1 /* SPDX-License-Identifier: GPL-2.0 */
3 #include <linux/compiler_types.h>
4 #include <linux/errno.h>
6 #include <linux/fsnotify.h>
9 #include <linux/init.h>
10 #include <linux/ipc_namespace.h>
11 #include <linux/kdev_t.h>
12 #include <linux/kernel.h>
13 #include <linux/list.h>
14 #include <linux/namei.h>
15 #include <linux/magic.h>
16 #include <linux/major.h>
17 #include <linux/miscdevice.h>
18 #include <linux/module.h>
19 #include <linux/mutex.h>
20 #include <linux/mount.h>
21 #include <linux/parser.h>
22 #include <linux/radix-tree.h>
23 #include <linux/sched.h>
24 #include <linux/seq_file.h>
25 #include <linux/slab.h>
26 #include <linux/spinlock_types.h>
27 #include <linux/stddef.h>
28 #include <linux/string.h>
29 #include <linux/types.h>
30 #include <linux/uaccess.h>
31 #include <linux/user_namespace.h>
32 #include <linux/xarray.h>
33 #include <uapi/asm-generic/errno-base.h>
34 #include <uapi/linux/android/binder.h>
35 #include <uapi/linux/android/binderfs.h>
37 #include "binder_internal.h"
40 #define SECOND_INODE 2
41 #define INODE_OFFSET 3
43 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
44 /* Ensure that the initial ipc namespace always has devices available. */
45 #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
47 static dev_t binderfs_dev
;
48 static DEFINE_MUTEX(binderfs_minors_mutex
);
49 static DEFINE_IDA(binderfs_minors
);
57 enum binderfs_stats_mode
{
62 static const match_table_t tokens
= {
63 { Opt_max
, "max=%d" },
64 { Opt_stats_mode
, "stats=%s" },
68 static inline struct binderfs_info
*BINDERFS_I(const struct inode
*inode
)
70 return inode
->i_sb
->s_fs_info
;
73 bool is_binderfs_device(const struct inode
*inode
)
75 if (inode
->i_sb
->s_magic
== BINDERFS_SUPER_MAGIC
)
82 * binderfs_binder_device_create - allocate inode from super block of a
84 * @ref_inode: inode from wich the super block will be taken
85 * @userp: buffer to copy information about new device for userspace to
86 * @req: struct binderfs_device as copied from userspace
88 * This function allocates a new binder_device and reserves a new minor
90 * Minor numbers are limited and tracked globally in binderfs_minors. The
91 * function will stash a struct binder_device for the specific binder
92 * device in i_private of the inode.
93 * It will go on to allocate a new inode from the super block of the
94 * filesystem mount, stash a struct binder_device in its i_private field
95 * and attach a dentry to that inode.
97 * Return: 0 on success, negative errno on failure
99 static int binderfs_binder_device_create(struct inode
*ref_inode
,
100 struct binderfs_device __user
*userp
,
101 struct binderfs_device
*req
)
104 struct dentry
*dentry
, *root
;
105 struct binder_device
*device
;
108 struct inode
*inode
= NULL
;
109 struct super_block
*sb
= ref_inode
->i_sb
;
110 struct binderfs_info
*info
= sb
->s_fs_info
;
111 #if defined(CONFIG_IPC_NS)
112 bool use_reserve
= (info
->ipc_ns
== &init_ipc_ns
);
114 bool use_reserve
= true;
117 /* Reserve new minor number for the new device. */
118 mutex_lock(&binderfs_minors_mutex
);
119 if (++info
->device_count
<= info
->mount_opts
.max
)
120 minor
= ida_alloc_max(&binderfs_minors
,
121 use_reserve
? BINDERFS_MAX_MINOR
:
122 BINDERFS_MAX_MINOR_CAPPED
,
127 --info
->device_count
;
128 mutex_unlock(&binderfs_minors_mutex
);
131 mutex_unlock(&binderfs_minors_mutex
);
134 device
= kzalloc(sizeof(*device
), GFP_KERNEL
);
138 inode
= new_inode(sb
);
142 inode
->i_ino
= minor
+ INODE_OFFSET
;
143 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
144 init_special_inode(inode
, S_IFCHR
| 0600,
145 MKDEV(MAJOR(binderfs_dev
), minor
));
146 inode
->i_fop
= &binder_fops
;
147 inode
->i_uid
= info
->root_uid
;
148 inode
->i_gid
= info
->root_gid
;
