Commit | Line | Data |
---|---|---|
7e84522c | 1 | // SPDX-License-Identifier: GPL-2.0 |
3ad20fe3 CB |
2 | |
3 | #include <linux/compiler_types.h> | |
4 | #include <linux/errno.h> | |
5 | #include <linux/fs.h> | |
6 | #include <linux/fsnotify.h> | |
7 | #include <linux/gfp.h> | |
8 | #include <linux/idr.h> | |
9 | #include <linux/init.h> | |
10 | #include <linux/ipc_namespace.h> | |
11 | #include <linux/kdev_t.h> | |
12 | #include <linux/kernel.h> | |
13 | #include <linux/list.h> | |
01b3f1fc | 14 | #include <linux/namei.h> |
3ad20fe3 CB |
15 | #include <linux/magic.h> |
16 | #include <linux/major.h> | |
17 | #include <linux/miscdevice.h> | |
18 | #include <linux/module.h> | |
19 | #include <linux/mutex.h> | |
20 | #include <linux/mount.h> | |
095cf502 | 21 | #include <linux/fs_parser.h> |
3ad20fe3 CB |
22 | #include <linux/radix-tree.h> |
23 | #include <linux/sched.h> | |
849d540d | 24 | #include <linux/seq_file.h> |
3ad20fe3 CB |
25 | #include <linux/slab.h> |
26 | #include <linux/spinlock_types.h> | |
27 | #include <linux/stddef.h> | |
28 | #include <linux/string.h> | |
29 | #include <linux/types.h> | |
30 | #include <linux/uaccess.h> | |
31 | #include <linux/user_namespace.h> | |
32 | #include <linux/xarray.h> | |
33 | #include <uapi/asm-generic/errno-base.h> | |
34 | #include <uapi/linux/android/binder.h> | |
c13295ad | 35 | #include <uapi/linux/android/binderfs.h> |
3ad20fe3 CB |
36 | |
37 | #include "binder_internal.h" | |
38 | ||
39 | #define FIRST_INODE 1 | |
40 | #define SECOND_INODE 2 | |
41 | #define INODE_OFFSET 3 | |
42 | #define INTSTRLEN 21 | |
43 | #define BINDERFS_MAX_MINOR (1U << MINORBITS) | |
36bdf3ca CB |
44 | /* Ensure that the initial ipc namespace always has devices available. */ |
45 | #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4) | |
3ad20fe3 | 46 | |
3ad20fe3 CB |
47 | static dev_t binderfs_dev; |
48 | static DEFINE_MUTEX(binderfs_minors_mutex); | |
49 | static DEFINE_IDA(binderfs_minors); | |
50 | ||
095cf502 | 51 | enum binderfs_param { |
849d540d | 52 | Opt_max, |
f0083451 | 53 | Opt_stats_mode, |
849d540d CB |
54 | }; |
55 | ||
f0083451 | 56 | enum binderfs_stats_mode { |
095cf502 CB |
57 | binderfs_stats_mode_unset, |
58 | binderfs_stats_mode_global, | |
f0083451 HV |
59 | }; |
60 | ||
fc470abf CL |
61 | struct binder_features { |
62 | bool oneway_spam_detection; | |
d23386ed | 63 | bool extended_error; |
fc470abf CL |
64 | }; |
65 | ||
095cf502 CB |
66 | static const struct constant_table binderfs_param_stats[] = { |
67 | { "global", binderfs_stats_mode_global }, | |
68 | {} | |
849d540d CB |
69 | }; |
70 | ||
89320020 | 71 | static const struct fs_parameter_spec binderfs_fs_parameters[] = { |
095cf502 CB |
72 | fsparam_u32("max", Opt_max), |
73 | fsparam_enum("stats", Opt_stats_mode, binderfs_param_stats), | |
74 | {} | |
75 | }; | |
76 | ||
fc470abf CL |
77 | static struct binder_features binder_features = { |
78 | .oneway_spam_detection = true, | |
d23386ed | 79 | .extended_error = true, |
fc470abf CL |
80 | }; |
81 | ||
095cf502 | 82 | static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb) |
3ad20fe3 | 83 | { |
095cf502 | 84 | return sb->s_fs_info; |
3ad20fe3 CB |
85 | } |
86 | ||
87 | bool is_binderfs_device(const struct inode *inode) | |
88 | { | |
89 | if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC) | |
90 | return true; | |
91 | ||
92 | return false; | |
93 | } | |
94 | ||
95 | /** | |
96 | * binderfs_binder_device_create - allocate inode from super block of a | |
97 | * binderfs mount | |
98 | * @ref_inode: inode from wich the super block will be taken | |
99 | * @userp: buffer to copy information about new device for userspace to | |
100 | * @req: struct binderfs_device as copied from userspace | |
101 | * | |
