1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/compiler_types.h> 4 #include <linux/errno.h> 5 #include <linux/fs.h> 6 #include <linux/fsnotify.h> 7 #include <linux/gfp.h> 8 #include <linux/idr.h> 9 #include <linux/init.h> 10 #include <linux/ipc_namespace.h> 11 #include <linux/kdev_t.h> 12 #include <linux/kernel.h> 13 #include <linux/list.h> 14 #include <linux/namei.h> 15 #include <linux/magic.h> 16 #include <linux/major.h> 17 #include <linux/miscdevice.h> 18 #include <linux/module.h> 19 #include <linux/mutex.h> 20 #include <linux/mount.h> 21 #include <linux/fs_parser.h> 22 #include <linux/sched.h> 23 #include <linux/seq_file.h> 24 #include <linux/slab.h> 25 #include <linux/spinlock_types.h> 26 #include <linux/stddef.h> 27 #include <linux/string.h> 28 #include <linux/types.h> 29 #include <linux/uaccess.h> 30 #include <linux/user_namespace.h> 31 #include <linux/xarray.h> 32 #include <uapi/linux/android/binder.h> 33 #include <uapi/linux/android/binderfs.h> 34 35 #include "binder_internal.h" 36 37 #define FIRST_INODE 1 38 #define SECOND_INODE 2 39 #define INODE_OFFSET 3 40 #define BINDERFS_MAX_MINOR (1U << MINORBITS) 41 /* Ensure that the initial ipc namespace always has devices available. */ 42 #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4) 43 44 static dev_t binderfs_dev; 45 static DEFINE_MUTEX(binderfs_minors_mutex); 46 static DEFINE_IDA(binderfs_minors); 47 48 enum binderfs_param { 49 Opt_max, 50 Opt_stats_mode, 51 }; 52 53 enum binderfs_stats_mode { 54 binderfs_stats_mode_unset, 55 binderfs_stats_mode_global, 56 }; 57 58 struct binder_features { 59 bool oneway_spam_detection; 60 bool extended_error; 61 bool freeze_notification; 62 bool transaction_report; 63 }; 64 65 static const struct constant_table binderfs_param_stats[] = { 66 { "global", binderfs_stats_mode_global }, 67 {} 68 }; 69 70 static const struct fs_parameter_spec binderfs_fs_parameters[] = { 71 fsparam_u32("max", Opt_max), 72 fsparam_enum("stats", Opt_stats_mode, binderfs_param_stats), 73 {} 74 }; 75 76 static struct binder_features binder_features = { 77 .oneway_spam_detection = true, 78 .extended_error = true, 79 .freeze_notification = true, 80 .transaction_report = true, 81 }; 82 83 static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb) 84 { 85 return sb->s_fs_info; 86 } 87 88 bool is_binderfs_device(const struct inode *inode) 89 { 90 if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC) 91 return true; 92 93 return false; 94 } 95 96 /** 97 * binderfs_binder_device_create - allocate inode from super block of a 98 * binderfs mount 99 * @ref_inode: inode from which the super block will be taken 100 * @userp: buffer to copy information about new device for userspace to 101 * @req: struct binderfs_device as copied from userspace 102 * 103 * This function allocates a new binder_device and reserves a new minor 104 * number for it. 105 * Minor numbers are limited and tracked globally in binderfs_minors. The 106 * function will stash a struct binder_device for the specific binder 107 * device in i_private of the inode. 108 * It will go on to allocate a new inode from the super block of the 109 * filesystem mount, stash a struct binder_device in its i_private field 110 * and attach a dentry to that inode. 