1 | // SPDX-License-Identifier: GPL-2.0 |
2 | |
3 | #include <linux/compiler_types.h> |
4 | #include <linux/errno.h> |
5 | #include <linux/fs.h> |
6 | #include <linux/fsnotify.h> |
7 | #include <linux/gfp.h> |
8 | #include <linux/idr.h> |
9 | #include <linux/init.h> |
10 | #include <linux/ipc_namespace.h> |
11 | #include <linux/kdev_t.h> |
12 | #include <linux/kernel.h> |
13 | #include <linux/list.h> |
14 | #include <linux/namei.h> |
15 | #include <linux/magic.h> |
16 | #include <linux/major.h> |
17 | #include <linux/miscdevice.h> |
18 | #include <linux/module.h> |
19 | #include <linux/mutex.h> |
20 | #include <linux/mount.h> |
21 | #include <linux/fs_parser.h> |
22 | #include <linux/sched.h> |
23 | #include <linux/seq_file.h> |
24 | #include <linux/slab.h> |
25 | #include <linux/spinlock_types.h> |
26 | #include <linux/stddef.h> |
27 | #include <linux/string.h> |
28 | #include <linux/types.h> |
29 | #include <linux/uaccess.h> |
30 | #include <linux/user_namespace.h> |
31 | #include <linux/xarray.h> |
32 | #include <uapi/linux/android/binder.h> |
33 | #include <uapi/linux/android/binderfs.h> |
34 | |
35 | #include "binder_internal.h" |
36 | |
37 | #define FIRST_INODE 1 |
38 | #define SECOND_INODE 2 |
39 | #define INODE_OFFSET 3 |
40 | #define BINDERFS_MAX_MINOR (1U << MINORBITS) |
41 | /* Ensure that the initial ipc namespace always has devices available. */ |
42 | #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4) |
43 | |
44 | static dev_t binderfs_dev; |
45 | static DEFINE_MUTEX(binderfs_minors_mutex); |
46 | static DEFINE_IDA(binderfs_minors); |
47 | |
48 | enum binderfs_param { |
49 | Opt_max, |
50 | Opt_stats_mode, |
51 | }; |
52 | |
53 | enum binderfs_stats_mode { |
54 | binderfs_stats_mode_unset, |
55 | binderfs_stats_mode_global, |
56 | }; |
57 | |
58 | struct binder_features { |
59 | bool oneway_spam_detection; |
60 | bool extended_error; |
61 | }; |
62 | |
63 | static const struct constant_table binderfs_param_stats[] = { |
64 | { "global" , binderfs_stats_mode_global }, |
65 | {} |
66 | }; |
67 | |
68 | static const struct fs_parameter_spec binderfs_fs_parameters[] = { |
69 | fsparam_u32("max" , Opt_max), |
70 | fsparam_enum("stats" , Opt_stats_mode, binderfs_param_stats), |
71 | {} |
72 | }; |
73 | |
74 | static struct binder_features binder_features = { |
75 | .oneway_spam_detection = true, |
76 | .extended_error = true, |
77 | }; |
78 | |
79 | static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb) |
80 | { |
81 | return sb->s_fs_info; |
82 | } |
83 | |
84 | bool is_binderfs_device(const struct inode *inode) |
85 | { |
86 | if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC) |
87 | return true; |
88 | |
89 | return false; |
90 | } |
91 | |
92 | /** |
93 | * binderfs_binder_device_create - allocate inode from super block of a |
94 | * binderfs mount |
95 | * @ref_inode: inode from which the super block will be taken |
96 | * @userp: buffer to copy information about new device for userspace to |
97 | * @req: struct binderfs_device as copied from userspace |
98 | * |
99 | * This function allocates a new binder_device and reserves a new minor |
100 | * number for it. |
101 | * Minor numbers are limited and tracked globally in binderfs_minors. The |