01b3f1fc | 102 | * This function allocates a new binder_device and reserves a new minor |
3ad20fe3 CB |
103 | * number for it. |
104 | * Minor numbers are limited and tracked globally in binderfs_minors. The | |
105 | * function will stash a struct binder_device for the specific binder | |
106 | * device in i_private of the inode. | |
107 | * It will go on to allocate a new inode from the super block of the | |
108 | * filesystem mount, stash a struct binder_device in its i_private field | |
109 | * and attach a dentry to that inode. | |
110 | * | |
111 | * Return: 0 on success, negative errno on failure | |
112 | */ | |
113 | static int binderfs_binder_device_create(struct inode *ref_inode, | |
114 | struct binderfs_device __user *userp, | |
115 | struct binderfs_device *req) | |
116 | { | |
117 | int minor, ret; | |
01b3f1fc | 118 | struct dentry *dentry, *root; |
3ad20fe3 | 119 | struct binder_device *device; |
3ad20fe3 | 120 | char *name = NULL; |
01b3f1fc | 121 | size_t name_len; |
3ad20fe3 CB |
122 | struct inode *inode = NULL; |
123 | struct super_block *sb = ref_inode->i_sb; | |
124 | struct binderfs_info *info = sb->s_fs_info; | |
7fefaadd | 125 | #if defined(CONFIG_IPC_NS) |
36bdf3ca | 126 | bool use_reserve = (info->ipc_ns == &init_ipc_ns); |
7fefaadd CB |
127 | #else |
128 | bool use_reserve = true; | |
129 | #endif | |
3ad20fe3 CB |
130 | |
131 | /* Reserve new minor number for the new device. */ | |
132 | mutex_lock(&binderfs_minors_mutex); | |
849d540d | 133 | if (++info->device_count <= info->mount_opts.max) |
36bdf3ca CB |
134 | minor = ida_alloc_max(&binderfs_minors, |
135 | use_reserve ? BINDERFS_MAX_MINOR : | |
136 | BINDERFS_MAX_MINOR_CAPPED, | |
849d540d CB |
137 | GFP_KERNEL); |
138 | else | |
139 | minor = -ENOSPC; | |
140 | if (minor < 0) { | |
141 | --info->device_count; | |
142 | mutex_unlock(&binderfs_minors_mutex); | |
3ad20fe3 | 143 | return minor; |
849d540d CB |
144 | } |
145 | mutex_unlock(&binderfs_minors_mutex); | |
3ad20fe3 CB |
146 | |
147 | ret = -ENOMEM; | |
148 | device = kzalloc(sizeof(*device), GFP_KERNEL); | |
149 | if (!device) | |
150 | goto err; | |
151 | ||
152 | inode = new_inode(sb); | |
153 | if (!inode) | |
154 | goto err; | |
155 | ||
156 | inode->i_ino = minor + INODE_OFFSET; | |
157 | inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); | |
158 | init_special_inode(inode, S_IFCHR | 0600, | |
159 | MKDEV(MAJOR(binderfs_dev), minor)); | |
160 | inode->i_fop = &binder_fops; | |
161 | inode->i_uid = info->root_uid; | |
162 | inode->i_gid = info->root_gid; | |
163 | ||
01b3f1fc CB |
164 | req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */ |
165 | name_len = strlen(req->name); | |
166 | /* Make sure to include terminating NUL byte */ | |
167 | name = kmemdup(req->name, name_len + 1, GFP_KERNEL); | |
3ad20fe3 CB |
168 | if (!name) |
169 | goto err; | |
170 | ||
f0fe2c0f | 171 | refcount_set(&device->ref, 1); |
3ad20fe3 CB |
172 | device->binderfs_inode = inode; |
173 | device->context.binder_context_mgr_uid = INVALID_UID; | |
174 | device->context.name = name; | |
175 | device->miscdev.name = name; | |
176 | device->miscdev.minor = minor; | |
177 | mutex_init(&device->context.context_mgr_node_lock); | |
178 | ||
179 | req->major = MAJOR(binderfs_dev); | |
180 | req->minor = minor; | |
181 | ||
ca2864c6 | 182 | if (userp && copy_to_user(userp, req, sizeof(*req))) { |
3ad20fe3 CB |
183 | ret = -EFAULT; |
184 | goto err; | |
185 | } | |
186 | ||
187 | root = sb->s_root; | |
188 | inode_lock(d_inode(root)); | |
01b3f1fc CB |
189 | |
190 | /* look it up */ | |
191 | dentry = lookup_one_len(name, root, name_len); | |
192 | if (IS_ERR(dentry)) { | |
3ad20fe3 | 193 | inode_unlock(d_inode(root)); |
01b3f1fc | 194 | ret = PTR_ERR(dentry); |