150 req
->name
[BINDERFS_MAX_NAME
] = '\0'; /* NUL-terminate */
151 name_len
= strlen(req
->name
);
152 /* Make sure to include terminating NUL byte */
153 name
= kmemdup(req
->name
, name_len
+ 1, GFP_KERNEL
);
157 refcount_set(&device
->ref
, 1);
158 device
->binderfs_inode
= inode
;
159 device
->context
.binder_context_mgr_uid
= INVALID_UID
;
160 device
->context
.name
= name
;
161 device
->miscdev
.name
= name
;
162 device
->miscdev
.minor
= minor
;
163 mutex_init(&device
->context
.context_mgr_node_lock
);
165 req
->major
= MAJOR(binderfs_dev
);
168 if (userp
&& copy_to_user(userp
, req
, sizeof(*req
))) {
174 inode_lock(d_inode(root
));
177 dentry
= lookup_one_len(name
, root
, name_len
);
178 if (IS_ERR(dentry
)) {
179 inode_unlock(d_inode(root
));
180 ret
= PTR_ERR(dentry
);
184 if (d_really_is_positive(dentry
)) {
187 inode_unlock(d_inode(root
));
192 inode
->i_private
= device
;
193 d_instantiate(dentry
, inode
);
194 fsnotify_create(root
->d_inode
, dentry
);
195 inode_unlock(d_inode(root
));
202 mutex_lock(&binderfs_minors_mutex
);
203 --info
->device_count
;
204 ida_free(&binderfs_minors
, minor
);
205 mutex_unlock(&binderfs_minors_mutex
);
212 * binderfs_ctl_ioctl - handle binder device node allocation requests
214 * The request handler for the binder-control device. All requests operate on
215 * the binderfs mount the binder-control device resides in:
217 * Allocate a new binder device.
219 * Return: 0 on success, negative errno on failure
221 static long binder_ctl_ioctl(struct file
*file
, unsigned int cmd
,
225 struct inode
*inode
= file_inode(file
);
226 struct binderfs_device __user
*device
= (struct binderfs_device __user
*)arg
;
227 struct binderfs_device device_req
;
231 ret
= copy_from_user(&device_req
, device
, sizeof(device_req
));
237 ret
= binderfs_binder_device_create(inode
, device
, &device_req
);
246 static void binderfs_evict_inode(struct inode
*inode
)
248 struct binder_device
*device
= inode
->i_private
;
249 struct binderfs_info
*info
= BINDERFS_I(inode
);
253 if (!S_ISCHR(inode
->i_mode
) || !device
)
256 mutex_lock(&binderfs_minors_mutex
);
257 --info
->device_count
;
258 ida_free(&binderfs_minors
, device
->miscdev
.minor
);
259 mutex_unlock(&binderfs_minors_mutex
);
261 if (refcount_dec_and_test(&device
->ref
)) {
262 kfree(device
->context
.name
);
268 * binderfs_parse_mount_opts - parse binderfs mount options
269 * @data: options to set (can be NULL in which case defaults are used)
271 static int binderfs_parse_mount_opts(char *data
,
272 struct binderfs_mount_opts
*opts
)
275 opts
->max
= BINDERFS_MAX_MINOR
;
276 opts
->stats_mode
= STATS_NONE
;
278 while ((p
= strsep(&data
, ",")) != NULL
) {
279 substring_t args
[MAX_OPT_ARGS
];
286 token
= match_token(p
, tokens
, args
);
289 if (match_int(&args
[0], &max_devices
) ||
291 (max_devices
> BINDERFS_MAX_MINOR
)))
294 opts
->max
= max_devices
;
297 if (!capable(CAP_SYS_ADMIN
))
300 stats
= match_strdup(&args
[0]);
304 if (strcmp(stats
, "global") != 0) {
309 opts
->stats_mode
= STATS_GLOBAL
;
313 pr_err("Invalid mount options\n");
321 static int binderfs_remount(struct super_block
*sb
, int *flags
, char *data
)
323 int prev_stats_mode
, ret
;
324 struct binderfs_info
*info
= sb
->s_fs_info
;
326 prev_stats_mode
= info
->mount_opts
.stats_mode
;
327 ret
= binderfs_parse_mount_opts(data
, &info
->mount_opts
);
331 if (prev_stats_mode
!= info
->mount_opts
.stats_mode
) {
332 pr_err("Binderfs stats mode cannot be changed during a remount\n");
333 info
->mount_opts
.stats_mode
= prev_stats_mode
;
340 static int binderfs_show_mount_opts(struct seq_file
*seq
, struct dentry
*root
)
342 struct binderfs_info
*info
;
344 info
= root
->d_sb
->s_fs_info
;
345 if (info
->mount_opts
.max
