minors, minor);
	227	mutex_unlock(&binderfs_minors_mutex);
	228	iput(inode);
	229
	230	return ret;
	231	}
	232
	233	/**
	234	* binderfs_ctl_ioctl - handle binder device node allocation requests
	235	*
	236	* The request handler for the binder-control device. All requests operate on
	237	* the binderfs mount the binder-control device resides in:
	238	* - BINDER_CTL_ADD
	239	* Allocate a new binder device.
	240	*
	241	* Return: 0 on success, negative errno on failure
	242	*/
	243	static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
	244	unsigned long arg)
	245	{
	246	int ret = -EINVAL;
	247	struct inode *inode = file_inode(file);
	248	struct binderfs_device __user device = (struct binderfs_device __user )arg;
	249	struct binderfs_device device_req;
	250
	251	switch (cmd) {
	252	case BINDER_CTL_ADD:
	253	ret = copy_from_user(&device_req, device, sizeof(device_req));
	254	if (ret) {
	255	ret = -EFAULT;
	256	break;
	257	}
	258
	259	ret = binderfs_binder_device_create(inode, device, &device_req);
	260	break;
	261	default:
	262	break;
	263	}
	264
	265	return ret;
	266	}
	267
	268	static void binderfs_evict_inode(struct inode *inode)
	269	{
	270	struct binder_device *device = inode->i_private;
849d540d	271	struct binderfs_info *info = BINDERFS_I(inode);
3ad20fe3 CB	272
	273	clear_inode(inode);
	274
	275	if (!device)
	276	return;
	277
	278	mutex_lock(&binderfs_minors_mutex);
849d540d	279	--info->device_count;
3ad20fe3 CB	280	ida_free(&binderfs_minors, device->miscdev.minor);
	281	mutex_unlock(&binderfs_minors_mutex);
	282
	283	kfree(device->context.name);
	284	kfree(device);
	285	}
	286
849d540d CB	287	/**
	288	* binderfs_parse_mount_opts - parse binderfs mount options
	289	* @data: options to set (can be NULL in which case defaults are used)
	290	*/
	291	static int binderfs_parse_mount_opts(char *data,
	292	struct binderfs_mount_opts *opts)
	293	{
	294	char *p;
	295	opts->max = BINDERFS_MAX_MINOR;
	296
	297	while ((p = strsep(&data, ",")) != NULL) {
	298	substring_t args[MAX_OPT_ARGS];
	299	int token;
	300	int max_devices;
	301
	302	if (!*p)
	303	continue;
	304
	305	token = match_token(p, tokens, args);
	306	switch (token) {
	307	case Opt_max:
	308	if (match_int(&args[0], &max_devices) \|\|
	309	(max_devices < 0 \|\|
	310	(max_devices > BINDERFS_MAX_MINOR)))
	311	return -EINVAL;
	312
	313	opts->max = max_devices;
	314	break;
	315	default:
	316	pr_err("Invalid mount options\n");
	317	return -EINVAL;
	318	}
	319	}
	320
	321	return 0;
	322	}
	323
	324	static int binderfs_remount(struct super_block sb, int flags, char *data)
	325	{
	326	struct binderfs_info *info = sb->s_fs_info;
	327	return binderfs_parse_mount_opts(data, &info->mount_opts);
	328	}
	329
	330	static int binderfs_show_mount_opts(struct seq_file seq, struct dentry root)
	331	{
	332	struct binderfs_info *info;
	333
	334	info = root->d_sb->s_fs_info;
	335	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
	336	seq_printf(seq, ",max=%d", info->mount_opts.max);
	337
	338	return 0;
	339	}
	340
3ad20fe3	341	static const struct super_operations binderfs_super_ops = {
849d540d CB	342	.evict_inode = binderfs_evict_inode,
	343	.remount_fs = binderfs_remount,
	344	.show_options = binderfs_show_mount_opts,
	345	.statfs = simple_statfs,
3ad20fe3 CB	346	};
3ad20fe3 CB	347
e98e6fa1 CB	348	static inline bool is_binderfs_control_device(const struct dentry *dentry)
	349	{
	350	struct binderfs_info *info = dentry->d_sb->s_fs_info;
	351	return info->control_dentry == dentry;
	352	}
	353
3ad20fe3 CB	354	static int binderfs_rename(struct inode old_dir, struct dentry old_dentry,
	355	struct inode new_dir, struct dentry new_dentry,
	356	unsigned int flags)
	357	{
e98e6fa1 CB	358	if (is_binderfs_control_device(old_dentry) \|\|
e98e6fa1 CB	359	is_binderfs_control_device(new_dentry))
3ad20fe3 CB	360	return -EPERM;