3ad20fe3 CB |
195 | goto err; |
196 | } | |
197 | ||
01b3f1fc CB |
198 | if (d_really_is_positive(dentry)) { |
199 | /* already exists */ | |
200 | dput(dentry); | |
201 | inode_unlock(d_inode(root)); | |
202 | ret = -EEXIST; | |
203 | goto err; | |
3ad20fe3 CB |
204 | } |
205 | ||
206 | inode->i_private = device; | |
01684db9 | 207 | d_instantiate(dentry, inode); |
3ad20fe3 CB |
208 | fsnotify_create(root->d_inode, dentry); |
209 | inode_unlock(d_inode(root)); | |
210 | ||
211 | return 0; | |
212 | ||
213 | err: | |
214 | kfree(name); | |
215 | kfree(device); | |
216 | mutex_lock(&binderfs_minors_mutex); | |
849d540d | 217 | --info->device_count; |
3ad20fe3 CB |
218 | ida_free(&binderfs_minors, minor); |
219 | mutex_unlock(&binderfs_minors_mutex); | |
220 | iput(inode); | |
221 | ||
222 | return ret; | |
223 | } | |
224 | ||
225 | /** | |
226 | * binderfs_ctl_ioctl - handle binder device node allocation requests | |
227 | * | |
228 | * The request handler for the binder-control device. All requests operate on | |
229 | * the binderfs mount the binder-control device resides in: | |
230 | * - BINDER_CTL_ADD | |
231 | * Allocate a new binder device. | |
232 | * | |
233 | * Return: 0 on success, negative errno on failure | |
234 | */ | |
235 | static long binder_ctl_ioctl(struct file *file, unsigned int cmd, | |
236 | unsigned long arg) | |
237 | { | |
238 | int ret = -EINVAL; | |
239 | struct inode *inode = file_inode(file); | |
240 | struct binderfs_device __user *device = (struct binderfs_device __user *)arg; | |
241 | struct binderfs_device device_req; | |
242 | ||
243 | switch (cmd) { | |
244 | case BINDER_CTL_ADD: | |
245 | ret = copy_from_user(&device_req, device, sizeof(device_req)); | |
246 | if (ret) { | |
247 | ret = -EFAULT; | |
248 | break; | |
249 | } | |
250 | ||
251 | ret = binderfs_binder_device_create(inode, device, &device_req); | |
252 | break; | |
253 | default: | |
254 | break; | |
255 | } | |
256 | ||
257 | return ret; | |
258 | } | |
259 | ||
260 | static void binderfs_evict_inode(struct inode *inode) | |
261 | { | |
262 | struct binder_device *device = inode->i_private; | |
095cf502 | 263 | struct binderfs_info *info = BINDERFS_SB(inode->i_sb); |
3ad20fe3 CB |
264 | |
265 | clear_inode(inode); | |
266 | ||
0e13e452 | 267 | if (!S_ISCHR(inode->i_mode) || !device) |
3ad20fe3 CB |
268 | return; |
269 | ||
270 | mutex_lock(&binderfs_minors_mutex); | |
849d540d | 271 | --info->device_count; |
3ad20fe3 CB |
272 | ida_free(&binderfs_minors, device->miscdev.minor); |
273 | mutex_unlock(&binderfs_minors_mutex); | |
274 | ||
f0fe2c0f CB |
275 | if (refcount_dec_and_test(&device->ref)) { |
276 | kfree(device->context.name); | |
277 | kfree(device); | |
278 | } | |
3ad20fe3 CB |
279 | } |
280 | ||
095cf502 CB |
281 | static int binderfs_fs_context_parse_param(struct fs_context *fc, |
282 | struct fs_parameter *param) | |
849d540d | 283 | { |
095cf502 CB |
284 | int opt; |
285 | struct binderfs_mount_opts *ctx = fc->fs_private; | |
286 | struct fs_parse_result result; | |
f0083451 | 287 | |
095cf502 CB |
288 | opt = fs_parse(fc, binderfs_fs_parameters, param, &result); |
289 | if (opt < 0) | |
290 | return opt; | |
f0083451 | 291 | |
095cf502 CB |
292 | switch (opt) { |
293 | case Opt_max: | |
294 | if (result.uint_32 > BINDERFS_MAX_MINOR) | |
295 | return invalfc(fc, "Bad value for '%s'", param->key); | |
f0083451 | 296 | |
095cf502 CB |
297 | ctx->max = result.uint_32; |
298 | break; | |
299 | case Opt_stats_mode: | |
300 | if (!capable(CAP_SYS_ADMIN)) | |
301 | return -EPERM; | |
302 | ||
303 | ctx->stats_mode = result.uint_32; | |
304 | break; | |
305 | default: | |
306 | return invalfc(fc, "Unsupported parameter '%s'", param->key); | |
849d540d CB |
307 | } |