102 | * function will stash a struct binder_device for the specific binder |
103 | * device in i_private of the inode. |
104 | * It will go on to allocate a new inode from the super block of the |
105 | * filesystem mount, stash a struct binder_device in its i_private field |
106 | * and attach a dentry to that inode. |
107 | * |
108 | * Return: 0 on success, negative errno on failure |
109 | */ |
110 | static int binderfs_binder_device_create(struct inode *ref_inode, |
111 | struct binderfs_device __user *userp, |
112 | struct binderfs_device *req) |
113 | { |
114 | int minor, ret; |
115 | struct dentry *dentry, *root; |
116 | struct binder_device *device; |
117 | char *name = NULL; |
118 | size_t name_len; |
119 | struct inode *inode = NULL; |
120 | struct super_block *sb = ref_inode->i_sb; |
121 | struct binderfs_info *info = sb->s_fs_info; |
122 | #if defined(CONFIG_IPC_NS) |
123 | bool use_reserve = (info->ipc_ns == &init_ipc_ns); |
124 | #else |
125 | bool use_reserve = true; |
126 | #endif |
127 | |
128 | /* Reserve new minor number for the new device. */ |
129 | mutex_lock(&binderfs_minors_mutex); |
130 | if (++info->device_count <= info->mount_opts.max) |
131 | minor = ida_alloc_max(ida: &binderfs_minors, |
132 | max: use_reserve ? BINDERFS_MAX_MINOR : |
133 | BINDERFS_MAX_MINOR_CAPPED, |
134 | GFP_KERNEL); |
135 | else |
136 | minor = -ENOSPC; |
137 | if (minor < 0) { |
138 | --info->device_count; |
139 | mutex_unlock(lock: &binderfs_minors_mutex); |
140 | return minor; |
141 | } |
142 | mutex_unlock(lock: &binderfs_minors_mutex); |
143 | |
144 | ret = -ENOMEM; |
145 | device = kzalloc(size: sizeof(*device), GFP_KERNEL); |
146 | if (!device) |
147 | goto err; |
148 | |
149 | inode = new_inode(sb); |
150 | if (!inode) |
151 | goto err; |
152 | |
153 | inode->i_ino = minor + INODE_OFFSET; |
154 | simple_inode_init_ts(inode); |
155 | init_special_inode(inode, S_IFCHR | 0600, |
156 | MKDEV(MAJOR(binderfs_dev), minor)); |
157 | inode->i_fop = &binder_fops; |
158 | inode->i_uid = info->root_uid; |
159 | inode->i_gid = info->root_gid; |
160 | |
161 | req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */ |
162 | name_len = strlen(req->name); |
163 | /* Make sure to include terminating NUL byte */ |
164 | name = kmemdup(p: req->name, size: name_len + 1, GFP_KERNEL); |
165 | if (!name) |
166 | goto err; |
167 | |
168 | refcount_set(r: &device->ref, n: 1); |
169 | device->binderfs_inode = inode; |
170 | device->context.binder_context_mgr_uid = INVALID_UID; |
171 | device->context.name = name; |
172 | device->miscdev.name = name; |
173 | device->miscdev.minor = minor; |
174 | mutex_init(&device->context.context_mgr_node_lock); |
175 | |
176 | req->major = MAJOR(binderfs_dev); |
177 | req->minor = minor; |
178 | |
179 | if (userp && copy_to_user(to: userp, from: req, n: sizeof(*req))) { |
180 | ret = -EFAULT; |
181 | goto err; |
182 | } |
183 | |
184 | root = sb->s_root; |
185 | inode_lock(inode: d_inode(dentry: root)); |
186 | |
187 | /* look it up */ |
188 | dentry = lookup_one_len(name, root, name_len); |
189 | if (IS_ERR(ptr: dentry)) { |
190 | inode_unlock(inode: d_inode(dentry: root)); |
191 | ret = PTR_ERR(ptr: dentry); |
192 | goto err; |
193 | } |
194 | |
195 | if (d_really_is_positive(dentry)) { |
196 | /* already exists */ |
