1// SPDX-License-Identifier: GPL-2.0
  2
  3#include <linux/compiler_types.h>
  4#include <linux/errno.h>
  5#include <linux/fs.h>
  6#include <linux/fsnotify.h>
  7#include <linux/gfp.h>
  8#include <linux/idr.h>
  9#include <linux/init.h>
 10#include <linux/ipc_namespace.h>
 11#include <linux/kdev_t.h>
 12#include <linux/kernel.h>
 13#include <linux/list.h>
 14#include <linux/namei.h>
 15#include <linux/magic.h>
 16#include <linux/major.h>
 17#include <linux/miscdevice.h>
 18#include <linux/module.h>
 19#include <linux/mutex.h>
 20#include <linux/mount.h>
 21#include <linux/fs_parser.h>
 22#include <linux/sched.h>
 23#include <linux/seq_file.h>
 24#include <linux/slab.h>
 25#include <linux/spinlock_types.h>
 26#include <linux/stddef.h>
 27#include <linux/string.h>
 28#include <linux/types.h>
 29#include <linux/uaccess.h>
 30#include <linux/user_namespace.h>
 31#include <linux/xarray.h>
 32#include <uapi/linux/android/binder.h>
 33#include <uapi/linux/android/binderfs.h>
 34
 35#include "binder_internal.h"
 36
 37#define FIRST_INODE 1
 38#define SECOND_INODE 2
 39#define INODE_OFFSET 3
 40#define BINDERFS_MAX_MINOR (1U << MINORBITS)
 41/* Ensure that the initial ipc namespace always has devices available. */
 42#define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
 43
 44static dev_t binderfs_dev;
 45static DEFINE_MUTEX(binderfs_minors_mutex);
 46static DEFINE_IDA(binderfs_minors);
 47
 48enum binderfs_param {
 49	Opt_max,
 50	Opt_stats_mode,
 51};
 52
 53enum binderfs_stats_mode {
 54	binderfs_stats_mode_unset,
 55	binderfs_stats_mode_global,
 56};
 57
 58struct binder_features {
 59	bool oneway_spam_detection;
 60	bool extended_error;
 
 61};
 62
 63static const struct constant_table binderfs_param_stats[] = {
 64	{ "global", binderfs_stats_mode_global },
 65	{}
 66};
 67
 68static const struct fs_parameter_spec binderfs_fs_parameters[] = {
 69	fsparam_u32("max",	Opt_max),
 70	fsparam_enum("stats",	Opt_stats_mode, binderfs_param_stats),
 71	{}
 72};
 73
 74static struct binder_features binder_features = {
 75	.oneway_spam_detection = true,
 76	.extended_error = true,
 
 77};
 78
 79static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb)
 80{
 81	return sb->s_fs_info;
 82}
 83
 84bool is_binderfs_device(const struct inode *inode)
 85{
 86	if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
 87		return true;
 88
 89	return false;
 90}
 91
 92/**
 93 * binderfs_binder_device_create - allocate inode from super block of a
 94 *                                 binderfs mount
 95 * @ref_inode: inode from which the super block will be taken
 96 * @userp:     buffer to copy information about new device for userspace to
 97 * @req:       struct binderfs_device as copied from userspace
 98 *
 99 * This function allocates a new binder_device and reserves a new minor
100 * number for it.
101 * Minor numbers are limited and tracked globally in binderfs_minors. The
102 * function will stash a struct binder_device for the specific binder
103 * device in i_private of the inode.
104 * It will go on to allocate a new inode from the super block of the
105 * filesystem mount, stash a struct binder_device in its i_private field
106 * and attach a dentry to that inode.