111 * 112 * Return: 0 on success, negative errno on failure 113 */ 114 static int binderfs_binder_device_create(struct inode *ref_inode, 115 struct binderfs_device __user *userp, 116 struct binderfs_device *req) 117 { 118 int minor, ret; 119 struct dentry *dentry, *root; 120 struct binder_device *device; 121 char *name = NULL; 122 struct inode *inode = NULL; 123 struct super_block *sb = ref_inode->i_sb; 124 struct binderfs_info *info = sb->s_fs_info; 125 #if defined(CONFIG_IPC_NS) 126 bool use_reserve = (info->ipc_ns == &init_ipc_ns); 127 #else 128 bool use_reserve = true; 129 #endif 130 131 /* Reserve new minor number for the new device. */ 132 mutex_lock(&binderfs_minors_mutex); 133 if (++info->device_count <= info->mount_opts.max) 134 minor = ida_alloc_max(&binderfs_minors, 135 use_reserve ? BINDERFS_MAX_MINOR - 1 : 136 BINDERFS_MAX_MINOR_CAPPED - 1, 137 GFP_KERNEL); 138 else 139 minor = -ENOSPC; 140 if (minor < 0) { 141 --info->device_count; 142 mutex_unlock(&binderfs_minors_mutex); 143 return minor; 144 } 145 mutex_unlock(&binderfs_minors_mutex); 146 147 ret = -ENOMEM; 148 device = kzalloc_obj(*device); 149 if (!device) 150 goto err; 151 152 inode = new_inode(sb); 153 if (!inode) 154 goto err; 155 156 inode->i_ino = minor + INODE_OFFSET; 157 simple_inode_init_ts(inode); 158 init_special_inode(inode, S_IFCHR | 0600, 159 MKDEV(MAJOR(binderfs_dev), minor)); 160 inode->i_fop = &binder_fops; 161 inode->i_uid = info->root_uid; 162 inode->i_gid = info->root_gid; 163 164 req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */ 165 name = kstrdup(req->name, GFP_KERNEL); 166 if (!name) 167 goto err; 168 169 refcount_set(&device->ref, 1); 170 device->binderfs_inode = inode; 171 device->context.binder_context_mgr_uid = INVALID_UID; 172 device->context.name = name; 173 device->miscdev.name = name; 174 device->miscdev.minor = minor; 175 mutex_init(&device->context.context_mgr_node_lock); 176 177 req->major = MAJOR(binderfs_dev); 178 req->minor = minor; 179 180 if (userp && copy_to_user(userp, req, sizeof(*req))) { 181 ret = -EFAULT; 182 goto err; 183 } 184 185 root = sb->s_root; 186 dentry = simple_start_creating(root, name); 187 if (IS_ERR(dentry)) { 188 ret = PTR_ERR(dentry); 189 goto err; 190 } 191 inode->i_private = device; 192 binder_add_device(device); 193 d_make_persistent(dentry, inode); 194 fsnotify_create(root->d_inode, dentry); 195 simple_done_creating(dentry); 196 197 return 0; 198 199 err: 200 kfree(name); 201 kfree(device); 202 mutex_lock(&binderfs_minors_mutex); 203 --info->device_count; 204 ida_free(&binderfs_minors, minor); 205 mutex_unlock(&binderfs_minors_mutex); 206 iput(inode); 207 208 return ret; 209 } 210 211 /** 212 * binder_ctl_ioctl - handle binder device node allocation requests 213 * @file: The file pointer for the binder-control device node. 214 * @cmd: The ioctl command. 215 * @arg: The ioctl argument. 216 * 217 * The request handler for the binder-control device. All requests operate on 218 * the binderfs mount the binder-control device resides in: 219 * - BINDER_CTL_ADD 220 * Allocate a new binder device. 221 * 222 * Return: %0 on success, negative errno on failure. 223 */ 224 static long binder_ctl_ioctl(struct file *file, unsigned int cmd, 225 unsigned long arg) 226 { 227 int ret = -EINVAL; 228 struct inode *inode = file_inode(file); 229 struct binderfs_device __user *device = (struct binderfs_device __user *)arg; 230 struct binderfs_device device_req; 231 232 switch (cmd) { 233 case BINDER_CTL_ADD: 234 ret = copy_from_user(&device_req, device, sizeof(device_req)); 235 if (ret) { 236 ret = -EFAULT; 237 break; 238 } 239 240 ret = binderfs_binder_device_create(inode, device, &device_req); 241 break; 242 default: 243 break; 244 } 245 246 return ret; 247 } 248 249 static void binderfs_evict_inode(struct inode *inode) 250 { 251 struct binder_device *device = inode->i_private; 252 struct binderfs_info *info = BINDERFS_SB(inode->i_sb); 253 254 clear_inode(inode); 255 256 if (!S_ISCHR(inode->i_mode) || !device) 257 return; 258 259 mutex_lock(&binderfs_minors_mutex); 260 --info->device_count; 261 ida_free(&binderfs_minors, device->miscdev.minor); 262 mutex_unlock(&binderfs_minors_mutex); 263 264 if (refcount_dec_and_test(&device->ref)) { 265 binder_remove_device(device); 266 kfree(device->context.name); 267 kfree(device); 268 } 269 } 270 271 static int binderfs_fs_context_parse_param(struct fs_context *fc, 272 struct fs_parameter *param) 273 { 274 int opt; 275 struct binderfs_mount_opts *ctx = fc->fs_private; 276 struct fs_parse_result result; 277 278 opt = fs_parse(fc, binderfs_fs_parameters, param, &result); 279 if (opt < 0) 280 return opt; 281 282 switch (opt) { 283 case Opt_max: 284 if (result.uint_32 > BINDERFS_MAX_MINOR) 285 return invalfc(fc, "Bad value for '%s'", param->key); 286 287 ctx->max = result.uint_32; 288 break; 289 case Opt_stats_mode: 290 if (!capable(CAP_SYS_ADMIN)) 291 return -EPERM; 292 293 ctx->stats_mode = result.uint_32; 294 break; 295 default: 296 return invalfc(fc, "Unsupported parameter '%s'", param->key); 297 } 298 299 return 0; 300 } 301 302 static int binderfs_fs_context_reconfigure(struct fs_context *fc) 303 { 304 struct binderfs_mount_opts *ctx = fc->fs_private; 305 struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb); 306 307 if (info->mount_opts.stats_mode != ctx->stats_mode) 308 return invalfc(fc, "Binderfs stats mode cannot be changed during a remount"); 309 310 info->mount_opts.stats_mode = ctx->stats_mode; 311 info->mount_opts.max = ctx->max; 312 return 0; 313 } 314 315 static int binderfs_show_options(struct seq_file *seq, struct dentry *root) 316 { 317 struct binderfs_info *info = BINDERFS_SB(root->d_sb); 318 319 if (info->mount_opts.max <= BINDERFS_MAX_MINOR) 320 seq_printf(seq, ",max=%d", info->mount_opts.max); 321 322 switch (info->mount_opts.stats_mode) { 323 case binderfs_stats_mode_unset: 324 break; 325 case binderfs_stats_mode_global: 326 seq_printf(seq, ",stats=global"); 327 break; 328 } 329 330 return 0; 331 } 332 333 static const struct super_operations binderfs_super_ops = { 334 .evict_inode = binderfs_evict_inode, 335 .show_options = binderfs_show_options, 336 .statfs = simple_statfs, 337 }; 338 339 static inline bool is_binderfs_control_device(const struct dentry *dentry) 340 { 341 struct binderfs_info *info = dentry->d_sb->s_fs_info; 342 343 return info->control_dentry == dentry; 344 } 345 346 static int binderfs_rename(struct mnt_idmap *idmap, 347 struct inode *old_dir, struct dentry *old_dentry, 348 struct inode *new_dir, struct dentry *new_dentry, 349 unsigned int flags) 350 { 351 if (is_binderfs_control_device(old_dentry) || 352 is_binderfs_control_device(new_dentry)) 353 return -EPERM; 354 355 return simple_rename(idmap, old_dir, old_dentry, new_dir, 356 new_dentry, flags); 357 } 358 359 static int binderfs_unlink(struct inode *dir, struct dentry *dentry) 360 { 361 if (is_binderfs_control_device(dentry)) 362 return -EPERM; 363 364 return simple_unlink(dir, dentry); 365 } 366 367 static const struct file_operations binder_ctl_fops = { 368 .owner = THIS_MODULE, 369 .open = nonseekable_open, 370 .unlocked_ioctl = binder_ctl_ioctl, 371 .compat_ioctl = binder_ctl_ioctl, 372 .llseek = noop_llseek, 373 }; 374 375 /** 376 * binderfs_binder_ctl_create - create a new binder-control device 377 * @sb: super block of the binderfs mount 378 * 379 * This function creates a new binder-control device node in the binderfs mount 380 * referred to by @sb. 381 * 382 * Return: 