[linux-block.git] / drivers / android / binderfs.c

/* SPDX-License-Identifier: GPL-2.0 */

#include <linux/compiler_types.h>
#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/fsnotify.h>
#include <linux/gfp.h>
#include <linux/idr.h>
#include <linux/init.h>
#include <linux/ipc_namespace.h>
#include <linux/kdev_t.h>
#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/magic.h>
#include <linux/major.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/mount.h>
#include <linux/parser.h>
#include <linux/radix-tree.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <linux/spinlock_types.h>
#include <linux/stddef.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/uaccess.h>
#include <linux/user_namespace.h>
#include <linux/xarray.h>
#include <uapi/asm-generic/errno-base.h>
#include <uapi/linux/android/binder.h>
#include <uapi/linux/android/binderfs.h>

#include "binder_internal.h"

#define FIRST_INODE 1
#define SECOND_INODE 2
#define INODE_OFFSET 3
#define INTSTRLEN 21
#define BINDERFS_MAX_MINOR (1U << MINORBITS)
/* Ensure that the initial ipc namespace always has devices available. */
#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)

static dev_t binderfs_dev;
static DEFINE_MUTEX(binderfs_minors_mutex);
static DEFINE_IDA(binderfs_minors);

/**
 * binderfs_mount_opts - mount options for binderfs
 * @max: maximum number of allocatable binderfs binder devices
 */
struct binderfs_mount_opts {
	int max;
};

enum {
	Opt_max,
	Opt_err
};

static const match_table_t tokens = {
	{ Opt_max, "max=%d" },
	{ Opt_err, NULL     }
};

/**
 * binderfs_info - information about a binderfs mount
 * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
 * @control_dentry: This records the dentry of this binderfs mount
 *                  binder-control device.
 * @root_uid:       uid that needs to be used when a new binder device is
 *                  created.
 * @root_gid:       gid that needs to be used when a new binder device is
 *                  created.
 * @mount_opts:     The mount options in use.
 * @device_count:   The current number of allocated binder devices.
 */
struct binderfs_info {
	struct ipc_namespace *ipc_ns;
	struct dentry *control_dentry;
	kuid_t root_uid;
	kgid_t root_gid;
	struct binderfs_mount_opts mount_opts;
	int device_count;
};

static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
{
	return inode->i_sb->s_fs_info;
}

bool is_binderfs_device(const struct inode *inode)
{
	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
		return true;

	return false;
}

/**
 * binderfs_binder_device_create - allocate inode from super block of a
 *                                 binderfs mount
 * @ref_inode: inode from wich the super block will be taken
 * @userp:     buffer to copy information about new device for userspace to
 * @req:       struct binderfs_device as copied from userspace
 *
 * This function allocated a new binder_device and reserves a new minor
 * number for it.
 * Minor numbers are limited and tracked globally in binderfs_minors. The
 * function will stash a struct binder_device for the specific binder
 * device in i_private of the inode.
 * It will go on to allocate a new inode from the super block of the
 * filesystem mount, stash a struct binder_device in its i_private field
 * and attach a dentry to that inode.
 *
 * Return: 0 on success, negative errno on failure
 */
static int binderfs_binder_device_create(struct inode *ref_inode,
					 struct binderfs_device __user *userp,
					 struct binderfs_device *req)
{
	int minor, ret;
	struct dentry *dentry, *dup, *root;
	struct binder_device *device;
	size_t name_len = BINDERFS_MAX_NAME + 1;
	char *name = NULL;
	struct inode *inode = NULL;
	struct super_block *sb = ref_inode->i_sb;
	struct binderfs_info *info = sb->s_fs_info;
#if defined(CONFIG_IPC_NS)
	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
#else
	bool use_reserve = true;
#endif

	/* Reserve new minor number for the new device. */
	mutex_lock(&binderfs_minors_mutex);
	if (++info->device_count <= info->mount_opts.max)
		minor = ida_alloc_max(&binderfs_minors,
				      use_reserve ? BINDERFS_MAX_MINOR :
						    BINDERFS_MAX_MINOR_CAPPED,
				      GFP_KERNEL);
	else
		minor = -ENOSPC;
	if (minor < 0) {
		--info->device_count;
		mutex_unlock(&binderfs_minors_mutex);
		return minor;
	}
	mutex_unlock(&binderfs_minors_mutex);

	ret = -ENOMEM;
	device = kzalloc(sizeof(*device), GFP_KERNEL);
	if (!device)
		goto err;

	inode = new_inode(sb);
	if (!inode)
		goto err;