107 *
108 * Return: 0 on success, negative errno on failure
109 */
110static int binderfs_binder_device_create(struct inode *ref_inode,
111					 struct binderfs_device __user *userp,
112					 struct binderfs_device *req)
113{
114	int minor, ret;
115	struct dentry *dentry, *root;
116	struct binder_device *device;
117	char *name = NULL;
118	size_t name_len;
119	struct inode *inode = NULL;
120	struct super_block *sb = ref_inode->i_sb;
121	struct binderfs_info *info = sb->s_fs_info;
122#if defined(CONFIG_IPC_NS)
123	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
124#else
125	bool use_reserve = true;
126#endif
127
128	/* Reserve new minor number for the new device. */
129	mutex_lock(&binderfs_minors_mutex);
130	if (++info->device_count <= info->mount_opts.max)
131		minor = ida_alloc_max(&binderfs_minors,
132				      use_reserve ? BINDERFS_MAX_MINOR :
133						    BINDERFS_MAX_MINOR_CAPPED,
134				      GFP_KERNEL);
135	else
136		minor = -ENOSPC;
137	if (minor < 0) {
138		--info->device_count;
139		mutex_unlock(&binderfs_minors_mutex);
140		return minor;
141	}
142	mutex_unlock(&binderfs_minors_mutex);
143
144	ret = -ENOMEM;
145	device = kzalloc(sizeof(*device), GFP_KERNEL);
146	if (!device)
147		goto err;
148
149	inode = new_inode(sb);
150	if (!inode)
151		goto err;
152
153	inode->i_ino = minor + INODE_OFFSET;
154	simple_inode_init_ts(inode);
155	init_special_inode(inode, S_IFCHR | 0600,
156			   MKDEV(MAJOR(binderfs_dev), minor));
157	inode->i_fop = &binder_fops;
158	inode->i_uid = info->root_uid;
159	inode->i_gid = info->root_gid;
160
161	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
162	name_len = strlen(req->name);
163	/* Make sure to include terminating NUL byte */
164	name = kmemdup(req->name, name_len + 1, GFP_KERNEL);
165	if (!name)
166		goto err;
167
168	refcount_set(&device->ref, 1);
169	device->binderfs_inode = inode;
170	device->context.binder_context_mgr_uid = INVALID_UID;
171	device->context.name = name;
172	device->miscdev.name = name;
173	device->miscdev.minor = minor;
174	mutex_init(&device->context.context_mgr_node_lock);
175
176	req->major = MAJOR(binderfs_dev);
177	req->minor = minor;
178
179	if (userp && copy_to_user(userp, req, sizeof(*req))) {
180		ret = -EFAULT;
181		goto err;
182	}
183
184	root = sb->s_root;
185	inode_lock(d_inode(root));
186
187	/* look it up */
188	dentry = lookup_one_len(name, root, name_len);
189	if (IS_ERR(dentry)) {
190		inode_unlock(d_inode(root));
191		ret = PTR_ERR(dentry);
192		goto err;
193	}
194
195	if (d_really_is_positive(dentry)) {
196		/* already exists */
197		dput(dentry);
198		inode_unlock(d_inode(root));
199		ret = -EEXIST;
200		goto err;
201	}
202
203	inode->i_private = device;
204	d_instantiate(dentry, inode);
205	fsnotify_create(root->d_inode, dentry);
206	inode_unlock(d_inode(root));
207
208	return 0;
209
210err:
211	kfree(name);
212	kfree(device);
213	mutex_lock(&binderfs_minors_mutex);
214	--info->device_count;
215	ida_free(&binderfs_minors, minor);
216	mutex_unlock(&binderfs_minors_mutex);
217	iput(inode);
218
219	return ret;
220}
221
222/**
223 * binder_ctl_ioctl - handle binder device node allocation requests
224 *
225 * The request handler for the binder-control device. All requests operate on
226 * the binderfs mount the binder-control device resides in:
227 * - BINDER_CTL_ADD
228 *   Allocate a new binder device.
229 *
230 * Return: %0 on success, negative errno on failure.