<= BINDERFS_MAX_MINOR
)
346 seq_printf(seq
, ",max=%d", info
->mount_opts
.max
);
347 if (info
->mount_opts
.stats_mode
== STATS_GLOBAL
)
348 seq_printf(seq
, ",stats=global");
353 static const struct super_operations binderfs_super_ops
= {
354 .evict_inode
= binderfs_evict_inode
,
355 .remount_fs
= binderfs_remount
,
356 .show_options
= binderfs_show_mount_opts
,
357 .statfs
= simple_statfs
,
360 static inline bool is_binderfs_control_device(const struct dentry
*dentry
)
362 struct binderfs_info
*info
= dentry
->d_sb
->s_fs_info
;
363 return info
->control_dentry
== dentry
;
366 static int binderfs_rename(struct inode
*old_dir
, struct dentry
*old_dentry
,
367 struct inode
*new_dir
, struct dentry
*new_dentry
,
370 if (is_binderfs_control_device(old_dentry
) ||
371 is_binderfs_control_device(new_dentry
))
374 return simple_rename(old_dir
, old_dentry
, new_dir
, new_dentry
, flags
);
377 static int binderfs_unlink(struct inode
*dir
, struct dentry
*dentry
)
379 if (is_binderfs_control_device(dentry
))
382 return simple_unlink(dir
, dentry
);
385 static const struct file_operations binder_ctl_fops
= {
386 .owner
= THIS_MODULE
,
387 .open
= nonseekable_open
,
388 .unlocked_ioctl
= binder_ctl_ioctl
,
389 .compat_ioctl
= binder_ctl_ioctl
,
390 .llseek
= noop_llseek
,
394 * binderfs_binder_ctl_create - create a new binder-control device
395 * @sb: super block of the binderfs mount
397 * This function creates a new binder-control device node in the binderfs mount
398 * referred to by @sb.
400 * Return: 0 on success, negative errno on failure
402 static int binderfs_binder_ctl_create(struct super_block
*sb
)
405 struct dentry
*dentry
;
406 struct binder_device
*device
;
407 struct inode
*inode
= NULL
;
408 struct dentry
*root
= sb
->s_root
;
409 struct binderfs_info
*info
= sb
->s_fs_info
;
410 #if defined(CONFIG_IPC_NS)
411 bool use_reserve
= (info
->ipc_ns
== &init_ipc_ns
);
413 bool use_reserve
= true;
416 device
= kzalloc(sizeof(*device
), GFP_KERNEL
);
420 /* If we have already created a binder-control node, return. */
421 if (info
->control_dentry
) {
427 inode
= new_inode(sb
);
431 /* Reserve a new minor number for the new device. */
432 mutex_lock(&binderfs_minors_mutex
);
433 minor
= ida_alloc_max(&binderfs_minors
,
434 use_reserve
? BINDERFS_MAX_MINOR
:
435 BINDERFS_MAX_MINOR_CAPPED
,
437 mutex_unlock(&binderfs_minors_mutex
);
443 inode
->i_ino
= SECOND_INODE
;
444 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
445 init_special_inode(inode
, S_IFCHR
| 0600,
446 MKDEV(MAJOR(binderfs_dev
), minor
));
447 inode
->i_fop
= &binder_ctl_fops
;
448 inode
->i_uid
= info
->root_uid
;
449 inode
->i_gid
= info
->root_gid
;
451 refcount_set(&device
->ref
, 1);
452 device
->binderfs_inode
= inode
;
453 device
->miscdev
.minor
= minor
;
455 dentry
= d_alloc_name(root
, "binder-control");
459 inode
->i_private
= device
;
460 info
->control_dentry
= dentry
;
461 d_add(dentry
, inode
);
472 static const struct inode_operations binderfs_dir_inode_operations
= {
473 .lookup
= simple_lookup
,
474 .rename
= binderfs_rename
,
475 .unlink
= binderfs_unlink
,
478 static struct inode
*binderfs_make_inode(struct super_block
*sb
, int mode
)
484 ret
->i_ino
= iunique(sb
, BINDERFS_MAX_MINOR
+ INODE_OFFSET
);
486 ret
->i_atime
= ret
->i_mtime
= ret
->i_ctime
= current_time(ret
);
491 static struct dentry
*binderfs_create_dentry(struct dentry
*parent
,
494 struct dentry
*dentry
;
496 dentry
= lookup_one_len(name
, parent
, strlen(name
));
500 /* Return error if the file/dir already exists. */
501 if (d_really_is_positive(dentry
)) {
503 return ERR_PTR(-EEXIST
);
509 void binderfs_remove_file(struct dentry
*dentry
)
511 struct inode
*parent_inode
;
513 parent_inode
= d_inode(dentry
->d_parent