3ad20fe3 CB	361
e98e6fa1	362	return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
3ad20fe3 CB	363	}
	364
	365	static int binderfs_unlink(struct inode dir, struct dentry dentry)
	366	{
e98e6fa1	367	if (is_binderfs_control_device(dentry))
3ad20fe3 CB	368	return -EPERM;
	369
	370	return simple_unlink(dir, dentry);
	371	}
	372
	373	static const struct file_operations binder_ctl_fops = {
	374	.owner = THIS_MODULE,
	375	.open = nonseekable_open,
	376	.unlocked_ioctl = binder_ctl_ioctl,
	377	.compat_ioctl = binder_ctl_ioctl,
	378	.llseek = noop_llseek,
	379	};
	380
	381	/**
	382	* binderfs_binder_ctl_create - create a new binder-control device
	383	* @sb: super block of the binderfs mount
	384	*
	385	* This function creates a new binder-control device node in the binderfs mount
	386	* referred to by @sb.
	387	*
	388	* Return: 0 on success, negative errno on failure
	389	*/
	390	static int binderfs_binder_ctl_create(struct super_block *sb)
	391	{
	392	int minor, ret;
	393	struct dentry *dentry;
	394	struct binder_device *device;
	395	struct inode *inode = NULL;
	396	struct dentry *root = sb->s_root;
	397	struct binderfs_info *info = sb->s_fs_info;
da8ddba5 CB	398	#if defined(CONFIG_IPC_NS)
	399	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
	400	#else
	401	bool use_reserve = true;
	402	#endif
3ad20fe3 CB	403
	404	device = kzalloc(sizeof(*device), GFP_KERNEL);
	405	if (!device)
	406	return -ENOMEM;
	407
3ad20fe3 CB	408	/* If we have already created a binder-control node, return. */
	409	if (info->control_dentry) {
	410	ret = 0;
	411	goto out;
	412	}
	413
	414	ret = -ENOMEM;
	415	inode = new_inode(sb);
	416	if (!inode)
	417	goto out;
	418
	419	/* Reserve a new minor number for the new device. */
	420	mutex_lock(&binderfs_minors_mutex);
da8ddba5 CB	421	minor = ida_alloc_max(&binderfs_minors,
	422	use_reserve ? BINDERFS_MAX_MINOR :
	423	BINDERFS_MAX_MINOR_CAPPED,
	424	GFP_KERNEL);
3ad20fe3 CB	425	mutex_unlock(&binderfs_minors_mutex);
	426	if (minor < 0) {
	427	ret = minor;
	428	goto out;
	429	}
	430
	431	inode->i_ino = SECOND_INODE;
	432	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	433	init_special_inode(inode, S_IFCHR \| 0600,
	434	MKDEV(MAJOR(binderfs_dev), minor));
	435	inode->i_fop = &binder_ctl_fops;
	436	inode->i_uid = info->root_uid;
	437	inode->i_gid = info->root_gid;
	438
	439	device->binderfs_inode = inode;
	440	device->miscdev.minor = minor;
	441
	442	dentry = d_alloc_name(root, "binder-control");
	443	if (!dentry)
	444	goto out;
	445
	446	inode->i_private = device;
	447	info->control_dentry = dentry;
	448	d_add(dentry, inode);
3ad20fe3 CB	449
	450	return 0;
	451
	452	out:
3ad20fe3 CB	453	kfree(device);
	454	iput(inode);
	455
	456	return ret;
	457	}
	458
	459	static const struct inode_operations binderfs_dir_inode_operations = {
	460	.lookup = simple_lookup,
	461	.rename = binderfs_rename,
	462	.unlink = binderfs_unlink,
	463	};
	464
	465	static int binderfs_fill_super(struct super_block sb, void data, int silent)
	466	{
36975fc3	467	int ret;
3ad20fe3	468	struct binderfs_info *info;
3ad20fe3	469	struct inode *inode = NULL;
3ad20fe3 CB	470
	471	sb->s_blocksize = PAGE_SIZE;
	472	sb->s_blocksize_bits = PAGE_SHIFT;
	473
	474	/*
	475	* The binderfs filesystem can be mounted by userns root in a
	476	* non-initial userns. By default such mounts have the SB_I_NODEV flag
	477	* set in s_iflags to prevent security issues where userns root can
	478	* just create random device nodes via mknod() since it owns the
	479	* filesystem mount. But binderfs does not allow to create any files
	480	* including devices nodes. The only way to create binder devices nodes
	481	* is through the binder-control device which userns root is explicitly
	482	* allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
	483	* necessary and safe.
