1
// SPDX-License-Identifier: GPL-2.0
2

3
#include <linux/compiler_types.h>
4
#include <linux/errno.h>
5
#include <linux/fs.h>
6
#include <linux/fsnotify.h>
7
#include <linux/gfp.h>
8
#include <linux/idr.h>
9
#include <linux/init.h>
10
#include <linux/ipc_namespace.h>
11
#include <linux/kdev_t.h>
12
#include <linux/kernel.h>
13
#include <linux/list.h>
14
#include <linux/namei.h>
15
#include <linux/magic.h>
16
#include <linux/major.h>
17
#include <linux/miscdevice.h>
18
#include <linux/module.h>
19
#include <linux/mutex.h>
20
#include <linux/mount.h>
21
#include <linux/fs_parser.h>
22
#include <linux/sched.h>
23
#include <linux/seq_file.h>
24
#include <linux/slab.h>
25
#include <linux/spinlock_types.h>
26
#include <linux/stddef.h>
27
#include <linux/string.h>
28
#include <linux/types.h>
29
#include <linux/uaccess.h>
30
#include <linux/user_namespace.h>
31
#include <linux/xarray.h>
32
#include <uapi/linux/android/binder.h>
33
#include <uapi/linux/android/binderfs.h>
34

35
#include "binder_internal.h"
36

37
#define FIRST_INODE 1
38
#define SECOND_INODE 2
39
#define INODE_OFFSET 3
40
#define BINDERFS_MAX_MINOR (1U << MINORBITS)
41
/* Ensure that the initial ipc namespace always has devices available. */
42
#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
43

44
static dev_t binderfs_dev;
45
static DEFINE_MUTEX(binderfs_minors_mutex);
46
static DEFINE_IDA(binderfs_minors);
47

48
enum binderfs_param {
49
	Opt_max,
50
	Opt_stats_mode,
51
};
52

53
enum binderfs_stats_mode {
54
	binderfs_stats_mode_unset,
55
	binderfs_stats_mode_global,
56
};
57

58
struct binder_features {
59
	bool oneway_spam_detection;
60
	bool extended_error;
61
	bool freeze_notification;
62
	bool transaction_report;
63
};
64

65
static const struct constant_table binderfs_param_stats[] = {
66
	{ "global", binderfs_stats_mode_global },
67
	{}
68
};
69

70
static const struct fs_parameter_spec binderfs_fs_parameters[] = {
71
	fsparam_u32("max",	Opt_max),
72
	fsparam_enum("stats",	Opt_stats_mode, binderfs_param_stats),
73
	{}
74
};
75

76
static struct binder_features binder_features = {
77
	.oneway_spam_detection = true,
78
	.extended_error = true,
79
	.freeze_notification = true,
80
	.transaction_report = true,
81
};
82

83
static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb)
84
{
85
	return sb->s_fs_info;
86
}
87

88
bool is_binderfs_device(const struct inode *inode)
89
{
90
	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
91
		return true;
92

93
	return false;
94
}
95

96
/**
97
 * binderfs_binder_device_create - allocate inode from super block of a
98
 *                                 binderfs mount
99
 * @ref_inode: inode from which the super block will be taken
100
 * @userp:     buffer to copy information about new device for userspace to
101
 * @req:       struct binderfs_device as copied from userspace
102
 *
103
 * This function allocates a new binder_device and reserves a new minor
104
 * number for it.
105
 * Minor numbers are limited and tracked globally in binderfs_minors. The
106
 * function will stash a struct binder_device for the specific binder
107
 * device in i_private of the inode.
108
 * It will go on to allocate a new inode from the super block of the
109
 * filesystem mount, stash a struct binder_device in its i_private field
110
 * and attach a dentry to that inode.
111
 *
112
 * Return: 0 on success, negative errno on failure
113
 */
114
static int binderfs_binder_device_create(struct inode *ref_inode,
115
					 struct binderfs_device __user *userp,
116
					 struct binderfs_device *req)
117
{
118
	int minor, ret;
119
	struct dentry *dentry, *root;
120
	struct binder_device *device;
121
	char *name = NULL;
122
	struct inode *inode = NULL;
123
	struct super_block *sb = ref_inode->i_sb;
124
	struct binderfs_info *info = sb->s_fs_info;
125
#if defined(CONFIG_IPC_NS)
126
	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
127
#else
128
	bool use_reserve = true;
129
#endif
130