	inode->i_ino = minor + INODE_OFFSET;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	init_special_inode(inode, S_IFCHR | 0600,
			   MKDEV(MAJOR(binderfs_dev), minor));
	inode->i_fop = &binder_fops;
	inode->i_uid = info->root_uid;
	inode->i_gid = info->root_gid;

	name = kmalloc(name_len, GFP_KERNEL);
	if (!name)
		goto err;

	strscpy(name, req->name, name_len);

	device->binderfs_inode = inode;
	device->context.binder_context_mgr_uid = INVALID_UID;
	device->context.name = name;
	device->miscdev.name = name;
	device->miscdev.minor = minor;
	mutex_init(&device->context.context_mgr_node_lock);

	req->major = MAJOR(binderfs_dev);
	req->minor = minor;

	ret = copy_to_user(userp, req, sizeof(*req));
	if (ret) {
		ret = -EFAULT;
		goto err;
	}

	root = sb->s_root;
	inode_lock(d_inode(root));
	dentry = d_alloc_name(root, name);
	if (!dentry) {
		inode_unlock(d_inode(root));
		ret = -ENOMEM;
		goto err;
	}

	/* Verify that the name userspace gave us is not already in use. */
	dup = d_lookup(root, &dentry->d_name);
	if (dup) {
		if (d_really_is_positive(dup)) {
			dput(dup);
			dput(dentry);
			inode_unlock(d_inode(root));
			ret = -EEXIST;
			goto err;
		}
		dput(dup);
	}

	inode->i_private = device;
	d_add(dentry, inode);
	fsnotify_create(root->d_inode, dentry);
	inode_unlock(d_inode(root));

	return 0;

err:
	kfree(name);
	kfree(device);
	mutex_lock(&binderfs_minors_mutex);
	--info->device_count;
	ida_free(&binderfs_minors, minor);
	mutex_unlock(&binderfs_minors_mutex);
	iput(inode);

	return ret;
}

/**
 * binderfs_ctl_ioctl - handle binder device node allocation requests
 *
 * The request handler for the binder-control device. All requests operate on
 * the binderfs mount the binder-control device resides in:
 * - BINDER_CTL_ADD
 *   Allocate a new binder device.
 *
 * Return: 0 on success, negative errno on failure
 */
static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
			     unsigned long arg)
{
	int ret = -EINVAL;
	struct inode *inode = file_inode(file);
	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
	struct binderfs_device device_req;

	switch (cmd) {
	case BINDER_CTL_ADD:
		ret = copy_from_user(&device_req, device, sizeof(device_req));
		if (ret) {
			ret = -EFAULT;
			break;
		}

		ret = binderfs_binder_device_create(inode, device, &device_req);
		break;
	default:
		break;
	}

	return ret;
}

static void binderfs_evict_inode(struct inode *inode)
{
	struct binder_device *device = inode->i_private;
	struct binderfs_info *info = BINDERFS_I(inode);

	clear_inode(inode);

	if (!device)
		return;

	mutex_lock(&binderfs_minors_mutex);
	--info->device_count;
	ida_free(&binderfs_minors, device->miscdev.minor);
	mutex_unlock(&binderfs_minors_mutex);

	kfree(device->context.name);
	kfree(device);
}

/**
 * binderfs_parse_mount_opts - parse binderfs mount options
 * @data: options to set (can be NULL in which case defaults are used)
 */
static int binderfs_parse_mount_opts(char *data,
				     struct binderfs_mount_opts *opts)
{
	char *p;
	opts->max = BINDERFS_MAX_MINOR;

	while ((p = strsep(&data, ",")) != NULL) {
		substring_t args[MAX_OPT_ARGS];
		int token;
		int max_devices;

		if (!*p)
			continue;

		token = match_token(p, tokens, args);
		switch (token) {
		case Opt_max:
			if (match_int(&args[0], &max_devices) ||
			    (max_devices < 0 ||
			     (max_devices > BINDERFS_MAX_MINOR)))
				return -EINVAL;

			opts->max = max_devices;
			break;
		default:
			pr_err("Invalid mount options\n");
			return -EINVAL;
		}
	}

	return 0;
}

static int binderfs_remount(struct super_block *sb, int *flags, char *data)
{
	struct binderfs_info *info = sb->s_fs_info;
	return binderfs_parse_mount_opts(data, &info->mount_opts);
}

static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
{
	struct binderfs_info *info;

	info = root->d_sb->s_fs_info;
	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
		seq_printf(seq, ",max=%d", info->mount_opts.max);

	return 0;
}

static const struct super_operations binderfs_super_ops = {
	.evict_inode    = binderfs_evict_inode,
	.remount_fs	= binderfs_remount,
	.show_options	= binderfs_show_mount_opts,
	.statfs         = simple_statfs,
};

static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
			   struct inode *new_dir, struct dentry *new_dentry,
			   unsigned int flags)
{
	struct inode *inode = d_inode(old_dentry);