0 on success, negative errno on failure 383 */ 384 static int binderfs_binder_ctl_create(struct super_block *sb) 385 { 386 int minor, ret; 387 struct dentry *dentry; 388 struct binder_device *device; 389 struct inode *inode = NULL; 390 struct dentry *root = sb->s_root; 391 struct binderfs_info *info = sb->s_fs_info; 392 #if defined(CONFIG_IPC_NS) 393 bool use_reserve = (info->ipc_ns == &init_ipc_ns); 394 #else 395 bool use_reserve = true; 396 #endif 397 398 device = kzalloc_obj(*device); 399 if (!device) 400 return -ENOMEM; 401 402 ret = -ENOMEM; 403 inode = new_inode(sb); 404 if (!inode) 405 goto out; 406 407 /* Reserve a new minor number for the new device. */ 408 mutex_lock(&binderfs_minors_mutex); 409 minor = ida_alloc_max(&binderfs_minors, 410 use_reserve ? BINDERFS_MAX_MINOR - 1 : 411 BINDERFS_MAX_MINOR_CAPPED - 1, 412 GFP_KERNEL); 413 mutex_unlock(&binderfs_minors_mutex); 414 if (minor < 0) { 415 ret = minor; 416 goto out; 417 } 418 419 inode->i_ino = SECOND_INODE; 420 simple_inode_init_ts(inode); 421 init_special_inode(inode, S_IFCHR | 0600, 422 MKDEV(MAJOR(binderfs_dev), minor)); 423 inode->i_fop = &binder_ctl_fops; 424 inode->i_uid = info->root_uid; 425 inode->i_gid = info->root_gid; 426 427 refcount_set(&device->ref, 1); 428 device->binderfs_inode = inode; 429 device->miscdev.minor = minor; 430 431 dentry = d_alloc_name(root, "binder-control"); 432 if (!dentry) 433 goto out; 434 435 inode->i_private = device; 436 info->control_dentry = dentry; 437 d_make_persistent(dentry, inode); 438 dput(dentry); 439 440 return 0; 441 442 out: 443 kfree(device); 444 iput(inode); 445 446 return ret; 447 } 448 449 static const struct inode_operations binderfs_dir_inode_operations = { 450 .lookup = simple_lookup, 451 .rename = binderfs_rename, 452 .unlink = binderfs_unlink, 453 }; 454 455 static struct inode *binderfs_make_inode(struct super_block *sb, int mode) 456 { 457 struct inode *ret; 458 459 ret = new_inode(sb); 460 if (ret) { 461 ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET); 462 ret->i_mode = mode; 463 simple_inode_init_ts(ret); 464 } 465 return ret; 466 } 467 468 struct dentry *binderfs_create_file(struct dentry *parent, const char *name, 469 const struct file_operations *fops, 470 void *data) 471 { 472 struct dentry *dentry; 473 struct inode *new_inode, *parent_inode; 474 struct super_block *sb; 475 476 parent_inode = d_inode(parent); 477 478 dentry = simple_start_creating(parent, name); 479 if (IS_ERR(dentry)) 480 return dentry; 481 482 sb = parent_inode->i_sb; 483 new_inode = binderfs_make_inode(sb, S_IFREG | 0444); 484 if (!new_inode) { 485 simple_done_creating(dentry); 486 return ERR_PTR(-ENOMEM); 487 } 488 489 new_inode->i_fop = fops; 490 new_inode->i_private = data; 491 d_make_persistent(dentry, new_inode); 492 fsnotify_create(parent_inode, dentry); 493 simple_done_creating(dentry); 494 return dentry; // borrowed 495 } 496 497 static struct dentry *binderfs_create_dir(struct dentry *parent, 498 const char *name) 499 { 500 struct dentry *dentry; 501 struct inode *new_inode, *parent_inode; 502 struct super_block *sb; 503 504 parent_inode = d_inode(parent); 505 506 dentry = simple_start_creating(parent, name); 507 if (IS_ERR(dentry)) 508 return dentry; 509 510 sb = parent_inode->i_sb; 511 new_inode = binderfs_make_inode(sb, S_IFDIR | 0755); 512 if (!new_inode) { 513 simple_done_creating(dentry); 514 return ERR_PTR(-ENOMEM); 515 } 516 517 new_inode->i_fop = &simple_dir_operations; 518 new_inode->i_op = &simple_dir_inode_operations; 519 520 set_nlink(new_inode, 2); 521 d_make_persistent(dentry, new_inode); 