);
514 inode_lock(parent_inode
);
515 if (simple_positive(dentry
)) {
517 simple_unlink(parent_inode
, dentry
);
521 inode_unlock(parent_inode
);
524 struct dentry
*binderfs_create_file(struct dentry
*parent
, const char *name
,
525 const struct file_operations
*fops
,
528 struct dentry
*dentry
;
529 struct inode
*new_inode
, *parent_inode
;
530 struct super_block
*sb
;
532 parent_inode
= d_inode(parent
);
533 inode_lock(parent_inode
);
535 dentry
= binderfs_create_dentry(parent
, name
);
539 sb
= parent_inode
->i_sb
;
540 new_inode
= binderfs_make_inode(sb
, S_IFREG
| 0444);
543 dentry
= ERR_PTR(-ENOMEM
);
547 new_inode
->i_fop
= fops
;
548 new_inode
->i_private
= data
;
549 d_instantiate(dentry
, new_inode
);
550 fsnotify_create(parent_inode
, dentry
);
553 inode_unlock(parent_inode
);
557 static struct dentry
*binderfs_create_dir(struct dentry
*parent
,
560 struct dentry
*dentry
;
561 struct inode
*new_inode
, *parent_inode
;
562 struct super_block
*sb
;
564 parent_inode
= d_inode(parent
);
565 inode_lock(parent_inode
);
567 dentry
= binderfs_create_dentry(parent
, name
);
571 sb
= parent_inode
->i_sb
;
572 new_inode
= binderfs_make_inode(sb
, S_IFDIR
| 0755);
575 dentry
= ERR_PTR(-ENOMEM
);
579 new_inode
->i_fop
= &simple_dir_operations
;
580 new_inode
->i_op
= &simple_dir_inode_operations
;
582 set_nlink(new_inode
, 2);
583 d_instantiate(dentry
, new_inode
);
584 inc_nlink(parent_inode
);
585 fsnotify_mkdir(parent_inode
, dentry
);
588 inode_unlock(parent_inode
);
592 static int init_binder_logs(struct super_block
*sb
)
594 struct dentry
*binder_logs_root_dir
, *dentry
, *proc_log_dir
;
595 struct binderfs_info
*info
;
598 binder_logs_root_dir
= binderfs_create_dir(sb
->s_root
,
600 if (IS_ERR(binder_logs_root_dir
)) {
601 ret
= PTR_ERR(binder_logs_root_dir
);
605 dentry
= binderfs_create_file(binder_logs_root_dir
, "stats",
606 &binder_stats_fops
, NULL
);
607 if (IS_ERR(dentry
)) {
608 ret
= PTR_ERR(dentry
);
612 dentry
= binderfs_create_file(binder_logs_root_dir
, "state",
613 &binder_state_fops
, NULL
);
614 if (IS_ERR(dentry
)) {
615 ret
= PTR_ERR(dentry
);
619 dentry
= binderfs_create_file(binder_logs_root_dir
, "transactions",
620 &binder_transactions_fops
, NULL
);
621 if (IS_ERR(dentry
)) {
622 ret
= PTR_ERR(dentry
);
626 dentry
= binderfs_create_file(binder_logs_root_dir
,
628 &binder_transaction_log_fops
,
629 &binder_transaction_log
);
630 if (IS_ERR(dentry
)) {
631 ret
= PTR_ERR(dentry
);
635 dentry
= binderfs_create_file(binder_logs_root_dir
,
636 "failed_transaction_log",
637 &binder_transaction_log_fops
,
638 &binder_transaction_log_failed
);
639 if (IS_ERR(dentry
)) {
640 ret
= PTR_ERR(dentry
);
644 proc_log_dir
= binderfs_create_dir(binder_logs_root_dir
, "proc");
645 if (IS_ERR(proc_log_dir
)) {
646 ret
= PTR_ERR(proc_log_dir
);
649 info
= sb
->s_fs_info
;
650 info
->proc_log_dir
= proc_log_dir
;
656 static int binderfs_fill_super(struct super_block
*sb
, void *data
, int silent
)
659 struct binderfs_info
*info
;
660 struct inode
*inode
= NULL
;
661 struct binderfs_device device_info
= { 0 };
665 sb
->s_blocksize
= PAGE_SIZE
;
666 sb
->s_blocksize_bits
= PAGE_SHIFT
;
669 * The binderfs filesystem can be mounted by userns root in a
670 * non-initial userns. By default such mounts have the SB_I_NODEV flag
671 * set in s_iflags to prevent security issues where userns root can
672 * just create random device nodes via mknod() since it owns the
673 * filesystem mount. But binderfs does not allow to create any files
674 * including devices nodes. The only way to create binder devices nodes
675 * is through the binder-control device which userns root is explicitly
676 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
677 * necessary and safe.