308 | ||
309 | return 0; | |
310 | } | |
311 | ||
095cf502 | 312 | static int binderfs_fs_context_reconfigure(struct fs_context *fc) |
849d540d | 313 | { |
095cf502 CB |
314 | struct binderfs_mount_opts *ctx = fc->fs_private; |
315 | struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb); | |
f0083451 | 316 | |
095cf502 CB |
317 | if (info->mount_opts.stats_mode != ctx->stats_mode) |
318 | return invalfc(fc, "Binderfs stats mode cannot be changed during a remount"); | |
f0083451 | 319 | |
095cf502 CB |
320 | info->mount_opts.stats_mode = ctx->stats_mode; |
321 | info->mount_opts.max = ctx->max; | |
f0083451 | 322 | return 0; |
849d540d CB |
323 | } |
324 | ||
095cf502 | 325 | static int binderfs_show_options(struct seq_file *seq, struct dentry *root) |
849d540d | 326 | { |
095cf502 | 327 | struct binderfs_info *info = BINDERFS_SB(root->d_sb); |
849d540d | 328 | |
849d540d CB |
329 | if (info->mount_opts.max <= BINDERFS_MAX_MINOR) |
330 | seq_printf(seq, ",max=%d", info->mount_opts.max); | |
095cf502 CB |
331 | |
332 | switch (info->mount_opts.stats_mode) { | |
333 | case binderfs_stats_mode_unset: | |
334 | break; | |
335 | case binderfs_stats_mode_global: | |
f0083451 | 336 | seq_printf(seq, ",stats=global"); |
095cf502 CB |
337 | break; |
338 | } | |
849d540d CB |
339 | |
340 | return 0; | |
341 | } | |
342 | ||
095cf502 CB |
343 | static void binderfs_put_super(struct super_block *sb) |
344 | { | |
345 | struct binderfs_info *info = sb->s_fs_info; | |
346 | ||
347 | if (info && info->ipc_ns) | |
348 | put_ipc_ns(info->ipc_ns); | |
349 | ||
350 | kfree(info); | |
351 | sb->s_fs_info = NULL; | |
352 | } | |
353 | ||
3ad20fe3 | 354 | static const struct super_operations binderfs_super_ops = { |
849d540d | 355 | .evict_inode = binderfs_evict_inode, |
095cf502 | 356 | .show_options = binderfs_show_options, |
849d540d | 357 | .statfs = simple_statfs, |
095cf502 | 358 | .put_super = binderfs_put_super, |
3ad20fe3 CB |
359 | }; |
360 | ||
e98e6fa1 CB |
361 | static inline bool is_binderfs_control_device(const struct dentry *dentry) |
362 | { | |
363 | struct binderfs_info *info = dentry->d_sb->s_fs_info; | |
81195f96 | 364 | |
e98e6fa1 CB |
365 | return info->control_dentry == dentry; |
366 | } | |
367 | ||
549c7297 CB |
368 | static int binderfs_rename(struct user_namespace *mnt_userns, |
369 | struct inode *old_dir, struct dentry *old_dentry, | |
3ad20fe3 CB |
370 | struct inode *new_dir, struct dentry *new_dentry, |
371 | unsigned int flags) | |
372 | { | |
e98e6fa1 CB |
373 | if (is_binderfs_control_device(old_dentry) || |
374 | is_binderfs_control_device(new_dentry)) | |
3ad20fe3 CB |
375 | return -EPERM; |
376 | ||
549c7297 CB |
377 | return simple_rename(&init_user_ns, old_dir, old_dentry, new_dir, |
378 | new_dentry, flags); | |
3ad20fe3 CB |
379 | } |
380 | ||
381 | static int binderfs_unlink(struct inode *dir, struct dentry *dentry) | |
382 | { | |
e98e6fa1 | 383 | if (is_binderfs_control_device(dentry)) |
3ad20fe3 CB |
384 | return -EPERM; |
385 | ||
386 | return simple_unlink(dir, dentry); | |
387 | } | |
388 | ||
389 | static const struct file_operations binder_ctl_fops = { | |
390 | .owner = THIS_MODULE, | |
391 | .open = nonseekable_open, | |
392 | .unlocked_ioctl = binder_ctl_ioctl, | |
393 | .compat_ioctl = binder_ctl_ioctl, | |
394 | .llseek = noop_llseek, | |
395 | }; | |
396 | ||
397 | /** | |
398 | * binderfs_binder_ctl_create - create a new binder-control device | |
399 | * @sb: super block of the binderfs mount | |
400 | * | |
401 | * This function creates a new binder-control device node in the binderfs mount | |
402 | * referred to by @sb. | |
403 | * | |
404 | * Return: 0 on success, negative errno on failure | |
405 | */ | |
