xref: /linux/drivers/android/binder/rust_binderfs.c (revision 509d3f45847627f4c5cdce004c3ec79262b5239c)
1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include <linux/compiler_types.h>
4 #include <linux/errno.h>
5 #include <linux/fs.h>
6 #include <linux/fsnotify.h>
7 #include <linux/gfp.h>
8 #include <linux/idr.h>
9 #include <linux/init.h>
10 #include <linux/ipc_namespace.h>
11 #include <linux/kdev_t.h>
12 #include <linux/kernel.h>
13 #include <linux/list.h>
14 #include <linux/namei.h>
15 #include <linux/magic.h>
16 #include <linux/major.h>
17 #include <linux/miscdevice.h>
18 #include <linux/module.h>
19 #include <linux/mutex.h>
20 #include <linux/mount.h>
21 #include <linux/fs_parser.h>
22 #include <linux/sched.h>
23 #include <linux/seq_file.h>
24 #include <linux/slab.h>
25 #include <linux/spinlock_types.h>
26 #include <linux/stddef.h>
27 #include <linux/string.h>
28 #include <linux/types.h>
29 #include <linux/uaccess.h>
30 #include <linux/user_namespace.h>
31 #include <linux/xarray.h>
32 #include <uapi/asm-generic/errno-base.h>
33 #include <uapi/linux/android/binder.h>
34 #include <uapi/linux/android/binderfs.h>
35 
36 #include "rust_binder.h"
37 #include "rust_binder_internal.h"
38 
39 #define FIRST_INODE 1
40 #define SECOND_INODE 2
41 #define INODE_OFFSET 3
42 #define BINDERFS_MAX_MINOR (1U << MINORBITS)
43 /* Ensure that the initial ipc namespace always has devices available. */
44 #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4)
45 
46 DEFINE_SHOW_ATTRIBUTE(rust_binder_stats);
47 DEFINE_SHOW_ATTRIBUTE(rust_binder_state);
48 DEFINE_SHOW_ATTRIBUTE(rust_binder_transactions);
49 DEFINE_SHOW_ATTRIBUTE(rust_binder_proc);
50 
51 char *rust_binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
52 module_param_named(rust_devices, rust_binder_devices_param, charp, 0444);
53 
54 static dev_t binderfs_dev;
55 static DEFINE_MUTEX(binderfs_minors_mutex);
56 static DEFINE_IDA(binderfs_minors);
57 
58 enum binderfs_param {
59 	Opt_max,
60 	Opt_stats_mode,
61 };
62 
63 enum binderfs_stats_mode {
64 	binderfs_stats_mode_unset,
65 	binderfs_stats_mode_global,
66 };
67 
68 struct binder_features {
69 	bool oneway_spam_detection;
70 	bool extended_error;
71 	bool freeze_notification;
72 };
73 
74 static const struct constant_table binderfs_param_stats[] = {
75 	{ "global", binderfs_stats_mode_global },
76 	{}
77 };
78 
79 static const struct fs_parameter_spec binderfs_fs_parameters[] = {
80 	fsparam_u32("max",	Opt_max),
81 	fsparam_enum("stats",	Opt_stats_mode, binderfs_param_stats),
82 	{}
83 };
84 
85 static struct binder_features binder_features = {
86 	.oneway_spam_detection = true,
87 	.extended_error = true,
88 	.freeze_notification = true,
89 };
90 
91 static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb)
92 {
93 	return sb->s_fs_info;
94 }
95 
96 /**
97  * binderfs_binder_device_create - allocate inode from super block of a
98  *                                 binderfs mount
99  * @ref_inode: inode from wich the super block will be taken
100  * @userp:     buffer to copy information about new device for userspace to
101  * @req:       struct binderfs_device as copied from userspace
102  *
103  * This function allocates a new binder_device and reserves a new minor
104  * number for it.
105  * Minor numbers are limited and tracked globally in binderfs_minors. The
106  * function will stash a struct binder_device for the specific binder
107  * device in i_private of the inode.