131
	/* Reserve new minor number for the new device. */
132
	mutex_lock(&binderfs_minors_mutex);
133
	if (++info->device_count <= info->mount_opts.max)
134
		minor = ida_alloc_max(&binderfs_minors,
135
				      use_reserve ? BINDERFS_MAX_MINOR :
136
						    BINDERFS_MAX_MINOR_CAPPED,
137
				      GFP_KERNEL);
138
	else
139
		minor = -ENOSPC;
140
	if (minor < 0) {
141
		--info->device_count;
142
		mutex_unlock(&binderfs_minors_mutex);
143
		return minor;
144
	}
145
	mutex_unlock(&binderfs_minors_mutex);
146

147
	ret = -ENOMEM;
148
	device = kzalloc(sizeof(*device), GFP_KERNEL);
149
	if (!device)
150
		goto err;
151

152
	inode = new_inode(sb);
153
	if (!inode)
154
		goto err;
155

156
	inode->i_ino = minor + INODE_OFFSET;
157
	simple_inode_init_ts(inode);
158
	init_special_inode(inode, S_IFCHR | 0600,
159
			   MKDEV(MAJOR(binderfs_dev), minor));
160
	inode->i_fop = &binder_fops;
161
	inode->i_uid = info->root_uid;
162
	inode->i_gid = info->root_gid;
163

164
	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
165
	name = kstrdup(req->name, GFP_KERNEL);
166
	if (!name)
167
		goto err;
168

169
	refcount_set(&device->ref, 1);
170
	device->binderfs_inode = inode;
171
	device->context.binder_context_mgr_uid = INVALID_UID;
172
	device->context.name = name;
173
	device->miscdev.name = name;
174
	device->miscdev.minor = minor;
175
	mutex_init(&device->context.context_mgr_node_lock);
176

177
	req->major = MAJOR(binderfs_dev);
178
	req->minor = minor;
179

180
	if (userp && copy_to_user(userp, req, sizeof(*req))) {
181
		ret = -EFAULT;
182
		goto err;
183
	}
184

185
	root = sb->s_root;
186
	inode_lock(d_inode(root));
187

188
	/* look it up */
189
	dentry = lookup_noperm(&QSTR(name), root);
190
	if (IS_ERR(dentry)) {
191
		inode_unlock(d_inode(root));
192
		ret = PTR_ERR(dentry);
193
		goto err;
194
	}
195

196
	if (d_really_is_positive(dentry)) {
197
		/* already exists */
198
		dput(dentry);
199
		inode_unlock(d_inode(root));
200
		ret = -EEXIST;
201
		goto err;
202
	}
203

204
	inode->i_private = device;
205
	d_instantiate(dentry, inode);
206
	fsnotify_create(root->d_inode, dentry);
207
	inode_unlock(d_inode(root));
208

209
	binder_add_device(device);
210

211
	return 0;
212

213
err:
214
	kfree(name);
215
	kfree(device);
216
	mutex_lock(&binderfs_minors_mutex);
217
	--info->device_count;
218
	ida_free(&binderfs_minors, minor);
219
	mutex_unlock(&binderfs_minors_mutex);
220
	iput(inode);
221

