1 /* SPDX-License-Identifier: GPL-2.0 */
3 #include <linux/compiler_types.h>
4 #include <linux/errno.h>
6 #include <linux/fsnotify.h>
9 #include <linux/init.h>
10 #include <linux/ipc_namespace.h>
11 #include <linux/kdev_t.h>
12 #include <linux/kernel.h>
13 #include <linux/list.h>
14 #include <linux/namei.h>
15 #include <linux/magic.h>
16 #include <linux/major.h>
17 #include <linux/miscdevice.h>
18 #include <linux/module.h>
19 #include <linux/mutex.h>
20 #include <linux/mount.h>
21 #include <linux/parser.h>
22 #include <linux/radix-tree.h>
23 #include <linux/sched.h>
24 #include <linux/seq_file.h>
25 #include <linux/slab.h>
26 #include <linux/spinlock_types.h>
27 #include <linux/stddef.h>
28 #include <linux/string.h>
29 #include <linux/types.h>
30 #include <linux/uaccess.h>
31 #include <linux/user_namespace.h>
32 #include <linux/xarray.h>
33 #include <uapi/asm-generic/errno-base.h>
34 #include <uapi/linux/android/binder.h>
35 #include <uapi/linux/android/binderfs.h>
37 #include "binder_internal.h"
40 #define SECOND_INODE 2
41 #define INODE_OFFSET 3
43 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
44 /* Ensure that the initial ipc namespace always has devices available. */
45 #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
47 static dev_t binderfs_dev
;
48 static DEFINE_MUTEX(binderfs_minors_mutex
);
49 static DEFINE_IDA(binderfs_minors
);
57 enum binderfs_stats_mode
{
62 static const match_table_t tokens
= {
63 { Opt_max
, "max=%d" },
64 { Opt_stats_mode
, "stats=%s" },
68 static inline struct binderfs_info
*BINDERFS_I(const struct inode
*inode
)
70 return inode
->i_sb
->s_fs_info
;
73 bool is_binderfs_device(const struct inode
*inode
)
75 if (inode
->i_sb
->s_magic
== BINDERFS_SUPER_MAGIC
)
82 * binderfs_binder_device_create - allocate inode from super block of a
84 * @ref_inode: inode from wich the super block will be taken
85 * @userp: buffer to copy information about new device for userspace to
86 * @req: struct binderfs_device as copied from userspace
88 * This function allocates a new binder_device and reserves a new minor
90 * Minor numbers are limited and tracked globally in binderfs_minors. The
91 * function will stash a struct binder_device for the specific binder
92 * device in i_private of the inode.
93 * It will go on to allocate a new inode from the super block of the
94 * filesystem mount, stash a struct binder_device in its i_private field
95 * and attach a dentry to that inode.
97 * Return: 0 on success, negative errno on failure
99 static int binderfs_binder_device_create(struct inode
*ref_inode
,
100 struct binderfs_device __user
*userp
,
101 struct binderfs_device
*req
)
104 struct dentry
*dentry
, *root
;
105 struct binder_device
*device
;
108 struct inode
*inode
= NULL
;
109 struct super_block
*sb
= ref_inode
->i_sb
;
110 struct binderfs_info
*info
= sb
->s_fs_info
;
111 #if defined(CONFIG_IPC_NS)
112 bool use_reserve
= (info
->ipc_ns
== &init_ipc_ns
);
114 bool use_reserve
= true;
117 /* Reserve new minor number for the new device. */
118 mutex_lock(&binderfs_minors_mutex
);
119 if (++info
->device_count
<= info
->mount_opts
.max
)
120 minor
= ida_alloc_max(&binderfs_minors
,
121 use_reserve
? BINDERFS_MAX_MINOR
:
122 BINDERFS_MAX_MINOR_CAPPED
,
127 --info
->device_count
;
128 mutex_unlock(&binderfs_minors_mutex
);
131 mutex_unlock(&binderfs_minors_mutex
);
134 device
= kzalloc(sizeof(*device
), GFP_KERNEL
);
138 inode
= new_inode(sb
);
142 inode
->i_ino
= minor
+ INODE_OFFSET
;
143 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
144 init_special_inode(inode
, S_IFCHR
| 0600,
145 MKDEV(MAJOR(binderfs_dev
), minor
));
146 inode
->i_fop
= &binder_fops
;
147 inode
->i_uid
= info
->root_uid
;
148 inode
->i_gid
= info