108  * It will go on to allocate a new inode from the super block of the
109  * filesystem mount, stash a struct binder_device in its i_private field
110  * and attach a dentry to that inode.
111  *
112  * Return: 0 on success, negative errno on failure
113  */
114 static int binderfs_binder_device_create(struct inode *ref_inode,
115 					 struct binderfs_device __user *userp,
116 					 struct binderfs_device *req)
117 {
118 	int minor, ret;
119 	struct dentry *dentry, *root;
120 	struct binder_device *device = NULL;
121 	rust_binder_context ctx = NULL;
122 	struct inode *inode = NULL;
123 	struct super_block *sb = ref_inode->i_sb;
124 	struct binderfs_info *info = sb->s_fs_info;
125 #if defined(CONFIG_IPC_NS)
126 	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
127 #else
128 	bool use_reserve = true;
129 #endif
130 
131 	/* Reserve new minor number for the new device. */
132 	mutex_lock(&binderfs_minors_mutex);
133 	if (++info->device_count <= info->mount_opts.max)
134 		minor = ida_alloc_max(&binderfs_minors,
135 				      use_reserve ? BINDERFS_MAX_MINOR :
136 						    BINDERFS_MAX_MINOR_CAPPED,
137 				      GFP_KERNEL);
138 	else
139 		minor = -ENOSPC;
140 	if (minor < 0) {
141 		--info->device_count;
142 		mutex_unlock(&binderfs_minors_mutex);
143 		return minor;
144 	}
145 	mutex_unlock(&binderfs_minors_mutex);
146 
147 	ret = -ENOMEM;
148 	device = kzalloc(sizeof(*device), GFP_KERNEL);
149 	if (!device)
150 		goto err;
151 
152 	req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */
153 
154 	ctx = rust_binder_new_context(req->name);
155 	if (!ctx)
156 		goto err;
157 
158 	inode = new_inode(sb);
159 	if (!inode)
160 		goto err;
161 
162 	inode->i_ino = minor + INODE_OFFSET;
163 	simple_inode_init_ts(inode);
164 	init_special_inode(inode, S_IFCHR | 0600,
165 			   MKDEV(MAJOR(binderfs_dev), minor));
166 	inode->i_fop = &rust_binder_fops;
167 	inode->i_uid = info->root_uid;
168 	inode->i_gid = info->root_gid;
169 
170 	req->major = MAJOR(binderfs_dev);
171 	req->minor = minor;
172 	device->ctx = ctx;
173 	device->minor = minor;
174 
175 	if (userp && copy_to_user(userp, req, sizeof(*req))) {
176 		ret = -EFAULT;
177 		goto err;
178 	}
179 
180 	root = sb->s_root;
181 	dentry = simple_start_creating(root, req->name);
182 	if (IS_ERR(dentry)) {
183 		ret = PTR_ERR(dentry);
184 		goto err;
185 	}
186 
187 	inode->i_private = device;
188 	d_make_persistent(dentry, inode);
189 
190 	fsnotify_create(root->d_inode, dentry);
191 	simple_done_creating(dentry);
192 
193 	return 0;
194 
195 err:
196 	kfree(device);
197 	rust_binder_remove_context(ctx);
198 	mutex_lock(&binderfs_minors_mutex);
199 	--info->device_count;
200 	ida_free(&binderfs_minors, minor);
201 	mutex_unlock(&binderfs_minors_mutex);
202 	iput(inode);
203 
204 	return ret;
205 }
206 
207 /**
208  * binder_ctl_ioctl - handle binder device node allocation requests
209  *
210  * The request handler for the binder-control device. All requests operate on
211  * the binderfs mount the binder-control device resides in:
212  * - BINDER_CTL_ADD
213  *   Allocate a new binder device.
214  *
215  * Return: %0 on success, negative errno on failure.