222
	return ret;
223
}
224

225
/**
226
 * binder_ctl_ioctl - handle binder device node allocation requests
227
 *
228
 * The request handler for the binder-control device. All requests operate on
229
 * the binderfs mount the binder-control device resides in:
230
 * - BINDER_CTL_ADD
231
 *   Allocate a new binder device.
232
 *
233
 * Return: %0 on success, negative errno on failure.
234
 */
235
static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
236
			     unsigned long arg)
237
{
238
	int ret = -EINVAL;
239
	struct inode *inode = file_inode(file);
240
	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
241
	struct binderfs_device device_req;
242

243
	switch (cmd) {
244
	case BINDER_CTL_ADD:
245
		ret = copy_from_user(&device_req, device, sizeof(device_req));
246
		if (ret) {
247
			ret = -EFAULT;
248
			break;
249
		}
250

251
		ret = binderfs_binder_device_create(inode, device, &device_req);
252
		break;
253
	default:
254
		break;
255
	}
256

257
	return ret;
258
}
259

260
static void binderfs_evict_inode(struct inode *inode)
261
{
262
	struct binder_device *device = inode->i_private;
263
	struct binderfs_info *info = BINDERFS_SB(inode->i_sb);
264

265
	clear_inode(inode);
266

267
	if (!S_ISCHR(inode->i_mode) || !device)
268
		return;
269

270
	mutex_lock(&binderfs_minors_mutex);
271
	--info->device_count;
272
	ida_free(&binderfs_minors, device->miscdev.minor);
273
	mutex_unlock(&binderfs_minors_mutex);
274

275
	if (refcount_dec_and_test(&device->ref)) {
276
		binder_remove_device(device);
277
		kfree(device->context.name);
278
		kfree(device);
279
	}
280
}
281

282
static int binderfs_fs_context_parse_param(struct fs_context *fc,
283
					   struct fs_parameter *param)
284
{
285
	int opt;
286
	struct binderfs_mount_opts *ctx = fc->fs_private;
287
	struct fs_parse_result result;
288

289
	opt = fs_parse(fc, binderfs_fs_parameters, param, &result);
290
	if (opt < 0)
291
		return opt;
292

293
	switch (opt) {
294
	case Opt_max:
295
		if (result.uint_32 > BINDERFS_MAX_MINOR)
296
			return invalfc(fc, "Bad value for '%s'", param->key);
297

298
		ctx->max = result.uint_32;
299
		break;
300
	case Opt_stats_mode:
301
		if (!capable(CAP_SYS_ADMIN))
302
			return -EPERM;
303

304
		ctx->stats_mode = result.uint_32;
305
		break;
306
	default:
307
		return invalfc(fc, "Unsupported parameter '%s'", param->key);
308
	}
309

310
	return 0;
311
}
312

313
static int binderfs_fs_context_reconfigure(struct fs_context *fc)
314
{
315
	struct binderfs_mount_opts *ctx = fc->fs_private;
316
	struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb);
317

318
	if (info->mount_opts.stats_mode != ctx->stats_mode)
319
		return invalfc(fc, "Binderfs stats mode cannot be changed during a remount");
320

321
	info->mount_opts.stats_mode = ctx->stats_mode;
322
	info->mount_opts.max = ctx->max;
323
	return 0;
324
}
325

326
static int binderfs_show_options(struct seq_file *seq, struct dentry *root)
327
{
328
	struct binderfs_info *info = BINDERFS_SB(root->d_sb);
329

330
	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
331
		seq_printf(seq, ",max=%d", info->mount_opts.max);
332

333
	switch (info->mount_opts.stats_mode) {
334
	case binderfs_stats_mode_unset:
335
		break;
336
	case binderfs_stats_mode_global:
337
		seq_printf(seq, ",stats=global");
338
		break;
339
	}
340

341
	return 0;
342
}
343

344
static const struct super_operations binderfs_super_ops = {
345
	.evict_inode    = binderfs_evict_inode,
346
	.show_options	= binderfs_show_options,
347
	.statfs         = simple_statfs,
348
};
349

350
static inline bool is_binderfs_control_device(const struct dentry *dentry)
351
{
352
	struct binderfs_info *info = dentry->d_sb->s_fs_info;
353