406 | static int binderfs_binder_ctl_create(struct super_block *sb) | |
407 | { | |
408 | int minor, ret; | |
409 | struct dentry *dentry; | |
410 | struct binder_device *device; | |
411 | struct inode *inode = NULL; | |
412 | struct dentry *root = sb->s_root; | |
413 | struct binderfs_info *info = sb->s_fs_info; | |
da8ddba5 CB |
414 | #if defined(CONFIG_IPC_NS) |
415 | bool use_reserve = (info->ipc_ns == &init_ipc_ns); | |
416 | #else | |
417 | bool use_reserve = true; | |
418 | #endif | |
3ad20fe3 CB |
419 | |
420 | device = kzalloc(sizeof(*device), GFP_KERNEL); | |
421 | if (!device) | |
422 | return -ENOMEM; | |
423 | ||
3ad20fe3 CB |
424 | /* If we have already created a binder-control node, return. */ |
425 | if (info->control_dentry) { | |
426 | ret = 0; | |
427 | goto out; | |
428 | } | |
429 | ||
430 | ret = -ENOMEM; | |
431 | inode = new_inode(sb); | |
432 | if (!inode) | |
433 | goto out; | |
434 | ||
435 | /* Reserve a new minor number for the new device. */ | |
436 | mutex_lock(&binderfs_minors_mutex); | |
da8ddba5 CB |
437 | minor = ida_alloc_max(&binderfs_minors, |
438 | use_reserve ? BINDERFS_MAX_MINOR : | |
439 | BINDERFS_MAX_MINOR_CAPPED, | |
440 | GFP_KERNEL); | |
3ad20fe3 CB |
441 | mutex_unlock(&binderfs_minors_mutex); |
442 | if (minor < 0) { | |
443 | ret = minor; | |
444 | goto out; | |
445 | } | |
446 | ||
447 | inode->i_ino = SECOND_INODE; | |
448 | inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); | |
449 | init_special_inode(inode, S_IFCHR | 0600, | |
450 | MKDEV(MAJOR(binderfs_dev), minor)); | |
451 | inode->i_fop = &binder_ctl_fops; | |
452 | inode->i_uid = info->root_uid; | |
453 | inode->i_gid = info->root_gid; | |
454 | ||
211b64e4 | 455 | refcount_set(&device->ref, 1); |
3ad20fe3 CB |
456 | device->binderfs_inode = inode; |
457 | device->miscdev.minor = minor; | |
458 | ||
459 | dentry = d_alloc_name(root, "binder-control"); | |
460 | if (!dentry) | |
461 | goto out; | |
462 | ||
463 | inode->i_private = device; | |
464 | info->control_dentry = dentry; | |
465 | d_add(dentry, inode); | |
3ad20fe3 CB |
466 | |
467 | return 0; | |
468 | ||
469 | out: | |
3ad20fe3 CB |
470 | kfree(device); |
471 | iput(inode); | |
472 | ||
473 | return ret; | |
474 | } | |
475 | ||
476 | static const struct inode_operations binderfs_dir_inode_operations = { | |
477 | .lookup = simple_lookup, | |
478 | .rename = binderfs_rename, | |
479 | .unlink = binderfs_unlink, | |
480 | }; | |
481 | ||
0e13e452 HV |
482 | static struct inode *binderfs_make_inode(struct super_block *sb, int mode) |
483 | { | |
484 | struct inode *ret; | |
485 | ||
486 | ret = new_inode(sb); | |
487 | if (ret) { | |
488 | ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET); | |
489 | ret->i_mode = mode; | |
490 | ret->i_atime = ret->i_mtime = ret->i_ctime = current_time(ret); | |
491 | } | |
492 | return ret; | |
493 | } | |
494 | ||
495 | static struct dentry *binderfs_create_dentry(struct dentry *parent, | |
496 | const char *name) | |
497 | { | |
498 | struct dentry *dentry; | |
499 | ||
500 | dentry = lookup_one_len(name, parent, strlen(name)); | |
501 | if (IS_ERR(dentry)) | |
502 | return dentry; | |
503 | ||
504 | /* Return error if the file/dir already exists. */ | |
505 | if (d_really_is_positive(dentry)) { | |
506 | dput(dentry); | |
507 | return ERR_PTR(-EEXIST); | |
508 | } | |
509 | ||
510 | return dentry; | |
511 | } | |
512 | ||
4feb80fa HV |
513 | void binderfs_remove_file(struct dentry *dentry) |
514 | { | |
515 | struct inode *parent_inode; | |
516 | ||
517 | parent_inode = d_inode(dentry->d_parent); | |
518 | inode_lock(parent_inode); | |
519 | if (simple_positive(dentry)) { | |
520 | dget(dentry); | |
521 | simple_unlink(parent_inode, dentry); | |
522 | d_delete(dentry); | |
523 | dput(dentry); | |