231 */
232static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
233			     unsigned long arg)
234{
235	int ret = -EINVAL;
236	struct inode *inode = file_inode(file);
237	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
238	struct binderfs_device device_req;
239
240	switch (cmd) {
241	case BINDER_CTL_ADD:
242		ret = copy_from_user(&device_req, device, sizeof(device_req));
243		if (ret) {
244			ret = -EFAULT;
245			break;
246		}
247
248		ret = binderfs_binder_device_create(inode, device, &device_req);
249		break;
250	default:
251		break;
252	}
253
254	return ret;
255}
256
257static void binderfs_evict_inode(struct inode *inode)
258{
259	struct binder_device *device = inode->i_private;
260	struct binderfs_info *info = BINDERFS_SB(inode->i_sb);
261
262	clear_inode(inode);
263
264	if (!S_ISCHR(inode->i_mode) || !device)
265		return;
266
267	mutex_lock(&binderfs_minors_mutex);
268	--info->device_count;
269	ida_free(&binderfs_minors, device->miscdev.minor);
270	mutex_unlock(&binderfs_minors_mutex);
271
272	if (refcount_dec_and_test(&device->ref)) {
273		kfree(device->context.name);
274		kfree(device);
275	}
276}
277
278static int binderfs_fs_context_parse_param(struct fs_context *fc,
279					   struct fs_parameter *param)
280{
281	int opt;
282	struct binderfs_mount_opts *ctx = fc->fs_private;
283	struct fs_parse_result result;
284
285	opt = fs_parse(fc, binderfs_fs_parameters, param, &result);
286	if (opt < 0)
287		return opt;
288
289	switch (opt) {
290	case Opt_max:
291		if (result.uint_32 > BINDERFS_MAX_MINOR)
292			return invalfc(fc, "Bad value for '%s'", param->key);
293
294		ctx->max = result.uint_32;
295		break;
296	case Opt_stats_mode:
297		if (!capable(CAP_SYS_ADMIN))
298			return -EPERM;
299
300		ctx->stats_mode = result.uint_32;
301		break;
302	default:
303		return invalfc(fc, "Unsupported parameter '%s'", param->key);
304	}
305
306	return 0;
307}
308
309static int binderfs_fs_context_reconfigure(struct fs_context *fc)
310{
311	struct binderfs_mount_opts *ctx = fc->fs_private;
312	struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb);
313
314	if (info->mount_opts.stats_mode != ctx->stats_mode)
315		return invalfc(fc, "Binderfs stats mode cannot be changed during a remount");
316
317	info->mount_opts.stats_mode = ctx->stats_mode;
318	info->mount_opts.max = ctx->max;
319	return 0;
320}
321
322static int binderfs_show_options(struct seq_file *seq, struct dentry *root)
323{
324	struct binderfs_info *info = BINDERFS_SB(root->d_sb);
325
326	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
327		seq_printf(seq, ",max=%d", info->mount_opts.max);
328
329	switch (info->mount_opts.stats_mode) {
330	case binderfs_stats_mode_unset:
331		break;
332	case binderfs_stats_mode_global:
333		seq_printf(seq, ",stats=global");
334		break;
335	}
336
337	return 0;
338}
339
340static const struct super_operations binderfs_super_ops = {
341	.evict_inode    = binderfs_evict_inode,
342	.show_options	= binderfs_show_options,
343	.statfs         = simple_statfs,
344};
345
346static inline bool is_binderfs_control_device(const struct dentry *dentry)
347{
348	struct binderfs_info *info = dentry->d_sb->s_fs_info;
349
350	return info->control_dentry == dentry;
351}
352
353static int binderfs_rename(struct mnt_idmap *idmap,
354			   struct inode *old_dir, struct dentry *old_dentry,
355			   struct inode *new_dir, struct dentry *new_dentry,
356			   unsigned int flags)
357{
358	if (is_binderfs_control_device(old_dentry) ||
359	    is_binderfs_control_device(new_dentry))
360		return -EPERM;
361
362	return simple_rename(idmap, old_dir, old_dentry, new_dir,
363			     new_dentry, flags);
364}
365
366static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
367{
368	if (is_binderfs_control_device(dentry))
369		return -EPERM;
370
371	return simple_unlink(dir, dentry);
372}
373
374static const struct file_operations binder_ctl_fops = {
375	.owner		= THIS_MODULE,
376	.open		= nonseekable_open,
377	.unlocked_ioctl	= binder_ctl_ioctl,
378	.compat_ioctl	= binder_ctl_ioctl,
379	.llseek		= noop_llseek,
380};
381
382/**
383 * binderfs_binder_ctl_create - create a new binder-control device
384 * @sb: super block of the binderfs mount
385 *
386 * This function creates a new binder-control device node in the binderfs mount
387 * referred to by @sb.