354
	return info->control_dentry == dentry;
355
}
356

357
static int binderfs_rename(struct mnt_idmap *idmap,
358
			   struct inode *old_dir, struct dentry *old_dentry,
359
			   struct inode *new_dir, struct dentry *new_dentry,
360
			   unsigned int flags)
361
{
362
	if (is_binderfs_control_device(old_dentry) ||
363
	    is_binderfs_control_device(new_dentry))
364
		return -EPERM;
365

366
	return simple_rename(idmap, old_dir, old_dentry, new_dir,
367
			     new_dentry, flags);
368
}
369

370
static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
371
{
372
	if (is_binderfs_control_device(dentry))
373
		return -EPERM;
374

375
	return simple_unlink(dir, dentry);
376
}
377

378
static const struct file_operations binder_ctl_fops = {
379
	.owner		= THIS_MODULE,
380
	.open		= nonseekable_open,
381
	.unlocked_ioctl	= binder_ctl_ioctl,
382
	.compat_ioctl	= binder_ctl_ioctl,
383
	.llseek		= noop_llseek,
384
};
385

386
/**
387
 * binderfs_binder_ctl_create - create a new binder-control device
388
 * @sb: super block of the binderfs mount
389
 *
390
 * This function creates a new binder-control device node in the binderfs mount
391
 * referred to by @sb.
392
 *
393
 * Return: 0 on success, negative errno on failure
394
 */
395
static int binderfs_binder_ctl_create(struct super_block *sb)
396
{
397
	int minor, ret;
398
	struct dentry *dentry;
399
	struct binder_device *device;
400
	struct inode *inode = NULL;
401
	struct dentry *root = sb->s_root;
402
	struct binderfs_info *info = sb->s_fs_info;
403
#if defined(CONFIG_IPC_NS)
404
	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
405
#else
406
	bool use_reserve = true;
407
#endif
408

409
	device = kzalloc(sizeof(*device), GFP_KERNEL);
410
	if (!device)
411
		return -ENOMEM;
412

413
	/* If we have already created a binder-control node, return. */
414
	if (info->control_dentry) {
415
		ret = 0;
416
		goto out;
417
	}
418

419
	ret = -ENOMEM;
420
	inode = new_inode(sb);
421
	if (!inode)
422
		goto out;
423

424
	/* Reserve a new minor number for the new device. */
425
	mutex_lock(&binderfs_minors_mutex);
426
	minor = ida_alloc_max(&binderfs_minors,
427
			      use_reserve ? BINDERFS_MAX_MINOR :
428
					    BINDERFS_MAX_MINOR_CAPPED,
429
			      GFP_KERNEL);
430
	mutex_unlock(&binderfs_minors_mutex);
431
	if (minor < 0) {
432
		ret = minor;
433
		goto out;
434
	}
435

436
	inode->i_ino = SECOND_INODE;
437
	simple_inode_init_ts(inode);
438
	init_special_inode(inode, S_IFCHR | 0600,
439
			   MKDEV(MAJOR(binderfs_dev), minor));
440
	inode->i_fop = &binder_ctl_fops;
441
	inode->i_uid = info->root_uid;
442
	inode->i_gid = info->root_gid;
443

444
	refcount_set(&device->ref, 1);
445
	device->binderfs_inode = inode;
446
	device->miscdev.minor = minor;
447

448
	dentry = d_alloc_name(root, "binder-control");
449
	if (!dentry)
450
		goto out;
451

452
	inode->i_private = device;
453
	info->control_dentry = dentry;
454
	d_add(dentry, inode);
455

456
	return 0;
457

458
out:
459
	kfree(device);
460
	iput(inode);
461

462
	return ret;
463
}
464

465
static const struct inode_operations binderfs_dir_inode_operations = {
466
	.lookup = simple_lookup,
467
	.rename = binderfs_rename,
468
	.unlink = binderfs_unlink,
469
};
470