679 sb
->s_iflags
&= ~SB_I_NODEV
;
680 sb
->s_iflags
|= SB_I_NOEXEC
;
681 sb
->s_magic
= BINDERFS_SUPER_MAGIC
;
682 sb
->s_op
= &binderfs_super_ops
;
685 sb
->s_fs_info
= kzalloc(sizeof(struct binderfs_info
), GFP_KERNEL
);
688 info
= sb
->s_fs_info
;
690 info
->ipc_ns
= get_ipc_ns(current
->nsproxy
->ipc_ns
);
692 ret
= binderfs_parse_mount_opts(data
, &info
->mount_opts
);
696 info
->root_gid
= make_kgid(sb
->s_user_ns
, 0);
697 if (!gid_valid(info
->root_gid
))
698 info
->root_gid
= GLOBAL_ROOT_GID
;
699 info
->root_uid
= make_kuid(sb
->s_user_ns
, 0);
700 if (!uid_valid(info
->root_uid
))
701 info
->root_uid
= GLOBAL_ROOT_UID
;
703 inode
= new_inode(sb
);
707 inode
->i_ino
= FIRST_INODE
;
708 inode
->i_fop
= &simple_dir_operations
;
709 inode
->i_mode
= S_IFDIR
| 0755;
710 inode
->i_mtime
= inode
->i_atime
= inode
->i_ctime
= current_time(inode
);
711 inode
->i_op
= &binderfs_dir_inode_operations
;
714 sb
->s_root
= d_make_root(inode
);
718 ret
= binderfs_binder_ctl_create(sb
);
722 name
= binder_devices_param
;
723 for (len
= strcspn(name
, ","); len
> 0; len
= strcspn(name
, ",")) {
724 strscpy(device_info
.name
, name
, len
+ 1);
725 ret
= binderfs_binder_device_create(inode
, NULL
, &device_info
);
733 if (info
->mount_opts
.stats_mode
== STATS_GLOBAL
)
734 return init_binder_logs(sb
);
739 static struct dentry
*binderfs_mount(struct file_system_type
*fs_type
,
740 int flags
, const char *dev_name
,
743 return mount_nodev(fs_type
, flags
, data
, binderfs_fill_super
);
746 static void binderfs_kill_super(struct super_block
*sb
)
748 struct binderfs_info
*info
= sb
->s_fs_info
;
750 kill_litter_super(sb
);
752 if (info
&& info
->ipc_ns
)
753 put_ipc_ns(info
->ipc_ns
);
758 static struct file_system_type binder_fs_type
= {
760 .mount
= binderfs_mount
,
761 .kill_sb
= binderfs_kill_super
,
762 .fs_flags
= FS_USERNS_MOUNT
,
765 int __init
init_binderfs(void)
771 /* Verify that the default binderfs device names are valid. */
772 name
= binder_devices_param
;
773 for (len
= strcspn(name
, ","); len
> 0; len
= strcspn(name
, ",")) {
774 if (len
> BINDERFS_MAX_NAME
)
781 /* Allocate new major number for binderfs. */
782 ret
= alloc_chrdev_region(&binderfs_dev
, 0, BINDERFS_MAX_MINOR
,
787 ret
= register_filesystem(&binder_fs_type
);
789 unregister_chrdev_region(binderfs_dev
, BINDERFS_MAX_MINOR
);