216  */
217 static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
218 			     unsigned long arg)
219 {
220 	int ret = -EINVAL;
221 	struct inode *inode = file_inode(file);
222 	struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
223 	struct binderfs_device device_req;
224 
225 	switch (cmd) {
226 	case BINDER_CTL_ADD:
227 		ret = copy_from_user(&device_req, device, sizeof(device_req));
228 		if (ret) {
229 			ret = -EFAULT;
230 			break;
231 		}
232 
233 		ret = binderfs_binder_device_create(inode, device, &device_req);
234 		break;
235 	default:
236 		break;
237 	}
238 
239 	return ret;
240 }
241 
242 static void binderfs_evict_inode(struct inode *inode)
243 {
244 	struct binder_device *device = inode->i_private;
245 	struct binderfs_info *info = BINDERFS_SB(inode->i_sb);
246 
247 	clear_inode(inode);
248 
249 	if (!S_ISCHR(inode->i_mode) || !device)
250 		return;
251 
252 	mutex_lock(&binderfs_minors_mutex);
253 	--info->device_count;
254 	ida_free(&binderfs_minors, device->minor);
255 	mutex_unlock(&binderfs_minors_mutex);
256 
257 	/* ctx is null for binder-control, but this function ignores null pointers */
258 	rust_binder_remove_context(device->ctx);
259 
260 	kfree(device);
261 }
262 
263 static int binderfs_fs_context_parse_param(struct fs_context *fc,
264 					   struct fs_parameter *param)
265 {
266 	int opt;
267 	struct binderfs_mount_opts *ctx = fc->fs_private;
268 	struct fs_parse_result result;
269 
270 	opt = fs_parse(fc, binderfs_fs_parameters, param, &result);
271 	if (opt < 0)
272 		return opt;
273 
274 	switch (opt) {
275 	case Opt_max:
276 		if (result.uint_32 > BINDERFS_MAX_MINOR)
277 			return invalfc(fc, "Bad value for '%s'", param->key);
278 
279 		ctx->max = result.uint_32;
280 		break;
281 	case Opt_stats_mode:
282 		if (!capable(CAP_SYS_ADMIN))
283 			return -EPERM;
284 
285 		ctx->stats_mode = result.uint_32;
286 		break;
287 	default:
288 		return invalfc(fc, "Unsupported parameter '%s'", param->key);
289 	}
290 
291 	return 0;
292 }
293 
294 static int binderfs_fs_context_reconfigure(struct fs_context *fc)
295 {
296 	struct binderfs_mount_opts *ctx = fc->fs_private;
297 	struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb);
298 
299 	if (info->mount_opts.stats_mode != ctx->stats_mode)
300 		return invalfc(fc, "Binderfs stats mode cannot be changed during a remount");
301 
302 	info->mount_opts.stats_mode = ctx->stats_mode;
303 	info->mount_opts.max = ctx->max;
304 	return 0;
305 }
306 
307 static int binderfs_show_options(struct seq_file *seq, struct dentry *root)
308 {
309 	struct binderfs_info *info = BINDERFS_SB(root->d_sb);
310 
311 	if (info->mount_opts.max <= BINDERFS_MAX_MINOR)
312 		seq_printf(seq, ",max=%d", info->mount_opts.max);
313 
314 	switch (info->mount_opts.stats_mode) {
315 	case binderfs_stats_mode_unset:
316 		break;
317 	case binderfs_stats_mode_global:
318 		seq_puts(seq, ",stats=global");
319 		break;
320 	}
321 
322 	return 0;
323 }
324 
325 static const struct super_operations binderfs_super_ops = {