471
static struct inode *binderfs_make_inode(struct super_block *sb, int mode)
472
{
473
	struct inode *ret;
474

475
	ret = new_inode(sb);
476
	if (ret) {
477
		ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET);
478
		ret->i_mode = mode;
479
		simple_inode_init_ts(ret);
480
	}
481
	return ret;
482
}
483

484
static struct dentry *binderfs_create_dentry(struct dentry *parent,
485
					     const char *name)
486
{
487
	struct dentry *dentry;
488

489
	dentry = lookup_noperm(&QSTR(name), parent);
490
	if (IS_ERR(dentry))
491
		return dentry;
492

493
	/* Return error if the file/dir already exists. */
494
	if (d_really_is_positive(dentry)) {
495
		dput(dentry);
496
		return ERR_PTR(-EEXIST);
497
	}
498

499
	return dentry;
500
}
501

502
struct dentry *binderfs_create_file(struct dentry *parent, const char *name,
503
				    const struct file_operations *fops,
504
				    void *data)
505
{
506
	struct dentry *dentry;
507
	struct inode *new_inode, *parent_inode;
508
	struct super_block *sb;
509

510
	parent_inode = d_inode(parent);
511
	inode_lock(parent_inode);
512

513
	dentry = binderfs_create_dentry(parent, name);
514
	if (IS_ERR(dentry))
515
		goto out;
516

517
	sb = parent_inode->i_sb;
518
	new_inode = binderfs_make_inode(sb, S_IFREG | 0444);
519
	if (!new_inode) {
520
		dput(dentry);
521
		dentry = ERR_PTR(-ENOMEM);
522
		goto out;
523
	}
524

525
	new_inode->i_fop = fops;
526
	new_inode->i_private = data;
527
	d_instantiate(dentry, new_inode);
528
	fsnotify_create(parent_inode, dentry);
529

530
out:
531
	inode_unlock(parent_inode);
532
	return dentry;
533
}
534

535
static struct dentry *binderfs_create_dir(struct dentry *parent,
536
					  const char *name)
537
{
538
	struct dentry *dentry;
539
	struct inode *new_inode, *parent_inode;
540
	struct super_block *sb;
541

542
	parent_inode = d_inode(parent);
543
	inode_lock(parent_inode);
544

545
	dentry = binderfs_create_dentry(parent, name);
546
	if (IS_ERR(dentry))
547
		goto out;
548

549
	sb = parent_inode->i_sb;
550
	new_inode = binderfs_make_inode(sb, S_IFDIR | 0755);
551
	if (!new_inode) {
552
		dput(dentry);
553
		dentry = ERR_PTR(-ENOMEM);
554
		goto out;
555
	}
556

557
	new_inode->i_fop = &simple_dir_operations;
558
	new_inode->i_op = &simple_dir_inode_operations;
559

560
	set_nlink(new_inode, 2);
561
	d_instantiate(dentry, new_inode);
562
	inc_nlink(parent_inode);
563
	fsnotify_mkdir(parent_inode, dentry);
564

565
out:
566
	inode_unlock(parent_inode);
567
	return dentry;
568
}
569

570
static int binder_features_show(struct seq_file *m, void *unused)
571
{
572
	bool *feature = m->private;
573

574
	seq_printf(m, "%d\n", *feature);
575

576
	return 0;
577
}
578
DEFINE_SHOW_ATTRIBUTE(binder_features);
579

580
static int init_binder_features(struct super_block *sb)
581
{
582
	struct dentry *dentry, *dir;
583

584
	dir = binderfs_create_dir(sb->s_root, "features");
585
	if (IS_ERR(dir))
586
		return PTR_ERR(dir);
587

588
	dentry = binderfs_create_file(dir, "oneway_spam_detection",
589
				      &binder_features_fops,
590
				      &binder_features.oneway_spam_detection);
591
	if (IS_ERR(dentry))
592
		return PTR_ERR(dentry);
593