197 | dput(dentry); |
198 | inode_unlock(inode: d_inode(dentry: root)); |
199 | ret = -EEXIST; |
200 | goto err; |
201 | } |
202 | |
203 | inode->i_private = device; |
204 | d_instantiate(dentry, inode); |
205 | fsnotify_create(dir: root->d_inode, dentry); |
206 | inode_unlock(inode: d_inode(dentry: root)); |
207 | |
208 | return 0; |
209 | |
210 | err: |
211 | kfree(objp: name); |
212 | kfree(objp: device); |
213 | mutex_lock(&binderfs_minors_mutex); |
214 | --info->device_count; |
215 | ida_free(&binderfs_minors, id: minor); |
216 | mutex_unlock(lock: &binderfs_minors_mutex); |
217 | iput(inode); |
218 | |
219 | return ret; |
220 | } |
221 | |
222 | /** |
223 | * binder_ctl_ioctl - handle binder device node allocation requests |
224 | * |
225 | * The request handler for the binder-control device. All requests operate on |
226 | * the binderfs mount the binder-control device resides in: |
227 | * - BINDER_CTL_ADD |
228 | * Allocate a new binder device. |
229 | * |
230 | * Return: %0 on success, negative errno on failure. |
231 | */ |
232 | static long binder_ctl_ioctl(struct file *file, unsigned int cmd, |
233 | unsigned long arg) |
234 | { |
235 | int ret = -EINVAL; |
236 | struct inode *inode = file_inode(f: file); |
237 | struct binderfs_device __user *device = (struct binderfs_device __user *)arg; |
238 | struct binderfs_device device_req; |
239 | |
240 | switch (cmd) { |
241 | case BINDER_CTL_ADD: |
242 | ret = copy_from_user(to: &device_req, from: device, n: sizeof(device_req)); |
243 | if (ret) { |
244 | ret = -EFAULT; |
245 | break; |
246 | } |
247 | |
248 | ret = binderfs_binder_device_create(ref_inode: inode, userp: device, req: &device_req); |
249 | break; |
250 | default: |
251 | break; |
252 | } |
253 | |
254 | return ret; |
255 | } |
256 | |
257 | static void binderfs_evict_inode(struct inode *inode) |
258 | { |
259 | struct binder_device *device = inode->i_private; |
260 | struct binderfs_info *info = BINDERFS_SB(sb: inode->i_sb); |
261 | |
262 | clear_inode(inode); |
263 | |
264 | if (!S_ISCHR(inode->i_mode) || !device) |
265 | return; |
266 | |
267 | mutex_lock(&binderfs_minors_mutex); |
268 | --info->device_count; |
269 | ida_free(&binderfs_minors, id: device->miscdev.minor); |
270 | mutex_unlock(lock: &binderfs_minors_mutex); |
271 | |
272 | if (refcount_dec_and_test(r: &device->ref)) { |
273 | kfree(objp: device->context.name); |
274 | kfree(objp: device); |
275 | } |
276 | } |
277 | |
278 | static int binderfs_fs_context_parse_param(struct fs_context *fc, |
279 | struct fs_parameter *param) |
280 | { |
281 | int opt; |
282 | struct binderfs_mount_opts *ctx = fc->fs_private; |
283 | struct fs_parse_result result; |
284 | |
285 | opt = fs_parse(fc, desc: binderfs_fs_parameters, param, result: &result); |
286 | if (opt < 0) |
287 | return opt; |
288 | |
289 | switch (opt) { |
290 | case Opt_max: |
291 | if (result.uint_32 > BINDERFS_MAX_MINOR) |
292 | return invalfc(fc, "Bad value for '%s'" , param->key); |
293 | |
294 | ctx->max = result.uint_32; |
295 | break; |
296 | case Opt_stats_mode: |
297 | if (!capable(CAP_SYS_ADMIN)) |
298 | return -EPERM; |
299 | |
300 | ctx->stats_mode = result.uint_32; |
301 | break; |
302 | default: |
303 | return invalfc(fc, "Unsupported parameter '%s'" , param->key); |