->root_gid
;
150 req
->name
[BINDERFS_MAX_NAME
] = '\0'; /* NUL-terminate */
151 name_len
= strlen(req
->name
);
152 /* Make sure to include terminating NUL byte */
153 name
= kmemdup(req
->name
, name_len
+ 1, GFP_KERNEL
);
157 refcount_set(&device
->ref
, 1);
158 device
->binderfs_inode
= inode
;
159 device
->context
.binder_context_mgr_uid
= INVALID_UID
;
160 device
->context
.name
= name
;
161 device
->miscdev
.name
= name
;
162 device
->miscdev
.minor
= minor
;
163 mutex_init(&device
->context
.context_mgr_node_lock
);
165 req
->major
= MAJOR(binderfs_dev
);
168 if (userp
&& copy_to_user(userp
, req
, sizeof(*req
))) {
174 inode_lock(d_inode(root
));
177 dentry
= lookup_one_len(name
, root
, name_len
);
178 if (IS_ERR(dentry
)) {
179 inode_unlock(d_inode(root
));
180 ret
= PTR_ERR(dentry
);
184 if (d_really_is_positive(dentry
)) {
187 inode_unlock(d_inode(root
));
192 inode
->i_private
= device
;
193 d_instantiate(dentry
, inode
);
194 fsnotify_create(root
->d_inode
, dentry
);
195 inode_unlock(d_inode(root
));
202 mutex_lock(&binderfs_minors_mutex
);
203 --info
->device_count
;
204 ida_free(&binderfs_minors
, minor
);
205 mutex_unlock(&binderfs_minors_mutex
);
212 * binderfs_ctl_ioctl - handle binder device node allocation requests
214 * The request handler for the binder-control device. All requests operate on
215 * the binderfs mount the binder-control device resides in:
217 * Allocate a new binder device.
219 * Return: 0 on success, negative errno on failure
221 static long binder_ctl_ioctl(struct file
*file
, unsigned int cmd
,
225 struct inode
*inode
= file_inode(file
);
226 struct binderfs_device __user
*device
= (struct binderfs_device __user
*)arg
;
227 struct binderfs_device device_req
;
231 ret
= copy_from_user(&device_req
, device
, sizeof(device_req
));
237 ret
= binderfs_binder_device_create(inode
, device
, &device_req
);
246 static void binderfs_evict_inode(struct inode
*inode
)
248 struct binder_device
*device
= inode
->i_private
;
249 struct binderfs_info
*info
= BINDERFS_I(inode
);
253 if (!S_ISCHR(inode
->i_mode
) || !device
)
256 mutex_lock(&binderfs_minors_mutex
);
257 --info
->device_count
;
258 ida_free(&binderfs_minors
, device
->miscdev
.minor
);
259 mutex_unlock(&binderfs_minors_mutex
);
261 if (refcount_dec_and_test(&device
->ref
)) {
262 kfree(device
->context
.name
);
268 * binderfs_parse_mount_opts - parse binderfs mount options
269 * @data: options to set (can be NULL in which case defaults are used)
271 static int binderfs_parse_mount_opts(char *data
,
272 struct binderfs_mount_opts
*opts
)
275 opts
->max
= BINDERFS_MAX_MINOR
;
276 opts
->stats_mode
= STATS_NONE
;
278 while ((p
= strsep(&data
, ",")) != NULL
) {
279 substring_t args
[MAX_OPT_ARGS
];
286 token
= match_token(p
, tokens
, args
);
289 if (match_int(&args
[0], &max_devices
) ||
291 (max_devices
> BINDERFS_MAX_MINOR
)))
294 opts
->max
= max_devices
;
297 if (!capable(CAP_SYS_ADMIN
))
300 stats
= match_strdup(&args
[0]);
304 if (strcmp(stats
, "global") != 0) {
309 opts
->stats_mode
= STATS_GLOBAL
;
313 pr_err("Invalid mount options\n");
321 static int binderfs_remount(struct super_block
*sb
, int *flags
, char *data
)
323 int prev_stats_mode
, ret
;
324 struct binderfs_info
*info
= sb
->s_fs_info
;
326 prev_stats_mode
= info
->mount_opts
.stats_mode
;
327 ret
= binderfs_parse_mount_opts(data
, &info
->mount_opts
);
331 if (prev_stats_mode
!= info
->mount_opts
.stats_mode
) {
332 pr_err("Binderfs stats mode cannot be changed during a remount\n");
333 info
->mount_opts
.stats_mode
= prev_stats_mode
;
340 static int binderfs_show_mount_opts(struct seq_file
*seq
, struct dentry
*root
)
342 struct binderfs_info
*info
;
344 info
= root
->d_sb
->s_fs_info
;
345 if (info