	/* binderfs doesn't support directories. */
	if (d_is_dir(old_dentry))
		return -EPERM;

	if (flags & ~RENAME_NOREPLACE)
		return -EINVAL;

	if (!simple_empty(new_dentry))
		return -ENOTEMPTY;

	if (d_really_is_positive(new_dentry))
		simple_unlink(new_dir, new_dentry);

	old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
		new_dir->i_mtime = inode->i_ctime = current_time(old_dir);

	return 0;
}

static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
{
	if (BINDERFS_I(dir)->control_dentry == dentry)
		return -EPERM;

	return simple_unlink(dir, dentry);
}

static const struct file_operations binder_ctl_fops = {
	.owner		= THIS_MODULE,
	.open		= nonseekable_open,
	.unlocked_ioctl	= binder_ctl_ioctl,
	.compat_ioctl	= binder_ctl_ioctl,
	.llseek		= noop_llseek,
};

/**
 * binderfs_binder_ctl_create - create a new binder-control device
 * @sb: super block of the binderfs mount
 *
 * This function creates a new binder-control device node in the binderfs mount
 * referred to by @sb.
 *
 * Return: 0 on success, negative errno on failure
 */
static int binderfs_binder_ctl_create(struct super_block *sb)
{
	int minor, ret;
	struct dentry *dentry;
	struct binder_device *device;
	struct inode *inode = NULL;
	struct dentry *root = sb->s_root;
	struct binderfs_info *info = sb->s_fs_info;

	device = kzalloc(sizeof(*device), GFP_KERNEL);
	if (!device)
		return -ENOMEM;

	inode_lock(d_inode(root));

	/* If we have already created a binder-control node, return. */
	if (info->control_dentry) {
		ret = 0;
		goto out;
	}

	ret = -ENOMEM;
	inode = new_inode(sb);
	if (!inode)
		goto out;

	/* Reserve a new minor number for the new device. */
	mutex_lock(&binderfs_minors_mutex);
	minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
	mutex_unlock(&binderfs_minors_mutex);
	if (minor < 0) {
		ret = minor;
		goto out;
	}

	inode->i_ino = SECOND_INODE;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	init_special_inode(inode, S_IFCHR | 0600,
			   MKDEV(MAJOR(binderfs_dev), minor));
	inode->i_fop = &binder_ctl_fops;
	inode->i_uid = info->root_uid;
	inode->i_gid = info->root_gid;

	device->binderfs_inode = inode;
	device->miscdev.minor = minor;

	dentry = d_alloc_name(root, "binder-control");
	if (!dentry)
		goto out;

	inode->i_private = device;
	info->control_dentry = dentry;
	d_add(dentry, inode);
	inode_unlock(d_inode(root));

	return 0;

out:
	inode_unlock(d_inode(root));
	kfree(device);
	iput(inode);

	return ret;
}

static const struct inode_operations binderfs_dir_inode_operations = {
	.lookup = simple_lookup,
	.rename = binderfs_rename,
	.unlink = binderfs_unlink,
};

static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
{
	struct binderfs_info *info;
	int ret = -ENOMEM;
	struct inode *inode = NULL;
	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;

	get_ipc_ns(ipc_ns);

	sb->s_blocksize = PAGE_SIZE;
	sb->s_blocksize_bits = PAGE_SHIFT;

	/*
	 * The binderfs filesystem can be mounted by userns root in a
	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
	 * set in s_iflags to prevent security issues where userns root can
	 * just create random device nodes via mknod() since it owns the
	 * filesystem mount. But binderfs does not allow to create any files
	 * including devices nodes. The only way to create binder devices nodes
	 * is through the binder-control device which userns root is explicitly
	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
	 * necessary and safe.
	 */
	sb->s_iflags &= ~SB_I_NODEV;
	sb->s_iflags |= SB_I_NOEXEC;
	sb->s_magic = BINDERFS_SUPER_MAGIC;
	sb->s_op = &binderfs_super_ops;
	sb->s_time_gran = 1;

	info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
	if (!info)
		goto err_without_dentry;

	ret = binderfs_parse_mount_opts(data, &info->mount_opts);
	if (ret)
		goto err_without_dentry;

	info->ipc_ns = ipc_ns;
	info->root_gid = make_kgid(sb->s_user_ns, 0);
	if (!gid_valid(info->root_gid))
		info->root_gid = GLOBAL_ROOT_GID;
	info->root_uid = make_kuid(sb->s_user_ns, 0);
	if (!uid_valid(info->root_uid))
		info->root_uid = GLOBAL_ROOT_UID;