524 | } | |
525 | inode_unlock(parent_inode); | |
526 | } | |
527 | ||
528 | struct dentry *binderfs_create_file(struct dentry *parent, const char *name, | |
529 | const struct file_operations *fops, | |
530 | void *data) | |
0e13e452 HV |
531 | { |
532 | struct dentry *dentry; | |
533 | struct inode *new_inode, *parent_inode; | |
534 | struct super_block *sb; | |
535 | ||
536 | parent_inode = d_inode(parent); | |
537 | inode_lock(parent_inode); | |
538 | ||
539 | dentry = binderfs_create_dentry(parent, name); | |
540 | if (IS_ERR(dentry)) | |
541 | goto out; | |
542 | ||
543 | sb = parent_inode->i_sb; | |
544 | new_inode = binderfs_make_inode(sb, S_IFREG | 0444); | |
545 | if (!new_inode) { | |
546 | dput(dentry); | |
547 | dentry = ERR_PTR(-ENOMEM); | |
548 | goto out; | |
549 | } | |
550 | ||
551 | new_inode->i_fop = fops; | |
552 | new_inode->i_private = data; | |
553 | d_instantiate(dentry, new_inode); | |
554 | fsnotify_create(parent_inode, dentry); | |
555 | ||
556 | out: | |
557 | inode_unlock(parent_inode); | |
558 | return dentry; | |
559 | } | |
560 | ||
561 | static struct dentry *binderfs_create_dir(struct dentry *parent, | |
562 | const char *name) | |
563 | { | |
564 | struct dentry *dentry; | |
565 | struct inode *new_inode, *parent_inode; | |
566 | struct super_block *sb; | |
567 | ||
568 | parent_inode = d_inode(parent); | |
569 | inode_lock(parent_inode); | |
570 | ||
571 | dentry = binderfs_create_dentry(parent, name); | |
572 | if (IS_ERR(dentry)) | |
573 | goto out; | |
574 | ||
575 | sb = parent_inode->i_sb; | |
576 | new_inode = binderfs_make_inode(sb, S_IFDIR | 0755); | |
577 | if (!new_inode) { | |
578 | dput(dentry); | |
579 | dentry = ERR_PTR(-ENOMEM); | |
580 | goto out; | |
581 | } | |
582 | ||
583 | new_inode->i_fop = &simple_dir_operations; | |
584 | new_inode->i_op = &simple_dir_inode_operations; | |
585 | ||
586 | set_nlink(new_inode, 2); | |
587 | d_instantiate(dentry, new_inode); | |
588 | inc_nlink(parent_inode); | |
589 | fsnotify_mkdir(parent_inode, dentry); | |
590 | ||
591 | out: | |
592 | inode_unlock(parent_inode); | |
593 | return dentry; | |
594 | } | |
595 | ||
fc470abf CL |
596 | static int binder_features_show(struct seq_file *m, void *unused) |
597 | { | |
598 | bool *feature = m->private; | |
599 | ||
600 | seq_printf(m, "%d\n", *feature); | |
601 | ||
602 | return 0; | |
603 | } | |
604 | DEFINE_SHOW_ATTRIBUTE(binder_features); | |
605 | ||
606 | static int init_binder_features(struct super_block *sb) | |
607 | { | |
608 | struct dentry *dentry, *dir; | |
609 | ||
610 | dir = binderfs_create_dir(sb->s_root, "features"); | |
611 | if (IS_ERR(dir)) | |
612 | return PTR_ERR(dir); | |
613 | ||
614 | dentry = binderfs_create_file(dir, "oneway_spam_detection", | |
615 | &binder_features_fops, | |
616 | &binder_features.oneway_spam_detection); | |
617 | if (IS_ERR(dentry)) | |
618 | return PTR_ERR(dentry); | |
619 | ||
d23386ed CL |
620 | dentry = binderfs_create_file(dir, "extended_error", |
621 | &binder_features_fops, | |
622 | &binder_features.extended_error); | |
623 | if (IS_ERR(dentry)) | |
624 | return PTR_ERR(dentry); | |
625 | ||
fc470abf CL |
626 | return 0; |
627 | } | |
628 | ||
0e13e452 HV |
629 | static int init_binder_logs(struct super_block *sb) |
630 | { | |
4feb80fa HV |
631 | struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir; |
632 | struct binderfs_info *info; | |
0e13e452 HV |
633 | int ret = 0; |
634 | ||
635 | binder_logs_root_dir = binderfs_create_dir(sb->s_root, | |
636 | "binder_logs"); | |
637 | if (IS_ERR(binder_logs_root_dir)) { | |
638 | ret = PTR_ERR(binder_logs_root_dir); | |
639 | goto out; | |
640 | } | |
641 | ||
642 | dentry = binderfs_create_file(binder_logs_root_dir, "stats", | |