304 | } |
305 | |
306 | return 0; |
307 | } |
308 | |
309 | static int binderfs_fs_context_reconfigure(struct fs_context *fc) |
310 | { |
311 | struct binderfs_mount_opts *ctx = fc->fs_private; |
312 | struct binderfs_info *info = BINDERFS_SB(sb: fc->root->d_sb); |
313 | |
314 | if (info->mount_opts.stats_mode != ctx->stats_mode) |
315 | return invalfc(fc, "Binderfs stats mode cannot be changed during a remount" ); |
316 | |
317 | info->mount_opts.stats_mode = ctx->stats_mode; |
318 | info->mount_opts.max = ctx->max; |
319 | return 0; |
320 | } |
321 | |
322 | static int binderfs_show_options(struct seq_file *seq, struct dentry *root) |
323 | { |
324 | struct binderfs_info *info = BINDERFS_SB(sb: root->d_sb); |
325 | |
326 | if (info->mount_opts.max <= BINDERFS_MAX_MINOR) |
327 | seq_printf(m: seq, fmt: ",max=%d" , info->mount_opts.max); |
328 | |
329 | switch (info->mount_opts.stats_mode) { |
330 | case binderfs_stats_mode_unset: |
331 | break; |
332 | case binderfs_stats_mode_global: |
333 | seq_printf(m: seq, fmt: ",stats=global" ); |
334 | break; |
335 | } |
336 | |
337 | return 0; |
338 | } |
339 | |
340 | static const struct super_operations binderfs_super_ops = { |
341 | .evict_inode = binderfs_evict_inode, |
342 | .show_options = binderfs_show_options, |
343 | .statfs = simple_statfs, |
344 | }; |
345 | |
346 | static inline bool is_binderfs_control_device(const struct dentry *dentry) |
347 | { |
348 | struct binderfs_info *info = dentry->d_sb->s_fs_info; |
349 | |
350 | return info->control_dentry == dentry; |
351 | } |
352 | |
353 | static int binderfs_rename(struct mnt_idmap *idmap, |
354 | struct inode *old_dir, struct dentry *old_dentry, |
355 | struct inode *new_dir, struct dentry *new_dentry, |
356 | unsigned int flags) |
357 | { |
358 | if (is_binderfs_control_device(dentry: old_dentry) || |
359 | is_binderfs_control_device(dentry: new_dentry)) |
360 | return -EPERM; |
361 | |
362 | return simple_rename(idmap, old_dir, old_dentry, new_dir, |
363 | new_dentry, flags); |
364 | } |
365 | |
366 | static int binderfs_unlink(struct inode *dir, struct dentry *dentry) |
367 | { |
368 | if (is_binderfs_control_device(dentry)) |
369 | return -EPERM; |
370 | |
371 | return simple_unlink(dir, dentry); |
372 | } |
373 | |
374 | static const struct file_operations binder_ctl_fops = { |
375 | .owner = THIS_MODULE, |
376 | .open = nonseekable_open, |
377 | .unlocked_ioctl = binder_ctl_ioctl, |
378 | .compat_ioctl = binder_ctl_ioctl, |
379 | .llseek = noop_llseek, |
380 | }; |
381 | |
382 | /** |
383 | * binderfs_binder_ctl_create - create a new binder-control device |
384 | * @sb: super block of the binderfs mount |
385 | * |
386 | * This function creates a new binder-control device node in the binderfs mount |
387 | * referred to by @sb. |
388 | * |
389 | * Return: 0 on success, negative errno on failure |
390 | */ |
391 | static int binderfs_binder_ctl_create(struct super_block *sb) |
392 | { |
393 | int minor, ret; |
394 | struct dentry *dentry; |
395 | struct binder_device *device; |
396 | struct inode *inode = NULL; |
397 | struct dentry *root = sb->s_root; |
398 | struct binderfs_info *info = sb->s_fs_info; |
399 | #if defined(CONFIG_IPC_NS) |
400 | bool use_reserve = (info->ipc_ns == &init_ipc_ns); |