	sb->s_fs_info = info;

	ret = -ENOMEM;
	inode = new_inode(sb);
	if (!inode)
		goto err_without_dentry;

	inode->i_ino = FIRST_INODE;
	inode->i_fop = &simple_dir_operations;
	inode->i_mode = S_IFDIR | 0755;
	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	inode->i_op = &binderfs_dir_inode_operations;
	set_nlink(inode, 2);

	sb->s_root = d_make_root(inode);
	if (!sb->s_root)
		goto err_without_dentry;

	ret = binderfs_binder_ctl_create(sb);
	if (ret)
		goto err_with_dentry;

	return 0;

err_with_dentry:
	dput(sb->s_root);
	sb->s_root = NULL;

err_without_dentry:
	put_ipc_ns(ipc_ns);
	iput(inode);
	kfree(info);

	return ret;
}

static struct dentry *binderfs_mount(struct file_system_type *fs_type,
				     int flags, const char *dev_name,
				     void *data)
{
	return mount_nodev(fs_type, flags, data, binderfs_fill_super);
}

static void binderfs_kill_super(struct super_block *sb)
{
	struct binderfs_info *info = sb->s_fs_info;

	if (info && info->ipc_ns)
		put_ipc_ns(info->ipc_ns);

	kfree(info);
	kill_litter_super(sb);
}

static struct file_system_type binder_fs_type = {
	.name		= "binder",
	.mount		= binderfs_mount,
	.kill_sb	= binderfs_kill_super,
	.fs_flags	= FS_USERNS_MOUNT,
};

static int __init init_binderfs(void)
{
	int ret;

	/* Allocate new major number for binderfs. */
	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
				  "binder");
	if (ret)
		return ret;

	ret = register_filesystem(&binder_fs_type);
	if (ret) {
		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
		return ret;
	}