	484	*/
	485	sb->s_iflags &= ~SB_I_NODEV;
	486	sb->s_iflags \|= SB_I_NOEXEC;
	487	sb->s_magic = BINDERFS_SUPER_MAGIC;
	488	sb->s_op = &binderfs_super_ops;
	489	sb->s_time_gran = 1;
	490
36975fc3 CB	491	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
	492	if (!sb->s_fs_info)
	493	return -ENOMEM;
	494	info = sb->s_fs_info;
	495
	496	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
3ad20fe3	497
849d540d CB	498	ret = binderfs_parse_mount_opts(data, &info->mount_opts);
849d540d CB	499	if (ret)
36975fc3	500	return ret;
849d540d	501
3ad20fe3 CB	502	info->root_gid = make_kgid(sb->s_user_ns, 0);
	503	if (!gid_valid(info->root_gid))
	504	info->root_gid = GLOBAL_ROOT_GID;
	505	info->root_uid = make_kuid(sb->s_user_ns, 0);
	506	if (!uid_valid(info->root_uid))
	507	info->root_uid = GLOBAL_ROOT_UID;
	508
3ad20fe3 CB	509	inode = new_inode(sb);
3ad20fe3 CB	510	if (!inode)
36975fc3	511	return -ENOMEM;
3ad20fe3 CB	512
	513	inode->i_ino = FIRST_INODE;
	514	inode->i_fop = &simple_dir_operations;
	515	inode->i_mode = S_IFDIR \| 0755;
	516	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	517	inode->i_op = &binderfs_dir_inode_operations;
	518	set_nlink(inode, 2);
	519
	520	sb->s_root = d_make_root(inode);
	521	if (!sb->s_root)
36975fc3	522	return -ENOMEM;
3ad20fe3	523
36975fc3	524	return binderfs_binder_ctl_create(sb);
3ad20fe3 CB	525	}
3ad20fe3 CB	526
3ad20fe3 CB	527	static struct dentry binderfs_mount(struct file_system_type fs_type,
	528	int flags, const char *dev_name,
	529	void *data)
	530	{
b6c770d7	531	return mount_nodev(fs_type, flags, data, binderfs_fill_super);
3ad20fe3 CB	532	}
	533
	534	static void binderfs_kill_super(struct super_block *sb)
	535	{
	536	struct binderfs_info *info = sb->s_fs_info;
	537
41984795 CB	538	kill_litter_super(sb);
41984795 CB	539
3ad20fe3 CB	540	if (info && info->ipc_ns)
	541	put_ipc_ns(info->ipc_ns);
	542
	543	kfree(info);
3ad20fe3 CB	544	}
	545
	546	static struct file_system_type binder_fs_type = {
	547	.name = "binder",
	548	.mount = binderfs_mount,
	549	.kill_sb = binderfs_kill_super,
	550	.fs_flags = FS_USERNS_MOUNT,
	551	};
	552
5b9633af	553	int __init init_binderfs(void)
3ad20fe3 CB	554	{
	555	int ret;
	556
	557	/* Allocate new major number for binderfs. */
	558	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
	559	"binder");
	560	if (ret)
	561	return ret;
	562
	563	ret = register_filesystem(&binder_fs_type);
	564	if (ret) {
	565	unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
	566	return ret;
	567	}
	568
3ad20fe3 CB	569	return ret;
3ad20fe3 CB	570	}