->mount_opts
.max
<= BINDERFS_MAX_MINOR
)
346 seq_printf(seq
, ",max=%d", info
->mount_opts
.max
);
347 if (info
->mount_opts
.stats_mode
== STATS_GLOBAL
)
348 seq_printf(seq
, ",stats=global");
353 static const struct super_operations binderfs_super_ops
= {
354 .evict_inode
= binderfs_evict_inode
,
355 .remount_fs
= binderfs_remount
,
356 .show_options
= binderfs_show_mount_opts
,
357 .statfs
= simple_statfs
,
360 static inline bool is_binderfs_control_device(const struct dentry
*dentry
)
362 struct binderfs_info
*info
= dentry
->d_sb
->s_fs_info
;
363 return info
->control_dentry
== dentry
;
366 static int binderfs_rename(struct inode
*old_dir
, struct dentry
*old_dentry
,
367 struct inode
*new_dir
, struct dentry
*new_dentry
,
370 if (is_binderfs_control_device(old_dentry
) ||
371 is_binderfs_control_device(new_dentry
))
374 return simple_rename(old_dir
, old_dentry
, new_dir
, new_dentry
, flags
);
377 static int binderfs_unlink(struct inode
*dir
, struct dentry
*dentry
)
379 if (is_binderfs_control_device(dentry
))
382 return simple_unlink(dir
, dentry
);
385 static const struct file_operations binder_ctl_fops
= {
386 .owner
= THIS_MODULE
,
387 .open
= nonseekable_open
,
388 .unlocked_ioctl
= binder_ctl_ioctl
,
389 .compat_ioctl
= binder_ctl_ioctl
,
390 .llseek
= noop_llseek
,
394 * binderfs_binder_ctl_create - create a new binder-control device
395 * @sb: super block of the binderfs mount
397 * This function creates a new binder-control device node in the binderfs mount
398 * referred to by @sb.
400 * Return: 0 on success, negative errno on failure
402 static int binderfs_binder_ctl_create(struct super_block
*sb
)
405 struct dentry
*dentry
;
406 struct binder_device
*device
;
407 struct inode
*inode
= NULL
;
408 struct dentry
*root
= sb
->s_root
;
409 struct binderfs_info
*info
= sb
->s_fs_info
;
410 #if defined(CONFIG_IPC_NS)
411 bool use_reserve
= (info
->ipc_ns
== &init_ipc_ns
);
413 bool use_reserve
= true;
416 device
= kzalloc(sizeof(*device
), GFP_KERNEL
);
420 /* If we have already created a binder-control node, return. */
421 if (info
->control_dentry
) {
427 inode
= new_inode(sb
);
431 /* Reserve a new minor number for the new device. */
432 mutex_lock(&binderfs_minors_mutex
);
433 minor
= ida_alloc_max(&binderfs_minors
,
434 use_reserve
? BINDERFS_MAX_MINOR
:
435 BINDERFS_MAX_MINOR_CAPPED
,
437 mutex_unlock(&binderfs_minors_mutex
);
443 inode
->i_ino
= SECOND_INODE
;
444 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
445 init_special_inode(inode
, S_IFCHR
| 0600,
446 MKDEV(MAJOR(binderfs_dev
), minor
));
447 inode
->i_fop
= &binder_ctl_fops
;
448 inode
->i_uid
= info
->root_uid
;
449 inode
->i_gid
= info
->root_gid
;
451 device
->binderfs_inode
= inode
;
452 device
->miscdev
.minor
= minor
;
454 dentry
= d_alloc_name(root
, "binder-control");
458 inode
->i_private
= device
;
459 info
->control_dentry
= dentry
;
460 d_add(dentry
, inode
);
471 static const struct inode_operations binderfs_dir_inode_operations
= {
472 .lookup
= simple_lookup
,
473 .rename
= binderfs_rename
,
474 .unlink
= binderfs_unlink
,
477 static struct inode
*binderfs_make_inode(struct super_block
*sb
, int mode
)
483 ret
->i_ino
= iunique(sb
, BINDERFS_MAX_MINOR
+ INODE_OFFSET
);
485 ret
->i_atime
= ret
->i_mtime
= ret
->i_ctime
= current_time(ret
);
490 static struct dentry
*binderfs_create_dentry(struct dentry
*parent
,
493 struct dentry
*dentry
;
495 dentry
= lookup_one_len(name
, parent
, strlen(name
));
499 /* Return error if the file/dir already exists. */
500 if (d_really_is_positive(dentry
)) {
502 return ERR_PTR(-EEXIST
);
508 void binderfs_remove_file(struct dentry
*dentry
)
510 struct inode
*parent_inode
;
512 parent_inode
= d_inode(dentry
->d_parent
);