	return ret;
}

device_initcall(init_binderfs);
Commit	Line	Data
3ad20fe3 CB	1	/* SPDX-License-Identifier: GPL-2.0 */
	2
	3	#include <linux/compiler_types.h>
	4	#include <linux/errno.h>
	5	#include <linux/fs.h>
	6	#include <linux/fsnotify.h>
	7	#include <linux/gfp.h>
	8	#include <linux/idr.h>
	9	#include <linux/init.h>
	10	#include <linux/ipc_namespace.h>
	11	#include <linux/kdev_t.h>
	12	#include <linux/kernel.h>
	13	#include <linux/list.h>
	14	#include <linux/magic.h>
	15	#include <linux/major.h>
	16	#include <linux/miscdevice.h>
	17	#include <linux/module.h>
	18	#include <linux/mutex.h>
	19	#include <linux/mount.h>
	20	#include <linux/parser.h>
	21	#include <linux/radix-tree.h>
	22	#include <linux/sched.h>
849d540d	23	#include <linux/seq_file.h>
3ad20fe3 CB	24	#include <linux/slab.h>
	25	#include <linux/spinlock_types.h>
	26	#include <linux/stddef.h>
	27	#include <linux/string.h>
	28	#include <linux/types.h>
	29	#include <linux/uaccess.h>
	30	#include <linux/user_namespace.h>
	31	#include <linux/xarray.h>
	32	#include <uapi/asm-generic/errno-base.h>
	33	#include <uapi/linux/android/binder.h>
c13295ad	34	#include <uapi/linux/android/binderfs.h>
3ad20fe3 CB	35
	36	#include "binder_internal.h"
	37
	38	#define FIRST_INODE 1
	39	#define SECOND_INODE 2
	40	#define INODE_OFFSET 3
	41	#define INTSTRLEN 21
	42	#define BINDERFS_MAX_MINOR (1U << MINORBITS)
36bdf3ca CB	43	/* Ensure that the initial ipc namespace always has devices available. */
36bdf3ca CB	44	#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
3ad20fe3	45
3ad20fe3 CB	46	static dev_t binderfs_dev;
	47	static DEFINE_MUTEX(binderfs_minors_mutex);
	48	static DEFINE_IDA(binderfs_minors);
	49
849d540d CB	50	/**
	51	* binderfs_mount_opts - mount options for binderfs
	52	* @max: maximum number of allocatable binderfs binder devices
	53	*/
	54	struct binderfs_mount_opts {
	55	int max;
	56	};
	57
	58	enum {
	59	Opt_max,
	60	Opt_err
	61	};
	62
	63	static const match_table_t tokens = {
	64	{ Opt_max, "max=%d" },
	65	{ Opt_err, NULL }
	66	};
	67
3ad20fe3 CB	68	/**
	69	* binderfs_info - information about a binderfs mount
	70	* @ipc_ns: The ipc namespace the binderfs mount belongs to.
	71	* @control_dentry: This records the dentry of this binderfs mount
	72	* binder-control device.
	73	* @root_uid: uid that needs to be used when a new binder device is
	74	* created.
	75	* @root_gid: gid that needs to be used when a new binder device is
	76	* created.
849d540d CB	77	* @mount_opts: The mount options in use.
849d540d CB	78	* @device_count: The current number of allocated binder devices.
3ad20fe3 CB	79	*/
	80	struct binderfs_info {
	81	struct ipc_namespace *ipc_ns;
	82	struct dentry *control_dentry;
	83	kuid_t root_uid;
	84	kgid_t root_gid;
849d540d CB	85	struct binderfs_mount_opts mount_opts;
849d540d CB	86	int device_count;
3ad20fe3 CB	87	};
	88
	89	static inline struct binderfs_info BINDERFS_I(const struct inode inode)
	90	{
	91	return inode->i_sb->s_fs_info;
	92	}
	93
	94	bool is_binderfs_device(const struct inode *inode)
	95	{
	96	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
	97	return true;
	98
	99	return false;
	100	}
	101
	102	/**
	103	* binderfs_binder_device_create - allocate inode from super block of a
	104	* binderfs mount
	105	* @ref_inode: inode from wich the super block will be taken
	106	* @userp: buffer to copy information about new device for userspace to
	107	* @req: struct binderfs_device as copied from userspace
	108	*
	109	* This function allocated a new binder_device and reserves a new minor
	110	* number for it.
	111	* Minor numbers are limited and tracked globally in binderfs_minors. The
	112	* function will stash a struct binder_device for the specific binder
	113	* device in i_private of the inode.
	114	* It will go on to allocate a new inode from the super block of the
	115	* filesystem mount, stash a struct binder_device in its i_private field
	116	* and attach a dentry to that inode.
	117	*
	118	* Return: 0 on success, negative errno on failure
	119	*/
	120	static int binderfs_binder_device_create(struct inode *ref_inode,
	121	struct binderfs_device __user *userp,
	122	struct binderfs_device *req)
	123	{
	124	int minor, ret;
	125	struct dentry dentry, dup, *root;
	126	struct binder_device *device;
	127	size_t name_len = BINDERFS_MAX_NAME + 1;