388 *
389 * Return: 0 on success, negative errno on failure
390 */
391static int binderfs_binder_ctl_create(struct super_block *sb)
392{
393	int minor, ret;
394	struct dentry *dentry;
395	struct binder_device *device;
396	struct inode *inode = NULL;
397	struct dentry *root = sb->s_root;
398	struct binderfs_info *info = sb->s_fs_info;
399#if defined(CONFIG_IPC_NS)
400	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
401#else
402	bool use_reserve = true;
403#endif
404
405	device = kzalloc(sizeof(*device), GFP_KERNEL);
406	if (!device)
407		return -ENOMEM;
408
409	/* If we have already created a binder-control node, return. */
410	if (info->control_dentry) {
411		ret = 0;
412		goto out;
413	}
414
415	ret = -ENOMEM;
416	inode = new_inode(sb);
417	if (!inode)
418		goto out;
419
420	/* Reserve a new minor number for the new device. */
421	mutex_lock(&binderfs_minors_mutex);
422	minor = ida_alloc_max(&binderfs_minors,
423			      use_reserve ? BINDERFS_MAX_MINOR :
424					    BINDERFS_MAX_MINOR_CAPPED,
425			      GFP_KERNEL);
426	mutex_unlock(&binderfs_minors_mutex);
427	if (minor < 0) {
428		ret = minor;
429		goto out;
430	}
431
432	inode->i_ino = SECOND_INODE;
433	simple_inode_init_ts(inode);
434	init_special_inode(inode, S_IFCHR | 0600,
435			   MKDEV(MAJOR(binderfs_dev), minor));
436	inode->i_fop = &binder_ctl_fops;
437	inode->i_uid = info->root_uid;
438	inode->i_gid = info->root_gid;
439
440	refcount_set(&device->ref, 1);
441	device->binderfs_inode = inode;
442	device->miscdev.minor = minor;
443
444	dentry = d_alloc_name(root, "binder-control");
445	if (!dentry)
446		goto out;
447
448	inode->i_private = device;
449	info->control_dentry = dentry;
450	d_add(dentry, inode);
451
452	return 0;
453
454out:
455	kfree(device);
456	iput(inode);
457
458	return ret;
459}
460
461static const struct inode_operations binderfs_dir_inode_operations = {
462	.lookup = simple_lookup,
463	.rename = binderfs_rename,
464	.unlink = binderfs_unlink,
465};
466
467static struct inode *binderfs_make_inode(struct super_block *sb, int mode)
468{
469	struct inode *ret;
470
471	ret = new_inode(sb);
472	if (ret) {
473		ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET);
474		ret->i_mode = mode;
475		simple_inode_init_ts(ret);
476	}
477	return ret;
478}
479
480static struct dentry *binderfs_create_dentry(struct dentry *parent,
481					     const char *name)
482{
483	struct dentry *dentry;
484
485	dentry = lookup_one_len(name, parent, strlen(name));
486	if (IS_ERR(dentry))
487		return dentry;
488
489	/* Return error if the file/dir already exists. */
490	if (d_really_is_positive(dentry)) {
491		dput(dentry);
492		return ERR_PTR(-EEXIST);
493	}
494
495	return dentry;
496}
497
498void binderfs_remove_file(struct dentry *dentry)
499{
500	struct inode *parent_inode;
501
502	parent_inode = d_inode(dentry->d_parent);
503	inode_lock(parent_inode);
504	if (simple_positive(dentry)) {
505		dget(dentry);
506		simple_unlink(parent_inode, dentry);
507		d_delete(dentry);
508		dput(dentry);
509	}
510	inode_unlock(parent_inode);
511}
512
513struct dentry *binderfs_create_file(struct dentry *parent, const char *name,
514				    const struct file_operations *fops,
515				    void *data)
516{
517	struct dentry *dentry;
518	struct inode *new_inode, *parent_inode;
519	struct super_block *sb;
520
521	parent_inode = d_inode(parent);
522	inode_lock(parent_inode);
523
524	dentry = binderfs_create_dentry(parent, name);
525	if (IS_ERR(dentry))
526		goto out;
527
528	sb = parent_inode->i_sb;
529	new_inode = binderfs_make_inode(sb, S_IFREG | 0444);
530	if (!new_inode) {
531		dput(dentry);
532		dentry = ERR_PTR(-ENOMEM);
533		goto out;
534	}
535
536	new_inode->i_fop = fops;
537	new_inode->i_private = data;
538	d_instantiate(dentry, new_inode);