326 	.evict_inode    = binderfs_evict_inode,
327 	.show_options	= binderfs_show_options,
328 	.statfs         = simple_statfs,
329 };
330 
331 static inline bool is_binderfs_control_device(const struct dentry *dentry)
332 {
333 	struct binderfs_info *info = dentry->d_sb->s_fs_info;
334 
335 	return info->control_dentry == dentry;
336 }
337 
338 static int binderfs_rename(struct mnt_idmap *idmap,
339 			   struct inode *old_dir, struct dentry *old_dentry,
340 			   struct inode *new_dir, struct dentry *new_dentry,
341 			   unsigned int flags)
342 {
343 	if (is_binderfs_control_device(old_dentry) ||
344 	    is_binderfs_control_device(new_dentry))
345 		return -EPERM;
346 
347 	return simple_rename(idmap, old_dir, old_dentry, new_dir,
348 			     new_dentry, flags);
349 }
350 
351 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
352 {
353 	if (is_binderfs_control_device(dentry))
354 		return -EPERM;
355 
356 	return simple_unlink(dir, dentry);
357 }
358 
359 static const struct file_operations binder_ctl_fops = {
360 	.owner		= THIS_MODULE,
361 	.open		= nonseekable_open,
362 	.unlocked_ioctl	= binder_ctl_ioctl,
363 	.compat_ioctl	= binder_ctl_ioctl,
364 	.llseek		= noop_llseek,
365 };
366 
367 /**
368  * binderfs_binder_ctl_create - create a new binder-control device
369  * @sb: super block of the binderfs mount
370  *
371  * This function creates a new binder-control device node in the binderfs mount
372  * referred to by @sb.
373  *
374  * Return: 0 on success, negative errno on failure
375  */
376 static int binderfs_binder_ctl_create(struct super_block *sb)
377 {
378 	int minor, ret;
379 	struct dentry *dentry;
380 	struct binder_device *device;
381 	struct inode *inode = NULL;
382 	struct dentry *root = sb->s_root;
383 	struct binderfs_info *info = sb->s_fs_info;
384 #if defined(CONFIG_IPC_NS)
385 	bool use_reserve = (info->ipc_ns == &init_ipc_ns);
386 #else
387 	bool use_reserve = true;
388 #endif
389 
390 	device = kzalloc(sizeof(*device), GFP_KERNEL);
391 	if (!device)
392 		return -ENOMEM;
393 
394 	/* If we have already created a binder-control node, return. */
395 	if (info->control_dentry) {
396 		ret = 0;
397 		goto out;
398 	}
399 
400 	ret = -ENOMEM;
401 	inode = new_inode(sb);
402 	if (!inode)
403 		goto out;
404 
405 	/* Reserve a new minor number for the new device. */
406 	mutex_lock(&binderfs_minors_mutex);
407 	minor = ida_alloc_max(&binderfs_minors,
408 			      use_reserve ? BINDERFS_MAX_MINOR :
409 					    BINDERFS_MAX_MINOR_CAPPED,
410 			      GFP_KERNEL);
411 	mutex_unlock(&binderfs_minors_mutex);
412 	if (minor < 0) {
413 		ret = minor;
414 		goto out;
415 	}
416 
417 	inode->i_ino = SECOND_INODE;
418 	simple_inode_init_ts(inode);
419 	init_special_inode(inode, S_IFCHR | 0600,
420 			   MKDEV(MAJOR(binderfs_dev), minor));
421 	inode->i_fop = &binder_ctl_fops;
422 	inode->i_uid = info->root_uid;
423 	inode->i_gid = info->root_gid;
424 
425 	device->minor = minor;
426 	device->ctx = NULL;
427 
428 	dentry = d_alloc_name(root, "binder-control");
429 	if (!dentry)
430 		goto out;