513 inode_lock(parent_inode
);
514 if (simple_positive(dentry
)) {
516 simple_unlink(parent_inode
, dentry
);
520 inode_unlock(parent_inode
);
523 struct dentry
*binderfs_create_file(struct dentry
*parent
, const char *name
,
524 const struct file_operations
*fops
,
527 struct dentry
*dentry
;
528 struct inode
*new_inode
, *parent_inode
;
529 struct super_block
*sb
;
531 parent_inode
= d_inode(parent
);
532 inode_lock(parent_inode
);
534 dentry
= binderfs_create_dentry(parent
, name
);
538 sb
= parent_inode
->i_sb
;
539 new_inode
= binderfs_make_inode(sb
, S_IFREG
| 0444);
542 dentry
= ERR_PTR(-ENOMEM
);
546 new_inode
->i_fop
= fops
;
547 new_inode
->i_private
= data
;
548 d_instantiate(dentry
, new_inode
);
549 fsnotify_create(parent_inode
, dentry
);
552 inode_unlock(parent_inode
);
556 static struct dentry
*binderfs_create_dir(struct dentry
*parent
,
559 struct dentry
*dentry
;
560 struct inode
*new_inode
, *parent_inode
;
561 struct super_block
*sb
;
563 parent_inode
= d_inode(parent
);
564 inode_lock(parent_inode
);
566 dentry
= binderfs_create_dentry(parent
, name
);
570 sb
= parent_inode
->i_sb
;
571 new_inode
= binderfs_make_inode(sb
, S_IFDIR
| 0755);
574 dentry
= ERR_PTR(-ENOMEM
);
578 new_inode
->i_fop
= &simple_dir_operations
;
579 new_inode
->i_op
= &simple_dir_inode_operations
;
581 set_nlink(new_inode
, 2);
582 d_instantiate(dentry
, new_inode
);
583 inc_nlink(parent_inode
);
584 fsnotify_mkdir(parent_inode
, dentry
);
587 inode_unlock(parent_inode
);
591 static int init_binder_logs(struct super_block
*sb
)
593 struct dentry
*binder_logs_root_dir
, *dentry
, *proc_log_dir
;
594 struct binderfs_info
*info
;
597 binder_logs_root_dir
= binderfs_create_dir(sb
->s_root
,
599 if (IS_ERR(binder_logs_root_dir
)) {
600 ret
= PTR_ERR(binder_logs_root_dir
);
604 dentry
= binderfs_create_file(binder_logs_root_dir
, "stats",
605 &binder_stats_fops
, NULL
);
606 if (IS_ERR(dentry
)) {
607 ret
= PTR_ERR(dentry
);
611 dentry
= binderfs_create_file(binder_logs_root_dir
, "state",
612 &binder_state_fops
, NULL
);
613 if (IS_ERR(dentry
)) {
614 ret
= PTR_ERR(dentry
);
618 dentry
= binderfs_create_file(binder_logs_root_dir
, "transactions",
619 &binder_transactions_fops
, NULL
);
620 if (IS_ERR(dentry
)) {
621 ret
= PTR_ERR(dentry
);
625 dentry
= binderfs_create_file(binder_logs_root_dir
,
627 &binder_transaction_log_fops
,
628 &binder_transaction_log
);
629 if (IS_ERR(dentry
)) {
630 ret
= PTR_ERR(dentry
);
634 dentry
= binderfs_create_file(binder_logs_root_dir
,
635 "failed_transaction_log",
636 &binder_transaction_log_fops
,
637 &binder_transaction_log_failed
);
638 if (IS_ERR(dentry
)) {
639 ret
= PTR_ERR(dentry
);
643 proc_log_dir
= binderfs_create_dir(binder_logs_root_dir
, "proc");
644 if (IS_ERR(proc_log_dir
)) {
645 ret
= PTR_ERR(proc_log_dir
);
648 info
= sb
->s_fs_info
;
649 info
->proc_log_dir
= proc_log_dir
;
655 static int binderfs_fill_super(struct super_block
*sb
, void *data
, int silent
)
658 struct binderfs_info
*info
;
659 struct inode
*inode
= NULL
;
660 struct binderfs_device device_info
= { 0 };
664 sb
->s_blocksize
= PAGE_SIZE
;
665 sb
->s_blocksize_bits
= PAGE_SHIFT
;
668 * The binderfs filesystem can be mounted by userns root in a
669 * non-initial userns. By default such mounts have the SB_I_NODEV flag
670 * set in s_iflags to prevent security issues where userns root can
671 * just create random device nodes via mknod() since it owns the
672 * filesystem mount. But binderfs does not allow to create any files
673 * including devices nodes. The only way to create binder devices nodes
674 * is through the binder-control device which userns root is explicitly
675 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
676 * necessary and safe.