401 | #else |
402 | bool use_reserve = true; |
403 | #endif |
404 | |
405 | device = kzalloc(size: sizeof(*device), GFP_KERNEL); |
406 | if (!device) |
407 | return -ENOMEM; |
408 | |
409 | /* If we have already created a binder-control node, return. */ |
410 | if (info->control_dentry) { |
411 | ret = 0; |
412 | goto out; |
413 | } |
414 | |
415 | ret = -ENOMEM; |
416 | inode = new_inode(sb); |
417 | if (!inode) |
418 | goto out; |
419 | |
420 | /* Reserve a new minor number for the new device. */ |
421 | mutex_lock(&binderfs_minors_mutex); |
422 | minor = ida_alloc_max(ida: &binderfs_minors, |
423 | max: use_reserve ? BINDERFS_MAX_MINOR : |
424 | BINDERFS_MAX_MINOR_CAPPED, |
425 | GFP_KERNEL); |
426 | mutex_unlock(lock: &binderfs_minors_mutex); |
427 | if (minor < 0) { |
428 | ret = minor; |
429 | goto out; |
430 | } |
431 | |
432 | inode->i_ino = SECOND_INODE; |
433 | simple_inode_init_ts(inode); |
434 | init_special_inode(inode, S_IFCHR | 0600, |
435 | MKDEV(MAJOR(binderfs_dev), minor)); |
436 | inode->i_fop = &binder_ctl_fops; |
437 | inode->i_uid = info->root_uid; |
438 | inode->i_gid = info->root_gid; |
439 | |
440 | refcount_set(r: &device->ref, n: 1); |
441 | device->binderfs_inode = inode; |
442 | device->miscdev.minor = minor; |
443 | |
444 | dentry = d_alloc_name(root, "binder-control" ); |
445 | if (!dentry) |
446 | goto out; |
447 | |
448 | inode->i_private = device; |
449 | info->control_dentry = dentry; |
450 | d_add(dentry, inode); |
451 | |
452 | return 0; |
453 | |
454 | out: |
455 | kfree(objp: device); |
456 | iput(inode); |
457 | |
458 | return ret; |
459 | } |
460 | |
461 | static const struct inode_operations binderfs_dir_inode_operations = { |
462 | .lookup = simple_lookup, |
463 | .rename = binderfs_rename, |
464 | .unlink = binderfs_unlink, |
465 | }; |
466 | |
467 | static struct inode *binderfs_make_inode(struct super_block *sb, int mode) |
468 | { |
469 | struct inode *ret; |
470 | |
471 | ret = new_inode(sb); |
472 | if (ret) { |
473 | ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET); |
474 | ret->i_mode = mode; |
475 | simple_inode_init_ts(inode: ret); |
476 | } |
477 | return ret; |
478 | } |
479 | |
480 | static struct dentry *binderfs_create_dentry(struct dentry *parent, |
481 | const char *name) |
482 | { |
483 | struct dentry *dentry; |
484 | |
485 | dentry = lookup_one_len(name, parent, strlen(name)); |
486 | if (IS_ERR(ptr: dentry)) |
487 | return dentry; |
488 | |
489 | /* Return error if the file/dir already exists. */ |
490 | if (d_really_is_positive(dentry)) { |
491 | dput(dentry); |
492 | return ERR_PTR(error: -EEXIST); |
493 | } |
494 | |
495 | return dentry; |
496 | } |
497 | |
498 | void binderfs_remove_file(struct dentry *dentry) |
499 | { |
500 | struct inode *parent_inode; |
501 | |
502 | parent_inode = d_inode(dentry: dentry->d_parent); |
503 | inode_lock(inode: parent_inode); |
504 | if (simple_positive(dentry)) { |
505 | dget(dentry); |
506 | simple_unlink(parent_inode, dentry); |
507 | d_delete(dentry); |
508 | dput(dentry); |
509 | } |
510 | inode_unlock(inode: parent_inode); |
511 | } |
512 | |
513 | struct dentry *binderfs_create_file(struct dentry *parent, const char *name, |
514 | const struct file_operations *fops, |
515 | void *data) |
516 | { |