539	fsnotify_create(parent_inode, dentry);
540
541out:
542	inode_unlock(parent_inode);
543	return dentry;
544}
545
546static struct dentry *binderfs_create_dir(struct dentry *parent,
547					  const char *name)
548{
549	struct dentry *dentry;
550	struct inode *new_inode, *parent_inode;
551	struct super_block *sb;
552
553	parent_inode = d_inode(parent);
554	inode_lock(parent_inode);
555
556	dentry = binderfs_create_dentry(parent, name);
557	if (IS_ERR(dentry))
558		goto out;
559
560	sb = parent_inode->i_sb;
561	new_inode = binderfs_make_inode(sb, S_IFDIR | 0755);
562	if (!new_inode) {
563		dput(dentry);
564		dentry = ERR_PTR(-ENOMEM);
565		goto out;
566	}
567
568	new_inode->i_fop = &simple_dir_operations;
569	new_inode->i_op = &simple_dir_inode_operations;
570
571	set_nlink(new_inode, 2);
572	d_instantiate(dentry, new_inode);
573	inc_nlink(parent_inode);
574	fsnotify_mkdir(parent_inode, dentry);
575
576out:
577	inode_unlock(parent_inode);
578	return dentry;
579}
580
581static int binder_features_show(struct seq_file *m, void *unused)
582{
583	bool *feature = m->private;
584
585	seq_printf(m, "%d\n", *feature);
586
587	return 0;
588}
589DEFINE_SHOW_ATTRIBUTE(binder_features);
590
591static int init_binder_features(struct super_block *sb)
592{
593	struct dentry *dentry, *dir;
594
595	dir = binderfs_create_dir(sb->s_root, "features");
596	if (IS_ERR(dir))
597		return PTR_ERR(dir);
598
599	dentry = binderfs_create_file(dir, "oneway_spam_detection",
600				      &binder_features_fops,
601				      &binder_features.oneway_spam_detection);
602	if (IS_ERR(dentry))
603		return PTR_ERR(dentry);
604
605	dentry = binderfs_create_file(dir, "extended_error",
606				      &binder_features_fops,
607				      &binder_features.extended_error);
 
 
 
 
 
 
608	if (IS_ERR(dentry))
609		return PTR_ERR(dentry);
610
611	return 0;
612}
613
614static int init_binder_logs(struct super_block *sb)
615{
616	struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir;
617	const struct binder_debugfs_entry *db_entry;
618	struct binderfs_info *info;
619	int ret = 0;
620
621	binder_logs_root_dir = binderfs_create_dir(sb->s_root,
622						   "binder_logs");
623	if (IS_ERR(binder_logs_root_dir)) {
624		ret = PTR_ERR(binder_logs_root_dir);
625		goto out;
626	}
627
628	binder_for_each_debugfs_entry(db_entry) {
629		dentry = binderfs_create_file(binder_logs_root_dir,
630					      db_entry->name,
631					      db_entry->fops,
632					      db_entry->data);
633		if (IS_ERR(dentry)) {
634			ret = PTR_ERR(dentry);
635			goto out;
636		}
637	}
638
639	proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc");
640	if (IS_ERR(proc_log_dir)) {
641		ret = PTR_ERR(proc_log_dir);
642		goto out;
643	}
644	info = sb->s_fs_info;
645	info->proc_log_dir = proc_log_dir;
646
647out:
648	return ret;
649}
650
651static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc)
652{
653	int ret;
654	struct binderfs_info *info;
655	struct binderfs_mount_opts *ctx = fc->fs_private;
656	struct inode *inode = NULL;
657	struct binderfs_device device_info = {};
658	const char *name;
659	size_t len;
660
661	sb->s_blocksize = PAGE_SIZE;
662	sb->s_blocksize_bits = PAGE_SHIFT;
663
664	/*
665	 * The binderfs filesystem can be mounted by userns root in a
666	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
667	 * set in s_iflags to prevent security issues where userns root can
668	 * just create random device nodes via mknod() since it owns the
669	 * filesystem mount. But binderfs does not allow to create any files
670	 * including devices nodes. The only way to create binder devices nodes
671	 * is through the binder-control device which userns root is explicitly
672	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
673	 * necessary and safe.