	128	char *name = NULL;
	129	struct inode *inode = NULL;
	130	struct super_block *sb = ref_inode->i_sb;
	131	struct binderfs_info *info = sb->s_fs_info;
7fefaadd	132	#if defined(CONFIG_IPC_NS)
36bdf3ca	133	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
7fefaadd CB	134	#else
	135	bool use_reserve = true;
	136	#endif
3ad20fe3 CB	137
	138	/* Reserve new minor number for the new device. */
	139	mutex_lock(&binderfs_minors_mutex);
849d540d	140	if (++info->device_count <= info->mount_opts.max)
36bdf3ca CB	141	minor = ida_alloc_max(&binderfs_minors,
	142	use_reserve ? BINDERFS_MAX_MINOR :
	143	BINDERFS_MAX_MINOR_CAPPED,
849d540d CB	144	GFP_KERNEL);
	145	else
	146	minor = -ENOSPC;
	147	if (minor < 0) {
	148	--info->device_count;
	149	mutex_unlock(&binderfs_minors_mutex);
3ad20fe3	150	return minor;
849d540d CB	151	}
849d540d CB	152	mutex_unlock(&binderfs_minors_mutex);
3ad20fe3 CB	153
	154	ret = -ENOMEM;
	155	device = kzalloc(sizeof(*device), GFP_KERNEL);
	156	if (!device)
	157	goto err;
	158
	159	inode = new_inode(sb);
	160	if (!inode)
	161	goto err;
	162
	163	inode->i_ino = minor + INODE_OFFSET;
	164	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	165	init_special_inode(inode, S_IFCHR \| 0600,
	166	MKDEV(MAJOR(binderfs_dev), minor));
	167	inode->i_fop = &binder_fops;
	168	inode->i_uid = info->root_uid;
	169	inode->i_gid = info->root_gid;
	170
	171	name = kmalloc(name_len, GFP_KERNEL);
	172	if (!name)
	173	goto err;
	174
	175	strscpy(name, req->name, name_len);
	176
	177	device->binderfs_inode = inode;
	178	device->context.binder_context_mgr_uid = INVALID_UID;
	179	device->context.name = name;
	180	device->miscdev.name = name;
	181	device->miscdev.minor = minor;
	182	mutex_init(&device->context.context_mgr_node_lock);
	183
	184	req->major = MAJOR(binderfs_dev);
	185	req->minor = minor;
	186
	187	ret = copy_to_user(userp, req, sizeof(*req));
	188	if (ret) {
	189	ret = -EFAULT;
	190	goto err;
	191	}
	192
	193	root = sb->s_root;
	194	inode_lock(d_inode(root));
	195	dentry = d_alloc_name(root, name);
	196	if (!dentry) {
	197	inode_unlock(d_inode(root));
	198	ret = -ENOMEM;
	199	goto err;
	200	}
	201
	202	/* Verify that the name userspace gave us is not already in use. */
	203	dup = d_lookup(root, &dentry->d_name);
	204	if (dup) {
	205	if (d_really_is_positive(dup)) {
	206	dput(dup);
	207	dput(dentry);
	208	inode_unlock(d_inode(root));
	209	ret = -EEXIST;
	210	goto err;
	211	}
	212	dput(dup);
	213	}
	214
	215	inode->i_private = device;
	216	d_add(dentry, inode);
217	fsnotify_create(root->d_inode, dentry);
218	inode_unlock(d_inode(root));
219
220	return 0;
221
222	err:
223	kfree(name);
224	kfree(device);
225	mutex_lock(&binderfs_minors_mutex);
849d540d	226	--info->device_count;
3ad20fe3 CB	227	ida_free(&binderfs_minors, minor);
	228	mutex_unlock(&binderfs_minors_mutex);
	229	iput(inode);
	230
	231	return ret;
	232	}
	233
	234	/**
	235	* binderfs_ctl_ioctl - handle binder device node allocation requests
	236	*
	237	* The request handler for the binder-control device. All requests operate on
	238	* the binderfs mount the binder-control device resides in:
	239	* - BINDER_CTL_ADD
	240	* Allocate a new binder device.
	241	*
	242	* Return: 0 on success, negative errno on failure
	243	*/
	244	static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
	245	unsigned long arg)
	246	{
	247	int ret = -EINVAL;
	248	struct inode *inode = file_inode(file);
	249	struct binderfs_device __user device = (struct binderfs_device __user )arg;
	250	struct binderfs_device device_req;
	251
	252	switch (cmd) {
	253	case BINDER_CTL_ADD:
	254	ret = copy_from_user(&device_req, device, sizeof(device_req));
	255	if (ret) {
	256	ret = -EFAULT;
	257	break;
	258	}
	259
	260	ret = binderfs_binder_device_create(inode, device, &device_req);
	261	break;
	262	default:
	263	break;
	264	}
	265
	266	return ret;
	267	}
	268
	269	static void binderfs_evict_inode(struct inode *inode)
	270	{
	271	struct binder_device *device = inode->i_private;
849d540d	272	struct binderfs_info *info = BINDERFS_I(inode);
3ad20fe3 CB	273
	274	clear_inode(inode);
	275
	276	if (!device)
	277	return;
	278
	279	mutex_lock(&binderfs_minors_mutex);
849d540d	280	--info->device_count;
3ad20fe3 CB	281	ida_free(&binderfs_minors, device->miscdev.minor);
	282	mutex_unlock(&binderfs_minors_mutex);
	283