594
	dentry = binderfs_create_file(dir, "extended_error",
595
				      &binder_features_fops,
596
				      &binder_features.extended_error);
597
	if (IS_ERR(dentry))
598
		return PTR_ERR(dentry);
599

600
	dentry = binderfs_create_file(dir, "freeze_notification",
601
				      &binder_features_fops,
602
				      &binder_features.freeze_notification);
603
	if (IS_ERR(dentry))
604
		return PTR_ERR(dentry);
605

606
	dentry = binderfs_create_file(dir, "transaction_report",
607
				      &binder_features_fops,
608
				      &binder_features.transaction_report);
609
	if (IS_ERR(dentry))
610
		return PTR_ERR(dentry);
611

612
	return 0;
613
}
614

615
static int init_binder_logs(struct super_block *sb)
616
{
617
	struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir;
618
	const struct binder_debugfs_entry *db_entry;
619
	struct binderfs_info *info;
620
	int ret = 0;
621

622
	binder_logs_root_dir = binderfs_create_dir(sb->s_root,
623
						   "binder_logs");
624
	if (IS_ERR(binder_logs_root_dir)) {
625
		ret = PTR_ERR(binder_logs_root_dir);
626
		goto out;
627
	}
628

629
	binder_for_each_debugfs_entry(db_entry) {
630
		dentry = binderfs_create_file(binder_logs_root_dir,
631
					      db_entry->name,
632
					      db_entry->fops,
633
					      db_entry->data);
634
		if (IS_ERR(dentry)) {
635
			ret = PTR_ERR(dentry);
636
			goto out;
637
		}
638
	}
639

640
	proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc");
641
	if (IS_ERR(proc_log_dir)) {
642
		ret = PTR_ERR(proc_log_dir);
643
		goto out;
644
	}
645
	info = sb->s_fs_info;
646
	info->proc_log_dir = proc_log_dir;
647

648
out:
649
	return ret;
650
}
651

652
static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc)
653
{
654
	int ret;
655
	struct binderfs_info *info;
656
	struct binderfs_mount_opts *ctx = fc->fs_private;
657
	struct inode *inode = NULL;
658
	struct binderfs_device device_info = {};
659
	const char *name;
660
	size_t len;
661

662
	sb->s_blocksize = PAGE_SIZE;
663
	sb->s_blocksize_bits = PAGE_SHIFT;
664

665
	/*
666
	 * The binderfs filesystem can be mounted by userns root in a
667
	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
668
	 * set in s_iflags to prevent security issues where userns root can
669
	 * just create random device nodes via mknod() since it owns the
670
	 * filesystem mount. But binderfs does not allow to create any files
671
	 * including devices nodes. The only way to create binder devices nodes
672
	 * is through the binder-control device which userns root is explicitly
673
	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
674
	 * necessary and safe.
675
	 */
676
	sb->s_iflags &= ~SB_I_NODEV;
677
	sb->s_iflags |= SB_I_NOEXEC;
678
	sb->s_magic = BINDERFS_SUPER_MAGIC;
679
	sb->s_op = &binderfs_super_ops;
680
	sb->s_time_gran = 1;
681

682
	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
683
	if (!sb->s_fs_info)
684
		return -ENOMEM;
685
	info = sb->s_fs_info;
686

687
	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
688

689
	info->root_gid = make_kgid(sb->s_user_ns, 0);
690
	if (!gid_valid(info->root_gid))
691
		info->root_gid = GLOBAL_ROOT_GID;
692
	info->root_uid = make_kuid(sb->s_user_ns, 0);
693
	if (!uid_valid(info->root_uid))
694
		info->root_uid = GLOBAL_ROOT_UID;
695
	info->mount_opts.max = ctx->max;
696
	info->mount_opts.stats_mode = ctx->stats_mode;
697