674	 */
675	sb->s_iflags &= ~SB_I_NODEV;
676	sb->s_iflags |= SB_I_NOEXEC;
677	sb->s_magic = BINDERFS_SUPER_MAGIC;
678	sb->s_op = &binderfs_super_ops;
679	sb->s_time_gran = 1;
680
681	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
682	if (!sb->s_fs_info)
683		return -ENOMEM;
684	info = sb->s_fs_info;
685
686	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
687
688	info->root_gid = make_kgid(sb->s_user_ns, 0);
689	if (!gid_valid(info->root_gid))
690		info->root_gid = GLOBAL_ROOT_GID;
691	info->root_uid = make_kuid(sb->s_user_ns, 0);
692	if (!uid_valid(info->root_uid))
693		info->root_uid = GLOBAL_ROOT_UID;
694	info->mount_opts.max = ctx->max;
695	info->mount_opts.stats_mode = ctx->stats_mode;
696
697	inode = new_inode(sb);
698	if (!inode)
699		return -ENOMEM;
700
701	inode->i_ino = FIRST_INODE;
702	inode->i_fop = &simple_dir_operations;
703	inode->i_mode = S_IFDIR | 0755;
704	simple_inode_init_ts(inode);
705	inode->i_op = &binderfs_dir_inode_operations;
706	set_nlink(inode, 2);
707
708	sb->s_root = d_make_root(inode);
709	if (!sb->s_root)
710		return -ENOMEM;
711
712	ret = binderfs_binder_ctl_create(sb);
713	if (ret)
714		return ret;
715
716	name = binder_devices_param;
717	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
718		strscpy(device_info.name, name, len + 1);
719		ret = binderfs_binder_device_create(inode, NULL, &device_info);
720		if (ret)
721			return ret;
722		name += len;
723		if (*name == ',')
724			name++;
725	}
726
727	ret = init_binder_features(sb);
728	if (ret)
729		return ret;
730
731	if (info->mount_opts.stats_mode == binderfs_stats_mode_global)
732		return init_binder_logs(sb);
733
734	return 0;
735}
736
737static int binderfs_fs_context_get_tree(struct fs_context *fc)
738{
739	return get_tree_nodev(fc, binderfs_fill_super);
740}
741
742static void binderfs_fs_context_free(struct fs_context *fc)
743{
744	struct binderfs_mount_opts *ctx = fc->fs_private;
745
746	kfree(ctx);
747}
748
749static const struct fs_context_operations binderfs_fs_context_ops = {
750	.free		= binderfs_fs_context_free,
751	.get_tree	= binderfs_fs_context_get_tree,
752	.parse_param	= binderfs_fs_context_parse_param,
753	.reconfigure	= binderfs_fs_context_reconfigure,
754};
755
756static int binderfs_init_fs_context(struct fs_context *fc)
757{
758	struct binderfs_mount_opts *ctx;
759
760	ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL);
761	if (!ctx)
762		return -ENOMEM;
763
764	ctx->max = BINDERFS_MAX_MINOR;
765	ctx->stats_mode = binderfs_stats_mode_unset;
766
767	fc->fs_private = ctx;
768	fc->ops = &binderfs_fs_context_ops;
769
770	return 0;
771}
772
773static void binderfs_kill_super(struct super_block *sb)
774{
775	struct binderfs_info *info = sb->s_fs_info;
776
777	/*
778	 * During inode eviction struct binderfs_info is needed.
779	 * So first wipe the super_block then free struct binderfs_info.
780	 */
781	kill_litter_super(sb);
782
783	if (info && info->ipc_ns)
784		put_ipc_ns(info->ipc_ns);
785
786	kfree(info);
787}
788
789static struct file_system_type binder_fs_type = {
790	.name			= "binder",
791	.init_fs_context	= binderfs_init_fs_context,
792	.parameters		= binderfs_fs_parameters,
793	.kill_sb		= binderfs_kill_super,
794	.fs_flags		= FS_USERNS_MOUNT,
795};
796
797int __init init_binderfs(void)
798{
799	int ret;
800	const char *name;
801	size_t len;
802
803	/* Verify that the default binderfs device names are valid. */
804	name = binder_devices_param;
805	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
806		if (len > BINDERFS_MAX_NAME)
807			return -E2BIG;
808		name += len;
809		if (*name == ',')
810			name++;
811	}
812
813	/* Allocate new major number for binderfs. */
814	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
815				  "binder");
816	if (ret)
817		return ret;
818
819	ret = register_filesystem(&binder_fs_type);
820	if (ret) {
821		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
822		return ret;
823	}
824
825	return ret;
826}