	284	kfree(device->context.name);
	285	kfree(device);
	286	}
	287
849d540d CB	288	/**
	289	* binderfs_parse_mount_opts - parse binderfs mount options
	290	* @data: options to set (can be NULL in which case defaults are used)
	291	*/
	292	static int binderfs_parse_mount_opts(char *data,
	293	struct binderfs_mount_opts *opts)
	294	{
	295	char *p;
	296	opts->max = BINDERFS_MAX_MINOR;
	297
	298	while ((p = strsep(&data, ",")) != NULL) {
	299	substring_t args[MAX_OPT_ARGS];
	300	int token;
	301	int max_devices;
	302
	303	if (!*p)
	304	continue;
	305
	306	token = match_token(p, tokens, args);
	307	switch (token) {
	308	case Opt_max:
	309	if (match_int(&args[0], &max_devices) \|\|
	310	(max_devices < 0 \|\|
	311	(max_devices > BINDERFS_MAX_MINOR)))
	312	return -EINVAL;
	313
	314	opts->max = max_devices;
	315	break;
	316	default:
	317	pr_err("Invalid mount options\n");
	318	return -EINVAL;
	319	}
	320	}
	321
	322	return 0;
	323	}
	324
	325	static int binderfs_remount(struct super_block sb, int flags, char *data)
	326	{
	327	struct binderfs_info *info = sb->s_fs_info;
	328	return binderfs_parse_mount_opts(data, &info->mount_opts);
	329	}
	330
	331	static int binderfs_show_mount_opts(struct seq_file seq, struct dentry root)
	332	{
	333	struct binderfs_info *info;
	334
	335	info = root->d_sb->s_fs_info;
	336	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
	337	seq_printf(seq, ",max=%d", info->mount_opts.max);
	338
	339	return 0;
	340	}
	341
3ad20fe3	342	static const struct super_operations binderfs_super_ops = {
849d540d CB	343	.evict_inode = binderfs_evict_inode,
	344	.remount_fs = binderfs_remount,
	345	.show_options = binderfs_show_mount_opts,
	346	.statfs = simple_statfs,
3ad20fe3 CB	347	};
	348
	349	static int binderfs_rename(struct inode old_dir, struct dentry old_dentry,
	350	struct inode new_dir, struct dentry new_dentry,
	351	unsigned int flags)
	352	{
	353	struct inode *inode = d_inode(old_dentry);
	354
	355	/* binderfs doesn't support directories. */
	356	if (d_is_dir(old_dentry))
	357	return -EPERM;
	358
	359	if (flags & ~RENAME_NOREPLACE)
	360	return -EINVAL;
	361
	362	if (!simple_empty(new_dentry))
	363	return -ENOTEMPTY;
	364
	365	if (d_really_is_positive(new_dentry))
	366	simple_unlink(new_dir, new_dentry);
	367
	368	old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
	369	new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
	370
	371	return 0;
	372	}
	373
	374	static int binderfs_unlink(struct inode dir, struct dentry dentry)
	375	{
3ad20fe3 CB	376	if (BINDERFS_I(dir)->control_dentry == dentry)
	377	return -EPERM;
	378
	379	return simple_unlink(dir, dentry);
	380	}
	381
	382	static const struct file_operations binder_ctl_fops = {
	383	.owner = THIS_MODULE,
	384	.open = nonseekable_open,
	385	.unlocked_ioctl = binder_ctl_ioctl,
	386	.compat_ioctl = binder_ctl_ioctl,
	387	.llseek = noop_llseek,
	388	};
	389
	390	/**
	391	* binderfs_binder_ctl_create - create a new binder-control device
	392	* @sb: super block of the binderfs mount
	393	*
	394	* This function creates a new binder-control device node in the binderfs mount
	395	* referred to by @sb.
	396	*
	397	* Return: 0 on success, negative errno on failure
	398	*/
	399	static int binderfs_binder_ctl_create(struct super_block *sb)
	400	{
	401	int minor, ret;
	402	struct dentry *dentry;
	403	struct binder_device *device;
	404	struct inode *inode = NULL;
	405	struct dentry *root = sb->s_root;
	406	struct binderfs_info *info = sb->s_fs_info;
	407
	408	device = kzalloc(sizeof(*device), GFP_KERNEL);
	409	if (!device)
	410	return -ENOMEM;
	411
	412	inode_lock(d_inode(root));
	413
	414	/* If we have already created a binder-control node, return. */
	415	if (info->control_dentry) {
	416	ret = 0;
	417	goto out;
	418	}
	419
	420	ret = -ENOMEM;
	421	inode = new_inode(sb);
	422	if (!inode)
	423	goto out;
	424
	425	/* Reserve a new minor number for the new device. */
	426	mutex_lock(&binderfs_minors_mutex);
	427	minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
	428	mutex_unlock(&binderfs_minors_mutex);
	429	if (minor < 0) {
	430	ret = minor;
	431	goto out;
	432	}
	433
	434	inode->i_ino = SECOND_INODE;
	435	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	436	init_special_inode(inode, S_IFCHR \| 0600,
	437	MKDEV(MAJOR(binderfs_dev), minor));
	438	inode->i_fop = &binder_ctl_fops;