517 | struct dentry *dentry; |
518 | struct inode *new_inode, *parent_inode; |
519 | struct super_block *sb; |
520 | |
521 | parent_inode = d_inode(dentry: parent); |
522 | inode_lock(inode: parent_inode); |
523 | |
524 | dentry = binderfs_create_dentry(parent, name); |
525 | if (IS_ERR(ptr: dentry)) |
526 | goto out; |
527 | |
528 | sb = parent_inode->i_sb; |
529 | new_inode = binderfs_make_inode(sb, S_IFREG | 0444); |
530 | if (!new_inode) { |
531 | dput(dentry); |
532 | dentry = ERR_PTR(error: -ENOMEM); |
533 | goto out; |
534 | } |
535 | |
536 | new_inode->i_fop = fops; |
537 | new_inode->i_private = data; |
538 | d_instantiate(dentry, new_inode); |
539 | fsnotify_create(dir: parent_inode, dentry); |
540 | |
541 | out: |
542 | inode_unlock(inode: parent_inode); |
543 | return dentry; |
544 | } |
545 | |
546 | static struct dentry *binderfs_create_dir(struct dentry *parent, |
547 | const char *name) |
548 | { |
549 | struct dentry *dentry; |
550 | struct inode *new_inode, *parent_inode; |
551 | struct super_block *sb; |
552 | |
553 | parent_inode = d_inode(dentry: parent); |
554 | inode_lock(inode: parent_inode); |
555 | |
556 | dentry = binderfs_create_dentry(parent, name); |
557 | if (IS_ERR(ptr: dentry)) |
558 | goto out; |
559 | |
560 | sb = parent_inode->i_sb; |
561 | new_inode = binderfs_make_inode(sb, S_IFDIR | 0755); |
562 | if (!new_inode) { |
563 | dput(dentry); |
564 | dentry = ERR_PTR(error: -ENOMEM); |
565 | goto out; |
566 | } |
567 | |
568 | new_inode->i_fop = &simple_dir_operations; |
569 | new_inode->i_op = &simple_dir_inode_operations; |
570 | |
571 | set_nlink(inode: new_inode, nlink: 2); |
572 | d_instantiate(dentry, new_inode); |
573 | inc_nlink(inode: parent_inode); |
574 | fsnotify_mkdir(dir: parent_inode, dentry); |
575 | |
576 | out: |
577 | inode_unlock(inode: parent_inode); |
578 | return dentry; |
579 | } |
580 | |
581 | static int binder_features_show(struct seq_file *m, void *unused) |
582 | { |
583 | bool *feature = m->private; |
584 | |
585 | seq_printf(m, fmt: "%d\n" , *feature); |
586 | |
587 | return 0; |
588 | } |
589 | DEFINE_SHOW_ATTRIBUTE(binder_features); |
590 | |
591 | static int init_binder_features(struct super_block *sb) |
592 | { |
593 | struct dentry *dentry, *dir; |
594 | |
595 | dir = binderfs_create_dir(parent: sb->s_root, name: "features" ); |
596 | if (IS_ERR(ptr: dir)) |
597 | return PTR_ERR(ptr: dir); |
598 | |
599 | dentry = binderfs_create_file(parent: dir, name: "oneway_spam_detection" , |
600 | fops: &binder_features_fops, |
601 | data: &binder_features.oneway_spam_detection); |
602 | if (IS_ERR(ptr: dentry)) |
603 | return PTR_ERR(ptr: dentry); |
604 | |
605 | dentry = binderfs_create_file(parent: dir, name: "extended_error" , |
606 | fops: &binder_features_fops, |
607 | data: &binder_features.extended_error); |
608 | if (IS_ERR(ptr: dentry)) |
609 | return PTR_ERR(ptr: dentry); |
610 | |
611 | return 0; |
612 | } |
613 | |
614 | static int init_binder_logs(struct super_block *sb) |
615 | { |
616 | struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir; |
617 | const struct binder_debugfs_entry *db_entry; |
618 | struct binderfs_info *info; |
619 | int ret = 0; |
620 | |
621 | binder_logs_root_dir = binderfs_create_dir(parent: sb->s_root, |