643 | &binder_stats_fops, NULL); | |
644 | if (IS_ERR(dentry)) { | |
645 | ret = PTR_ERR(dentry); | |
646 | goto out; | |
647 | } | |
648 | ||
649 | dentry = binderfs_create_file(binder_logs_root_dir, "state", | |
650 | &binder_state_fops, NULL); | |
651 | if (IS_ERR(dentry)) { | |
652 | ret = PTR_ERR(dentry); | |
653 | goto out; | |
654 | } | |
655 | ||
656 | dentry = binderfs_create_file(binder_logs_root_dir, "transactions", | |
657 | &binder_transactions_fops, NULL); | |
03e2e07e HV |
658 | if (IS_ERR(dentry)) { |
659 | ret = PTR_ERR(dentry); | |
660 | goto out; | |
661 | } | |
662 | ||
663 | dentry = binderfs_create_file(binder_logs_root_dir, | |
664 | "transaction_log", | |
665 | &binder_transaction_log_fops, | |
666 | &binder_transaction_log); | |
667 | if (IS_ERR(dentry)) { | |
668 | ret = PTR_ERR(dentry); | |
669 | goto out; | |
670 | } | |
671 | ||
672 | dentry = binderfs_create_file(binder_logs_root_dir, | |
673 | "failed_transaction_log", | |
674 | &binder_transaction_log_fops, | |
675 | &binder_transaction_log_failed); | |
4feb80fa | 676 | if (IS_ERR(dentry)) { |
0e13e452 | 677 | ret = PTR_ERR(dentry); |
4feb80fa HV |
678 | goto out; |
679 | } | |
680 | ||
681 | proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc"); | |
682 | if (IS_ERR(proc_log_dir)) { | |
683 | ret = PTR_ERR(proc_log_dir); | |
684 | goto out; | |
685 | } | |
686 | info = sb->s_fs_info; | |
687 | info->proc_log_dir = proc_log_dir; | |
0e13e452 HV |
688 | |
689 | out: | |
690 | return ret; | |
691 | } | |
692 | ||
095cf502 | 693 | static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc) |
3ad20fe3 | 694 | { |
36975fc3 | 695 | int ret; |
3ad20fe3 | 696 | struct binderfs_info *info; |
095cf502 | 697 | struct binderfs_mount_opts *ctx = fc->fs_private; |
3ad20fe3 | 698 | struct inode *inode = NULL; |
7a1c4f28 | 699 | struct binderfs_device device_info = {}; |
ca2864c6 HV |
700 | const char *name; |
701 | size_t len; | |
3ad20fe3 CB |
702 | |
703 | sb->s_blocksize = PAGE_SIZE; | |
704 | sb->s_blocksize_bits = PAGE_SHIFT; | |
705 | ||
706 | /* | |
707 | * The binderfs filesystem can be mounted by userns root in a | |
708 | * non-initial userns. By default such mounts have the SB_I_NODEV flag | |
709 | * set in s_iflags to prevent security issues where userns root can | |
710 | * just create random device nodes via mknod() since it owns the | |
711 | * filesystem mount. But binderfs does not allow to create any files | |
712 | * including devices nodes. The only way to create binder devices nodes | |
713 | * is through the binder-control device which userns root is explicitly | |
714 | * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both | |
715 | * necessary and safe. | |
716 | */ | |
717 | sb->s_iflags &= ~SB_I_NODEV; | |
718 | sb->s_iflags |= SB_I_NOEXEC; | |
719 | sb->s_magic = BINDERFS_SUPER_MAGIC; | |
720 | sb->s_op = &binderfs_super_ops; | |
721 | sb->s_time_gran = 1; | |
722 | ||
36975fc3 CB |
723 | sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); |
724 | if (!sb->s_fs_info) | |
725 | return -ENOMEM; | |
726 | info = sb->s_fs_info; | |
727 | ||
728 | info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); | |
3ad20fe3 | 729 | |
3ad20fe3 CB |
730 | info->root_gid = make_kgid(sb->s_user_ns, 0); |
731 | if (!gid_valid(info->root_gid)) | |
732 | info->root_gid = GLOBAL_ROOT_GID; | |
733 | info->root_uid = make_kuid(sb->s_user_ns, 0); | |
734 | if (!uid_valid(info->root_uid)) | |
735 | info->root_uid = GLOBAL_ROOT_UID; | |
095cf502 CB |
736 | info->mount_opts.max = ctx->max; |
737 | info->mount_opts.stats_mode = ctx->stats_mode; | |
3ad20fe3 | 738 | |
3ad20fe3 CB |
739 | inode = new_inode(sb); |
740 | if (!inode) | |
36975fc3 | 741 | return -ENOMEM; |
3ad20fe3 CB |
742 | |
743 | inode->i_ino = FIRST_INODE; | |