431 
432 	inode->i_private = device;
433 	info->control_dentry = dentry;
434 	d_add(dentry, inode);
435 
436 	return 0;
437 
438 out:
439 	kfree(device);
440 	iput(inode);
441 
442 	return ret;
443 }
444 
445 static const struct inode_operations binderfs_dir_inode_operations = {
446 	.lookup = simple_lookup,
447 	.rename = binderfs_rename,
448 	.unlink = binderfs_unlink,
449 };
450 
451 static struct inode *binderfs_make_inode(struct super_block *sb, int mode)
452 {
453 	struct inode *ret;
454 
455 	ret = new_inode(sb);
456 	if (ret) {
457 		ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET);
458 		ret->i_mode = mode;
459 		simple_inode_init_ts(ret);
460 	}
461 	return ret;
462 }
463 
464 void rust_binderfs_remove_file(struct dentry *dentry)
465 {
466 	simple_recursive_removal(dentry, NULL);
467 }
468 
469 static struct dentry *rust_binderfs_create_file(struct dentry *parent, const char *name,
470 						const struct file_operations *fops,
471 						void *data)
472 {
473 	struct dentry *dentry;
474 	struct inode *new_inode;
475 
476 	new_inode = binderfs_make_inode(parent->d_sb, S_IFREG | 0444);
477 	if (!new_inode)
478 		return ERR_PTR(-ENOMEM);
479 	new_inode->i_fop = fops;
480 	new_inode->i_private = data;
481 
482 	dentry = simple_start_creating(parent, name);
483 	if (IS_ERR(dentry)) {
484 		iput(new_inode);
485 		return dentry;
486 	}
487 
488 	d_make_persistent(dentry, new_inode);
489 	fsnotify_create(parent->d_inode, dentry);
490 	simple_done_creating(dentry);
491 	return dentry;
492 }
493 
494 struct dentry *rust_binderfs_create_proc_file(struct inode *nodp, int pid)
495 {
496 	struct binderfs_info *info = nodp->i_sb->s_fs_info;
497 	struct dentry *dir = info->proc_log_dir;
498 	char strbuf[20 + 1];
499 	void *data = (void *)(unsigned long) pid;
500 
501 	if (!dir)
502 		return NULL;
503 
504 	snprintf(strbuf, sizeof(strbuf), "%u", pid);
505 	return rust_binderfs_create_file(dir, strbuf, &rust_binder_proc_fops, data);
506 }
507 
508 static struct dentry *binderfs_create_dir(struct dentry *parent,
509 					  const char *name)
510 {
511 	struct dentry *dentry;
512 	struct inode *new_inode;
513 
514 	new_inode = binderfs_make_inode(parent->d_sb, S_IFDIR | 0755);
515 	if (!new_inode)
516 		return ERR_PTR(-ENOMEM);
517 
518 	new_inode->i_fop = &simple_dir_operations;
519 	new_inode->i_op = &simple_dir_inode_operations;
520 
521 	dentry = simple_start_creating(parent, name);
522 	if (IS_ERR(dentry)) {
523 		iput(new_inode);
524 		return dentry;
525 	}
526 
527 	inc_nlink(parent->d_inode);
528 	set_nlink(new_inode, 2);
529 	d_make_persistent(dentry, new_inode);
530 	fsnotify_mkdir(parent->d_inode, dentry);
531 	simple_done_creating(dentry);
532 	return dentry;
533 }
534 
535 static int binder_features_show(struct seq_file *m, void *unused)
536 {
537 	bool *feature = m->private;
538 
539 	seq_printf(m, "%d\n", *feature);
540 
541 	return 0;
542 }
543 DEFINE_SHOW_ATTRIBUTE(binder_features);
544 
545 static int init_binder_features(struct super_block *sb)
546 {
547 	struct dentry *dentry, *dir;