	439	inode->i_uid = info->root_uid;
440	inode->i_gid = info->root_gid;
441
442	device->binderfs_inode = inode;
443	device->miscdev.minor = minor;
444
445	dentry = d_alloc_name(root, "binder-control");
446	if (!dentry)
447	goto out;
448
449	inode->i_private = device;
450	info->control_dentry = dentry;
451	d_add(dentry, inode);
452	inode_unlock(d_inode(root));
453
454	return 0;
455
456	out:
457	inode_unlock(d_inode(root));
458	kfree(device);
459	iput(inode);
460
461	return ret;
462	}
463
464	static const struct inode_operations binderfs_dir_inode_operations = {
465	.lookup = simple_lookup,
466	.rename = binderfs_rename,
467	.unlink = binderfs_unlink,
468	};
469
470	static int binderfs_fill_super(struct super_block sb, void data, int silent)
471	{
472	struct binderfs_info *info;
473	int ret = -ENOMEM;
474	struct inode *inode = NULL;
b6c770d7	475	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
3ad20fe3 CB	476
	477	get_ipc_ns(ipc_ns);
	478
	479	sb->s_blocksize = PAGE_SIZE;
	480	sb->s_blocksize_bits = PAGE_SHIFT;
	481
	482	/*
	483	* The binderfs filesystem can be mounted by userns root in a
	484	* non-initial userns. By default such mounts have the SB_I_NODEV flag
	485	* set in s_iflags to prevent security issues where userns root can
	486	* just create random device nodes via mknod() since it owns the
	487	* filesystem mount. But binderfs does not allow to create any files
	488	* including devices nodes. The only way to create binder devices nodes
	489	* is through the binder-control device which userns root is explicitly
	490	* allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
	491	* necessary and safe.
	492	*/
	493	sb->s_iflags &= ~SB_I_NODEV;
	494	sb->s_iflags \|= SB_I_NOEXEC;
	495	sb->s_magic = BINDERFS_SUPER_MAGIC;
	496	sb->s_op = &binderfs_super_ops;
	497	sb->s_time_gran = 1;
	498
	499	info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
	500	if (!info)
	501	goto err_without_dentry;
	502
849d540d CB	503	ret = binderfs_parse_mount_opts(data, &info->mount_opts);
	504	if (ret)
	505	goto err_without_dentry;
	506
3ad20fe3 CB	507	info->ipc_ns = ipc_ns;
	508	info->root_gid = make_kgid(sb->s_user_ns, 0);
	509	if (!gid_valid(info->root_gid))
	510	info->root_gid = GLOBAL_ROOT_GID;
	511	info->root_uid = make_kuid(sb->s_user_ns, 0);
	512	if (!uid_valid(info->root_uid))
	513	info->root_uid = GLOBAL_ROOT_UID;
	514
	515	sb->s_fs_info = info;
	516
7e7ca774	517	ret = -ENOMEM;
3ad20fe3 CB	518	inode = new_inode(sb);
	519	if (!inode)
	520	goto err_without_dentry;
	521
	522	inode->i_ino = FIRST_INODE;
	523	inode->i_fop = &simple_dir_operations;
	524	inode->i_mode = S_IFDIR \| 0755;
	525	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
	526	inode->i_op = &binderfs_dir_inode_operations;
	527	set_nlink(inode, 2);
	528
	529	sb->s_root = d_make_root(inode);
	530	if (!sb->s_root)
	531	goto err_without_dentry;
	532
	533	ret = binderfs_binder_ctl_create(sb);
	534	if (ret)
	535	goto err_with_dentry;
	536
	537	return 0;
	538
	539	err_with_dentry:
	540	dput(sb->s_root);
	541	sb->s_root = NULL;
	542
	543	err_without_dentry:
	544	put_ipc_ns(ipc_ns);
	545	iput(inode);
	546	kfree(info);
	547
	548	return ret;
	549	}
	550
3ad20fe3 CB	551	static struct dentry binderfs_mount(struct file_system_type fs_type,
	552	int flags, const char *dev_name,
	553	void *data)
	554	{
b6c770d7	555	return mount_nodev(fs_type, flags, data, binderfs_fill_super);
3ad20fe3 CB	556	}
	557
	558	static void binderfs_kill_super(struct super_block *sb)
	559	{
	560	struct binderfs_info *info = sb->s_fs_info;
	561
	562	if (info && info->ipc_ns)
	563	put_ipc_ns(info->ipc_ns);
	564
	565	kfree(info);
	566	kill_litter_super(sb);
	567	}
	568
	569	static struct file_system_type binder_fs_type = {
	570	.name = "binder",
	571	.mount = binderfs_mount,
	572	.kill_sb = binderfs_kill_super,
	573	.fs_flags = FS_USERNS_MOUNT,
	574	};
	575
	576	static int __init init_binderfs(void)
	577	{
	578	int ret;
	579
	580	/* Allocate new major number for binderfs. */
	581	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
	582	"binder");
	583	if (ret)
	584	return ret;
	585
	586	ret = register_filesystem(&binder_fs_type);
	587	if (ret) {
	588	unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
	589	return ret;
	590	}
	591
3ad20fe3 CB	592	return ret;
	593	}
	594
	595	device_initcall(init_binderfs);