678 sb
->s_iflags
&= ~SB_I_NODEV
;
679 sb
->s_iflags
|= SB_I_NOEXEC
;
680 sb
->s_magic
= BINDERFS_SUPER_MAGIC
;
681 sb
->s_op
= &binderfs_super_ops
;
684 sb
->s_fs_info
= kzalloc(sizeof(struct binderfs_info
), GFP_KERNEL
);
687 info
= sb
->s_fs_info
;
689 info
->ipc_ns
= get_ipc_ns(current
->nsproxy
->ipc_ns
);
691 ret
= binderfs_parse_mount_opts(data
, &info
->mount_opts
);
695 info
->root_gid
= make_kgid(sb
->s_user_ns
, 0);
696 if (!gid_valid(info
->root_gid
))
697 info
->root_gid
= GLOBAL_ROOT_GID
;
698 info
->root_uid
= make_kuid(sb
->s_user_ns
, 0);
699 if (!uid_valid(info
->root_uid
))
700 info
->root_uid
= GLOBAL_ROOT_UID
;
702 inode
= new_inode(sb
);
706 inode
->i_ino
= FIRST_INODE
;
707 inode
->i_fop
= &simple_dir_operations
;
708 inode
->i_mode
= S_IFDIR
| 0755;
709 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
710 inode
->i_op
= &binderfs_dir_inode_operations
;
713 sb
->s_root
= d_make_root(inode
);
717 ret
= binderfs_binder_ctl_create(sb
);
721 name
= binder_devices_param
;
722 for (len
= strcspn(name
, ","); len
> 0; len
= strcspn(name
, ",")) {
723 strscpy(device_info
.name
, name
, len
+ 1);
724 ret
= binderfs_binder_device_create(inode
, NULL
, &device_info
);
732 if (info
->mount_opts
.stats_mode
== STATS_GLOBAL
)
733 return init_binder_logs(sb
);
738 static struct dentry
*binderfs_mount(struct file_system_type
*fs_type
,
739 int flags
, const char *dev_name
,
742 return mount_nodev(fs_type
, flags
, data
, binderfs_fill_super
);
745 static void binderfs_kill_super(struct super_block
*sb
)
747 struct binderfs_info
*info
= sb
->s_fs_info
;
749 kill_litter_super(sb
);
751 if (info
&& info
->ipc_ns
)
752 put_ipc_ns(info
->ipc_ns
);
757 static struct file_system_type binder_fs_type
= {
759 .mount
= binderfs_mount
,
760 .kill_sb
= binderfs_kill_super
,
761 .fs_flags
= FS_USERNS_MOUNT
,
764 int __init
init_binderfs(void)
770 /* Verify that the default binderfs device names are valid. */
771 name
= binder_devices_param
;
772 for (len
= strcspn(name
, ","); len
> 0; len
= strcspn(name
, ",")) {
773 if (len
> BINDERFS_MAX_NAME
)
780 /* Allocate new major number for binderfs. */
781 ret
= alloc_chrdev_region(&binderfs_dev
, 0, BINDERFS_MAX_MINOR
,
786 ret
= register_filesystem(&binder_fs_type
);
788 unregister_chrdev_region(binderfs_dev
, BINDERFS_MAX_MINOR
);