522 inc_nlink(parent_inode); 523 fsnotify_mkdir(parent_inode, dentry); 524 simple_done_creating(dentry); 525 return dentry; 526 } 527 528 static int binder_features_show(struct seq_file *m, void *unused) 529 { 530 bool *feature = m->private; 531 532 seq_printf(m, "%d\n", *feature); 533 534 return 0; 535 } 536 DEFINE_SHOW_ATTRIBUTE(binder_features); 537 538 static int init_binder_features(struct super_block *sb) 539 { 540 struct dentry *dentry, *dir; 541 542 dir = binderfs_create_dir(sb->s_root, "features"); 543 if (IS_ERR(dir)) 544 return PTR_ERR(dir); 545 546 dentry = binderfs_create_file(dir, "oneway_spam_detection", 547 &binder_features_fops, 548 &binder_features.oneway_spam_detection); 549 if (IS_ERR(dentry)) 550 return PTR_ERR(dentry); 551 552 dentry = binderfs_create_file(dir, "extended_error", 553 &binder_features_fops, 554 &binder_features.extended_error); 555 if (IS_ERR(dentry)) 556 return PTR_ERR(dentry); 557 558 dentry = binderfs_create_file(dir, "freeze_notification", 559 &binder_features_fops, 560 &binder_features.freeze_notification); 561 if (IS_ERR(dentry)) 562 return PTR_ERR(dentry); 563 564 dentry = binderfs_create_file(dir, "transaction_report", 565 &binder_features_fops, 566 &binder_features.transaction_report); 567 if (IS_ERR(dentry)) 568 return PTR_ERR(dentry); 569 570 return 0; 571 } 572 573 static int init_binder_logs(struct super_block *sb) 574 { 575 struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir; 576 const struct binder_debugfs_entry *db_entry; 577 struct binderfs_info *info; 578 int ret = 0; 579 580 binder_logs_root_dir = binderfs_create_dir(sb->s_root, 581 "binder_logs"); 582 if (IS_ERR(binder_logs_root_dir)) { 583 ret = PTR_ERR(binder_logs_root_dir); 584 goto out; 585 } 586 587 binder_for_each_debugfs_entry(db_entry) { 588 dentry = binderfs_create_file(binder_logs_root_dir, 589 db_entry->name, 590 db_entry->fops, 591 db_entry->data); 592 if (IS_ERR(dentry)) { 593 ret = PTR_ERR(dentry); 594 goto out; 595 } 596 } 597 598 proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc"); 599 if (IS_ERR(proc_log_dir)) { 600 ret = PTR_ERR(proc_log_dir); 601 goto out; 602 } 603 info = sb->s_fs_info; 604 info->proc_log_dir = proc_log_dir; 605 606 out: 607 return ret; 608 } 609 610 static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc) 611 { 612 int ret; 613 struct binderfs_info *info; 614 struct binderfs_mount_opts *ctx = fc->fs_private; 615 struct inode *inode = NULL; 616 struct binderfs_device device_info = {}; 617 const char *name; 618 size_t len; 619 620 sb->s_blocksize = PAGE_SIZE; 621 sb->s_blocksize_bits = PAGE_SHIFT; 622 623 /* 624 * The binderfs filesystem can be mounted by userns root in a 625 * non-initial userns. By default such mounts have the SB_I_NODEV flag 626 * set in s_iflags to prevent security issues where userns root can 627 * just create random device nodes via mknod() since it owns the 628 * filesystem mount. But binderfs does not allow to create any files 629 * including devices nodes. The only way to create binder devices nodes 630 * is through the binder-control device which userns root is explicitly 631 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both 632 * necessary and safe. 633 */ 634 sb->s_iflags &= ~SB_I_NODEV; 635 sb->s_iflags |= SB_I_NOEXEC; 636 sb->s_magic = BINDERFS_SUPER_MAGIC; 637 sb->s_op = &binderfs_super_ops; 638 sb->s_time_gran = 1; 639 640 sb->s_fs_info = kzalloc_obj(struct binderfs_info); 641 if (!sb->s_fs_info) 642 return -ENOMEM; 643 info = sb->s_fs_info; 644 645 info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); 