744 | inode->i_fop = &simple_dir_operations; | |
745 | inode->i_mode = S_IFDIR | 0755; | |
746 | inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); | |
747 | inode->i_op = &binderfs_dir_inode_operations; | |
748 | set_nlink(inode, 2); | |
749 | ||
750 | sb->s_root = d_make_root(inode); | |
751 | if (!sb->s_root) | |
36975fc3 | 752 | return -ENOMEM; |
3ad20fe3 | 753 | |
ca2864c6 HV |
754 | ret = binderfs_binder_ctl_create(sb); |
755 | if (ret) | |
756 | return ret; | |
757 | ||
758 | name = binder_devices_param; | |
759 | for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { | |
760 | strscpy(device_info.name, name, len + 1); | |
761 | ret = binderfs_binder_device_create(inode, NULL, &device_info); | |
762 | if (ret) | |
763 | return ret; | |
764 | name += len; | |
765 | if (*name == ',') | |
766 | name++; | |
767 | } | |
768 | ||
fc470abf CL |
769 | ret = init_binder_features(sb); |
770 | if (ret) | |
771 | return ret; | |
772 | ||
095cf502 | 773 | if (info->mount_opts.stats_mode == binderfs_stats_mode_global) |
0e13e452 HV |
774 | return init_binder_logs(sb); |
775 | ||
ca2864c6 | 776 | return 0; |
3ad20fe3 CB |
777 | } |
778 | ||
095cf502 | 779 | static int binderfs_fs_context_get_tree(struct fs_context *fc) |
3ad20fe3 | 780 | { |
095cf502 | 781 | return get_tree_nodev(fc, binderfs_fill_super); |
3ad20fe3 CB |
782 | } |
783 | ||
095cf502 | 784 | static void binderfs_fs_context_free(struct fs_context *fc) |
3ad20fe3 | 785 | { |
095cf502 | 786 | struct binderfs_mount_opts *ctx = fc->fs_private; |
3ad20fe3 | 787 | |
095cf502 CB |
788 | kfree(ctx); |
789 | } | |
41984795 | 790 | |
095cf502 CB |
791 | static const struct fs_context_operations binderfs_fs_context_ops = { |
792 | .free = binderfs_fs_context_free, | |
793 | .get_tree = binderfs_fs_context_get_tree, | |
794 | .parse_param = binderfs_fs_context_parse_param, | |
795 | .reconfigure = binderfs_fs_context_reconfigure, | |
796 | }; | |
3ad20fe3 | 797 | |
095cf502 CB |
798 | static int binderfs_init_fs_context(struct fs_context *fc) |
799 | { | |
9e306ba3 | 800 | struct binderfs_mount_opts *ctx; |
095cf502 CB |
801 | |
802 | ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL); | |
803 | if (!ctx) | |
804 | return -ENOMEM; | |
805 | ||
806 | ctx->max = BINDERFS_MAX_MINOR; | |
807 | ctx->stats_mode = binderfs_stats_mode_unset; | |
808 | ||
809 | fc->fs_private = ctx; | |
810 | fc->ops = &binderfs_fs_context_ops; | |
811 | ||
812 | return 0; | |
3ad20fe3 CB |
813 | } |
814 | ||
815 | static struct file_system_type binder_fs_type = { | |
095cf502 CB |
816 | .name = "binder", |
817 | .init_fs_context = binderfs_init_fs_context, | |
818 | .parameters = binderfs_fs_parameters, | |
819 | .kill_sb = kill_litter_super, | |
820 | .fs_flags = FS_USERNS_MOUNT, | |
3ad20fe3 CB |
821 | }; |
822 | ||
5b9633af | 823 | int __init init_binderfs(void) |
3ad20fe3 CB |
824 | { |
825 | int ret; | |
028fb582 HV |
826 | const char *name; |
827 | size_t len; | |
828 | ||
829 | /* Verify that the default binderfs device names are valid. */ | |
830 | name = binder_devices_param; | |
831 | for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { | |
832 | if (len > BINDERFS_MAX_NAME) | |
833 | return -E2BIG; | |
834 | name += len; | |
835 | if (*name == ',') | |
836 | name++; | |
837 | } | |
3ad20fe3 CB |
838 | |
839 | /* Allocate new major number for binderfs. */ | |
840 | ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR, | |
841 | "binder"); | |
842 | if (ret) | |
843 | return ret; | |
844 | ||
845 | ret = register_filesystem(&binder_fs_type); | |
846 | if (ret) { | |
847 | unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); | |
848 | return ret; | |
849 | } | |
850 | ||
3ad20fe3 CB |
851 | return ret; |
852 | } |