622 | name: "binder_logs" ); |
623 | if (IS_ERR(ptr: binder_logs_root_dir)) { |
624 | ret = PTR_ERR(ptr: binder_logs_root_dir); |
625 | goto out; |
626 | } |
627 | |
628 | binder_for_each_debugfs_entry(db_entry) { |
629 | dentry = binderfs_create_file(parent: binder_logs_root_dir, |
630 | name: db_entry->name, |
631 | fops: db_entry->fops, |
632 | data: db_entry->data); |
633 | if (IS_ERR(ptr: dentry)) { |
634 | ret = PTR_ERR(ptr: dentry); |
635 | goto out; |
636 | } |
637 | } |
638 | |
639 | proc_log_dir = binderfs_create_dir(parent: binder_logs_root_dir, name: "proc" ); |
640 | if (IS_ERR(ptr: proc_log_dir)) { |
641 | ret = PTR_ERR(ptr: proc_log_dir); |
642 | goto out; |
643 | } |
644 | info = sb->s_fs_info; |
645 | info->proc_log_dir = proc_log_dir; |
646 | |
647 | out: |
648 | return ret; |
649 | } |
650 | |
651 | static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc) |
652 | { |
653 | int ret; |
654 | struct binderfs_info *info; |
655 | struct binderfs_mount_opts *ctx = fc->fs_private; |
656 | struct inode *inode = NULL; |
657 | struct binderfs_device device_info = {}; |
658 | const char *name; |
659 | size_t len; |
660 | |
661 | sb->s_blocksize = PAGE_SIZE; |
662 | sb->s_blocksize_bits = PAGE_SHIFT; |
663 | |
664 | /* |
665 | * The binderfs filesystem can be mounted by userns root in a |
666 | * non-initial userns. By default such mounts have the SB_I_NODEV flag |
667 | * set in s_iflags to prevent security issues where userns root can |
668 | * just create random device nodes via mknod() since it owns the |
669 | * filesystem mount. But binderfs does not allow to create any files |
670 | * including devices nodes. The only way to create binder devices nodes |
671 | * is through the binder-control device which userns root is explicitly |
672 | * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both |
673 | * necessary and safe. |
674 | */ |
675 | sb->s_iflags &= ~SB_I_NODEV; |
676 | sb->s_iflags |= SB_I_NOEXEC; |
677 | sb->s_magic = BINDERFS_SUPER_MAGIC; |
678 | sb->s_op = &binderfs_super_ops; |
679 | sb->s_time_gran = 1; |
680 | |
681 | sb->s_fs_info = kzalloc(size: sizeof(struct binderfs_info), GFP_KERNEL); |
682 | if (!sb->s_fs_info) |
683 | return -ENOMEM; |
684 | info = sb->s_fs_info; |
685 | |
686 | info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); |
687 | |
688 | info->root_gid = make_kgid(from: sb->s_user_ns, gid: 0); |
689 | if (!gid_valid(gid: info->root_gid)) |
690 | info->root_gid = GLOBAL_ROOT_GID; |
691 | info->root_uid = make_kuid(sb->s_user_ns, 0); |
692 | if (!uid_valid(info->root_uid)) |
693 | info->root_uid = GLOBAL_ROOT_UID; |
694 | info->mount_opts.max = ctx->max; |
695 | info->mount_opts.stats_mode = ctx->stats_mode; |
696 | |
697 | inode = new_inode(sb); |
698 | if (!inode) |
699 | return -ENOMEM; |
700 | |
701 | inode->i_ino = FIRST_INODE; |
702 | inode->i_fop = &simple_dir_operations; |
703 | inode->i_mode = S_IFDIR | 0755; |
704 | simple_inode_init_ts(inode); |
705 | inode->i_op = &binderfs_dir_inode_operations; |
706 | set_nlink(inode, 2); |
707 | |
708 | sb->s_root = d_make_root(inode); |
709 | if (!sb->s_root) |
710 | return -ENOMEM; |
711 | |
712 | ret = binderfs_binder_ctl_create(sb); |
713 | if (ret) |
714 | return ret; |
715 | |
716 | name = binder_devices_param; |