698
	inode = new_inode(sb);
699
	if (!inode)
700
		return -ENOMEM;
701

702
	inode->i_ino = FIRST_INODE;
703
	inode->i_fop = &simple_dir_operations;
704
	inode->i_mode = S_IFDIR | 0755;
705
	simple_inode_init_ts(inode);
706
	inode->i_op = &binderfs_dir_inode_operations;
707
	set_nlink(inode, 2);
708

709
	sb->s_root = d_make_root(inode);
710
	if (!sb->s_root)
711
		return -ENOMEM;
712

713
	ret = binderfs_binder_ctl_create(sb);
714
	if (ret)
715
		return ret;
716

717
	name = binder_devices_param;
718
	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
719
		strscpy(device_info.name, name, len + 1);
720
		ret = binderfs_binder_device_create(inode, NULL, &device_info);
721
		if (ret)
722
			return ret;
723
		name += len;
724
		if (*name == ',')
725
			name++;
726
	}
727

728
	ret = init_binder_features(sb);
729
	if (ret)
730
		return ret;
731

732
	if (info->mount_opts.stats_mode == binderfs_stats_mode_global)
733
		return init_binder_logs(sb);
734

735
	return 0;
736
}
737

738
static int binderfs_fs_context_get_tree(struct fs_context *fc)
739
{
740
	return get_tree_nodev(fc, binderfs_fill_super);
741
}
742

743
static void binderfs_fs_context_free(struct fs_context *fc)
744
{
745
	struct binderfs_mount_opts *ctx = fc->fs_private;
746

747
	kfree(ctx);
748
}
749

750
static const struct fs_context_operations binderfs_fs_context_ops = {
751
	.free		= binderfs_fs_context_free,
752
	.get_tree	= binderfs_fs_context_get_tree,
753
	.parse_param	= binderfs_fs_context_parse_param,
754
	.reconfigure	= binderfs_fs_context_reconfigure,
755
};
756

757
static int binderfs_init_fs_context(struct fs_context *fc)
758
{
759
	struct binderfs_mount_opts *ctx;
760

761
	ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL);
762
	if (!ctx)
763
		return -ENOMEM;
764

765
	ctx->max = BINDERFS_MAX_MINOR;
766
	ctx->stats_mode = binderfs_stats_mode_unset;
767

768
	fc->fs_private = ctx;
769
	fc->ops = &binderfs_fs_context_ops;
770

771
	return 0;
772
}
773

774
static void binderfs_kill_super(struct super_block *sb)
775
{
776
	struct binderfs_info *info = sb->s_fs_info;
777

778
	/*
779
	 * During inode eviction struct binderfs_info is needed.
780
	 * So first wipe the super_block then free struct binderfs_info.
781
	 */
782
	kill_litter_super(sb);
783

784
	if (info && info->ipc_ns)
785
		put_ipc_ns(info->ipc_ns);
786

787
	kfree(info);
788
}
789

790
static struct file_system_type binder_fs_type = {
791
	.name			= "binder",
792
	.init_fs_context	= binderfs_init_fs_context,
793
	.parameters		= binderfs_fs_parameters,
794
	.kill_sb		= binderfs_kill_super,
795
	.fs_flags		= FS_USERNS_MOUNT,
796
};
797

798
int __init init_binderfs(void)
799
{
800
	int ret;
801
	const char *name;
802
	size_t len;
803

804
	/* Verify that the default binderfs device names are valid. */
805
	name = binder_devices_param;
806
	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
807
		if (len > BINDERFS_MAX_NAME)
808
			return -E2BIG;
809
		name += len;
810
		if (*name == ',')
811
			name++;
812
	}
813

814
	/* Allocate new major number for binderfs. */
815
	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
816
				  "binder");
817
	if (ret)
818
		return ret;
819

820
	ret = register_filesystem(&binder_fs_type);
821
	if (ret) {
822
		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
823
		return ret;
824
	}
825

826
	return ret;
827
}
828

829