548 
549 	dir = binderfs_create_dir(sb->s_root, "features");
550 	if (IS_ERR(dir))
551 		return PTR_ERR(dir);
552 
553 	dentry = rust_binderfs_create_file(dir, "oneway_spam_detection",
554 				      &binder_features_fops,
555 				      &binder_features.oneway_spam_detection);
556 	if (IS_ERR(dentry))
557 		return PTR_ERR(dentry);
558 
559 	dentry = rust_binderfs_create_file(dir, "extended_error",
560 				      &binder_features_fops,
561 				      &binder_features.extended_error);
562 	if (IS_ERR(dentry))
563 		return PTR_ERR(dentry);
564 
565 	dentry = rust_binderfs_create_file(dir, "freeze_notification",
566 				      &binder_features_fops,
567 				      &binder_features.freeze_notification);
568 	if (IS_ERR(dentry))
569 		return PTR_ERR(dentry);
570 
571 	return 0;
572 }
573 
574 static int init_binder_logs(struct super_block *sb)
575 {
576 	struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir;
577 	struct binderfs_info *info;
578 	int ret = 0;
579 
580 	binder_logs_root_dir = binderfs_create_dir(sb->s_root,
581 						   "binder_logs");
582 	if (IS_ERR(binder_logs_root_dir)) {
583 		ret = PTR_ERR(binder_logs_root_dir);
584 		goto out;
585 	}
586 
587 	dentry = rust_binderfs_create_file(binder_logs_root_dir, "stats",
588 				      &rust_binder_stats_fops, NULL);
589 	if (IS_ERR(dentry)) {
590 		ret = PTR_ERR(dentry);
591 		goto out;
592 	}
593 
594 	dentry = rust_binderfs_create_file(binder_logs_root_dir, "state",
595 				      &rust_binder_state_fops, NULL);
596 	if (IS_ERR(dentry)) {
597 		ret = PTR_ERR(dentry);
598 		goto out;
599 	}
600 
601 	dentry = rust_binderfs_create_file(binder_logs_root_dir, "transactions",
602 				      &rust_binder_transactions_fops, NULL);
603 	if (IS_ERR(dentry)) {
604 		ret = PTR_ERR(dentry);
605 		goto out;
606 	}
607 
608 	proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc");
609 	if (IS_ERR(proc_log_dir)) {
610 		ret = PTR_ERR(proc_log_dir);
611 		goto out;
612 	}
613 	info = sb->s_fs_info;
614 	info->proc_log_dir = proc_log_dir;
615 
616 out:
617 	return ret;
618 }
619 
620 static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc)
621 {
622 	int ret;
623 	struct binderfs_info *info;
624 	struct binderfs_mount_opts *ctx = fc->fs_private;
625 	struct inode *inode = NULL;
626 	struct binderfs_device device_info = {};
627 	const char *name;
628 	size_t len;
629 
630 	sb->s_blocksize = PAGE_SIZE;
631 	sb->s_blocksize_bits = PAGE_SHIFT;
632 
633 	/*
634 	 * The binderfs filesystem can be mounted by userns root in a
635 	 * non-initial userns. By default such mounts have the SB_I_NODEV flag
636 	 * set in s_iflags to prevent security issues where userns root can
637 	 * just create random device nodes via mknod() since it owns the
638 	 * filesystem mount. But binderfs does not allow to create any files
639 	 * including devices nodes. The only way to create binder devices nodes
640 	 * is through the binder-control device which userns root is explicitly
641 	 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
642 	 * necessary and safe.