717 | for (len = strcspn(name, "," ); len > 0; len = strcspn(name, "," )) { |
718 | strscpy(device_info.name, name, len + 1); |
719 | ret = binderfs_binder_device_create(inode, NULL, &device_info); |
720 | if (ret) |
721 | return ret; |
722 | name += len; |
723 | if (*name == ',') |
724 | name++; |
725 | } |
726 | |
727 | ret = init_binder_features(sb); |
728 | if (ret) |
729 | return ret; |
730 | |
731 | if (info->mount_opts.stats_mode == binderfs_stats_mode_global) |
732 | return init_binder_logs(sb); |
733 | |
734 | return 0; |
735 | } |
736 | |
737 | static int binderfs_fs_context_get_tree(struct fs_context *fc) |
738 | { |
739 | return get_tree_nodev(fc, fill_super: binderfs_fill_super); |
740 | } |
741 | |
742 | static void binderfs_fs_context_free(struct fs_context *fc) |
743 | { |
744 | struct binderfs_mount_opts *ctx = fc->fs_private; |
745 | |
746 | kfree(objp: ctx); |
747 | } |
748 | |
749 | static const struct fs_context_operations binderfs_fs_context_ops = { |
750 | .free = binderfs_fs_context_free, |
751 | .get_tree = binderfs_fs_context_get_tree, |
752 | .parse_param = binderfs_fs_context_parse_param, |
753 | .reconfigure = binderfs_fs_context_reconfigure, |
754 | }; |
755 | |
756 | static int binderfs_init_fs_context(struct fs_context *fc) |
757 | { |
758 | struct binderfs_mount_opts *ctx; |
759 | |
760 | ctx = kzalloc(size: sizeof(struct binderfs_mount_opts), GFP_KERNEL); |
761 | if (!ctx) |
762 | return -ENOMEM; |
763 | |
764 | ctx->max = BINDERFS_MAX_MINOR; |
765 | ctx->stats_mode = binderfs_stats_mode_unset; |
766 | |
767 | fc->fs_private = ctx; |
768 | fc->ops = &binderfs_fs_context_ops; |
769 | |
770 | return 0; |
771 | } |
772 | |
773 | static void binderfs_kill_super(struct super_block *sb) |
774 | { |
775 | struct binderfs_info *info = sb->s_fs_info; |
776 | |
777 | /* |
778 | * During inode eviction struct binderfs_info is needed. |
779 | * So first wipe the super_block then free struct binderfs_info. |
780 | */ |
781 | kill_litter_super(sb); |
782 | |
783 | if (info && info->ipc_ns) |
784 | put_ipc_ns(ns: info->ipc_ns); |
785 | |
786 | kfree(objp: info); |
787 | } |
788 | |
789 | static struct file_system_type binder_fs_type = { |
790 | .name = "binder" , |
791 | .init_fs_context = binderfs_init_fs_context, |
792 | .parameters = binderfs_fs_parameters, |
793 | .kill_sb = binderfs_kill_super, |
794 | .fs_flags = FS_USERNS_MOUNT, |
795 | }; |
796 | |
797 | int __init init_binderfs(void) |
798 | { |
799 | int ret; |
800 | const char *name; |
801 | size_t len; |
802 | |
803 | /* Verify that the default binderfs device names are valid. */ |
804 | name = binder_devices_param; |
805 | for (len = strcspn(name, "," ); len > 0; len = strcspn(name, "," )) { |
806 | if (len > BINDERFS_MAX_NAME) |
807 | return -E2BIG; |
808 | name += len; |
809 | if (*name == ',') |
810 | name++; |
811 | } |
812 | |
813 | /* Allocate new major number for binderfs. */ |
814 | ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR, |
815 | "binder" ); |
816 | if (ret) |
817 | return ret; |
818 | |
819 | ret = register_filesystem(&binder_fs_type); |
820 | if (ret) { |
821 | unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); |
822 | return ret; |
823 | } |
824 | |
825 | return ret; |
826 | } |
827 | |