646 647 info->root_gid = make_kgid(sb->s_user_ns, 0); 648 if (!gid_valid(info->root_gid)) 649 info->root_gid = GLOBAL_ROOT_GID; 650 info->root_uid = make_kuid(sb->s_user_ns, 0); 651 if (!uid_valid(info->root_uid)) 652 info->root_uid = GLOBAL_ROOT_UID; 653 info->mount_opts.max = ctx->max; 654 info->mount_opts.stats_mode = ctx->stats_mode; 655 656 inode = new_inode(sb); 657 if (!inode) 658 return -ENOMEM; 659 660 inode->i_ino = FIRST_INODE; 661 inode->i_fop = &simple_dir_operations; 662 inode->i_mode = S_IFDIR | 0755; 663 simple_inode_init_ts(inode); 664 inode->i_op = &binderfs_dir_inode_operations; 665 set_nlink(inode, 2); 666 667 sb->s_root = d_make_root(inode); 668 if (!sb->s_root) 669 return -ENOMEM; 670 671 ret = binderfs_binder_ctl_create(sb); 672 if (ret) 673 return ret; 674 675 name = binder_devices_param; 676 for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { 677 strscpy(device_info.name, name, len + 1); 678 ret = binderfs_binder_device_create(inode, NULL, &device_info); 679 if (ret) 680 return ret; 681 name += len; 682 if (*name == ',') 683 name++; 684 } 685 686 ret = init_binder_features(sb); 687 if (ret) 688 return ret; 689 690 if (info->mount_opts.stats_mode == binderfs_stats_mode_global) 691 return init_binder_logs(sb); 692 693 return 0; 694 } 695 696 static int binderfs_fs_context_get_tree(struct fs_context *fc) 697 { 698 return get_tree_nodev(fc, binderfs_fill_super); 699 } 700 701 static void binderfs_fs_context_free(struct fs_context *fc) 702 { 703 struct binderfs_mount_opts *ctx = fc->fs_private; 704 705 kfree(ctx); 706 } 707 708 static const struct fs_context_operations binderfs_fs_context_ops = { 709 .free = binderfs_fs_context_free, 710 .get_tree = binderfs_fs_context_get_tree, 711 .parse_param = binderfs_fs_context_parse_param, 712 .reconfigure = binderfs_fs_context_reconfigure, 713 }; 714 715 static int binderfs_init_fs_context(struct fs_context *fc) 716 { 717 struct binderfs_mount_opts *ctx; 718 719 ctx = kzalloc_obj(struct binderfs_mount_opts); 720 if (!ctx) 721 return -ENOMEM; 722 723 ctx->max = BINDERFS_MAX_MINOR; 724 ctx->stats_mode = binderfs_stats_mode_unset; 725 726 fc->fs_private = ctx; 727 fc->ops = &binderfs_fs_context_ops; 728 729 return 0; 730 } 731 732 static void binderfs_kill_super(struct super_block *sb) 733 { 734 struct binderfs_info *info = sb->s_fs_info; 735 736 /* 737 * During inode eviction struct binderfs_info is needed. 738 * So first wipe the super_block then free struct binderfs_info. 739 */ 740 kill_anon_super(sb); 741 742 if (info && info->ipc_ns) 743 put_ipc_ns(info->ipc_ns); 744 745 kfree(info); 746 } 747 748 static struct file_system_type binder_fs_type = { 749 .name = "binder", 750 .init_fs_context = binderfs_init_fs_context, 751 .parameters = binderfs_fs_parameters, 752 .kill_sb = binderfs_kill_super, 753 .fs_flags = FS_USERNS_MOUNT, 754 }; 755 756 int __init init_binderfs(void) 757 { 758 int ret; 759 const char *name; 760 size_t len; 761 762 /* Verify that the default binderfs device names are valid. */ 763 name = binder_devices_param; 764 for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { 765 if (len > BINDERFS_MAX_NAME) 766 return -E2BIG; 767 name += len; 768 if (*name == ',') 769 name++; 770 } 771 772 /* Allocate new major number for binderfs. */ 773 ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR, 774 "binder"); 775 if (ret) 776 return ret; 777 778 ret = register_filesystem(&binder_fs_type); 779 if (ret) { 780 unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); 781 return ret; 782 } 783 784 return ret; 785 } 786