643 	 */
644 	sb->s_iflags &= ~SB_I_NODEV;
645 	sb->s_iflags |= SB_I_NOEXEC;
646 	sb->s_magic = RUST_BINDERFS_SUPER_MAGIC;
647 	sb->s_op = &binderfs_super_ops;
648 	sb->s_time_gran = 1;
649 
650 	sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
651 	if (!sb->s_fs_info)
652 		return -ENOMEM;
653 	info = sb->s_fs_info;
654 
655 	info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns);
656 
657 	info->root_gid = make_kgid(sb->s_user_ns, 0);
658 	if (!gid_valid(info->root_gid))
659 		info->root_gid = GLOBAL_ROOT_GID;
660 	info->root_uid = make_kuid(sb->s_user_ns, 0);
661 	if (!uid_valid(info->root_uid))
662 		info->root_uid = GLOBAL_ROOT_UID;
663 	info->mount_opts.max = ctx->max;
664 	info->mount_opts.stats_mode = ctx->stats_mode;
665 
666 	inode = new_inode(sb);
667 	if (!inode)
668 		return -ENOMEM;
669 
670 	inode->i_ino = FIRST_INODE;
671 	inode->i_fop = &simple_dir_operations;
672 	inode->i_mode = S_IFDIR | 0755;
673 	simple_inode_init_ts(inode);
674 	inode->i_op = &binderfs_dir_inode_operations;
675 	set_nlink(inode, 2);
676 
677 	sb->s_root = d_make_root(inode);
678 	if (!sb->s_root)
679 		return -ENOMEM;
680 
681 	ret = binderfs_binder_ctl_create(sb);
682 	if (ret)
683 		return ret;
684 
685 	name = rust_binder_devices_param;
686 	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
687 		strscpy(device_info.name, name, len + 1);
688 		ret = binderfs_binder_device_create(inode, NULL, &device_info);
689 		if (ret)
690 			return ret;
691 		name += len;
692 		if (*name == ',')
693 			name++;
694 	}
695 
696 	ret = init_binder_features(sb);
697 	if (ret)
698 		return ret;
699 
700 	if (info->mount_opts.stats_mode == binderfs_stats_mode_global)
701 		return init_binder_logs(sb);
702 
703 	return 0;
704 }
705 
706 static int binderfs_fs_context_get_tree(struct fs_context *fc)
707 {
708 	return get_tree_nodev(fc, binderfs_fill_super);
709 }
710 
711 static void binderfs_fs_context_free(struct fs_context *fc)
712 {
713 	struct binderfs_mount_opts *ctx = fc->fs_private;
714 
715 	kfree(ctx);
716 }
717 
718 static const struct fs_context_operations binderfs_fs_context_ops = {
719 	.free		= binderfs_fs_context_free,
720 	.get_tree	= binderfs_fs_context_get_tree,
721 	.parse_param	= binderfs_fs_context_parse_param,
722 	.reconfigure	= binderfs_fs_context_reconfigure,
723 };
724 
725 static int binderfs_init_fs_context(struct fs_context *fc)
726 {
727 	struct binderfs_mount_opts *ctx;
728 
729 	ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL);
730 	if (!ctx)
731 		return -ENOMEM;
732 
733 	ctx->max = BINDERFS_MAX_MINOR;
734 	ctx->stats_mode = binderfs_stats_mode_unset;
735 
736 	fc->fs_private = ctx;
737 	fc->ops = &binderfs_fs_context_ops;
738 
739 	return 0;
740 }
741 
742 static void binderfs_kill_super(struct super_block *sb)
743 {
744 	struct binderfs_info *info = sb->s_fs_info;
745 
746 	/*
747 	 * During inode eviction struct binderfs_info is needed.
748 	 * So first wipe the super_block then free struct binderfs_info.
749 	 */
750 	kill_anon_super(sb);
751 
752 	if (info && info->ipc_ns)
753 		put_ipc_ns(info->ipc_ns);
754 
755 	kfree(info);
756 }
757 
758 static struct file_system_type binder_fs_type = {
759 	.name			= "binder",
760 	.init_fs_context	= binderfs_init_fs_context,
761 	.parameters		= binderfs_fs_parameters,
762 	.kill_sb		= binderfs_kill_super,
763 	.fs_flags		= FS_USERNS_MOUNT,
764 };
765 
766 int init_rust_binderfs(void)
767 {
768 	int ret;
769 	const char *name;
770 	size_t len;
771 
772 	/* Verify that the default binderfs device names are valid. */
773 	name = rust_binder_devices_param;
774 	for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) {
775 		if (len > BINDERFS_MAX_NAME)
776 			return -E2BIG;
777 		name += len;
778 		if (*name == ',')
779 			name++;
780 	}
781 
782 	/* Allocate new major number for binderfs. */
783 	ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
784 				  "rust_binder");
785 	if (ret)
786 		return ret;
787 
788 	ret = register_filesystem(&binder_fs_type);
789 	if (ret) {
790 		unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
791 		return ret;
792 	}
793 
794 	return ret;
795 }
796