1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/compiler_types.h> 4 #include <linux/errno.h> 5 #include <linux/fs.h> 6 #include <linux/fsnotify.h> 7 #include <linux/gfp.h> 8 #include <linux/idr.h> 9 #include <linux/init.h> 10 #include <linux/ipc_namespace.h> 11 #include <linux/kdev_t.h> 12 #include <linux/kernel.h> 13 #include <linux/list.h> 14 #include <linux/namei.h> 15 #include <linux/magic.h> 16 #include <linux/major.h> 17 #include <linux/miscdevice.h> 18 #include <linux/module.h> 19 #include <linux/mutex.h> 20 #include <linux/mount.h> 21 #include <linux/fs_parser.h> 22 #include <linux/sched.h> 23 #include <linux/seq_file.h> 24 #include <linux/slab.h> 25 #include <linux/spinlock_types.h> 26 #include <linux/stddef.h> 27 #include <linux/string.h> 28 #include <linux/types.h> 29 #include <linux/uaccess.h> 30 #include <linux/user_namespace.h> 31 #include <linux/xarray.h> 32 #include <uapi/linux/android/binder.h> 33 #include <uapi/linux/android/binderfs.h> 34 35 #include "binder_internal.h" 36 37 #define FIRST_INODE 1 38 #define SECOND_INODE 2 39 #define INODE_OFFSET 3 40 #define BINDERFS_MAX_MINOR (1U << MINORBITS) 41 /* Ensure that the initial ipc namespace always has devices available. */ 42 #define BINDERFS_MAX_MINOR_CAPPED (BINDERFS_MAX_MINOR - 4) 43 44 static dev_t binderfs_dev; 45 static DEFINE_MUTEX(binderfs_minors_mutex); 46 static DEFINE_IDA(binderfs_minors); 47 48 enum binderfs_param { 49 Opt_max, 50 Opt_stats_mode, 51 }; 52 53 enum binderfs_stats_mode { 54 binderfs_stats_mode_unset, 55 binderfs_stats_mode_global, 56 }; 57 58 struct binder_features { 59 bool oneway_spam_detection; 60 bool extended_error; 61 bool freeze_notification; 62 bool transaction_report; 63 }; 64 65 static const struct constant_table binderfs_param_stats[] = { 66 { "global", binderfs_stats_mode_global }, 67 {} 68 }; 69 70 static const struct fs_parameter_spec binderfs_fs_parameters[] = { 71 fsparam_u32("max", Opt_max), 72 fsparam_enum("stats", Opt_stats_mode, binderfs_param_stats), 73 {} 74 }; 75 76 static struct binder_features binder_features = { 77 .oneway_spam_detection = true, 78 .extended_error = true, 79 .freeze_notification = true, 80 .transaction_report = true, 81 }; 82 83 static inline struct binderfs_info *BINDERFS_SB(const struct super_block *sb) 84 { 85 return sb->s_fs_info; 86 } 87 88 bool is_binderfs_device(const struct inode *inode) 89 { 90 if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC) 91 return true; 92 93 return false; 94 } 95 96 /** 97 * binderfs_binder_device_create - allocate inode from super block of a 98 * binderfs mount 99 * @ref_inode: inode from which the super block will be taken 100 * @userp: buffer to copy information about new device for userspace to 101 * @req: struct binderfs_device as copied from userspace 102 * 103 * This function allocates a new binder_device and reserves a new minor 104 * number for it. 105 * Minor numbers are limited and tracked globally in binderfs_minors. The 106 * function will stash a struct binder_device for the specific binder 107 * device in i_private of the inode. 108 * It will go on to allocate a new inode from the super block of the 109 * filesystem mount, stash a struct binder_device in its i_private field 110 * and attach a dentry to that inode. 111 * 112 * Return: 0 on success, negative errno on failure 113 */ 114 static int binderfs_binder_device_create(struct inode *ref_inode, 115 struct binderfs_device __user *userp, 116 struct binderfs_device *req) 117 { 118 int minor, ret; 119 struct dentry *dentry, *root; 120 struct binder_device *device; 121 char *name = NULL; 122 struct inode *inode = NULL; 123 struct super_block *sb = ref_inode->i_sb; 124 struct binderfs_info *info = sb->s_fs_info; 125 #if defined(CONFIG_IPC_NS) 126 bool use_reserve = (info->ipc_ns == &init_ipc_ns); 127 #else 128 bool use_reserve = true; 129 #endif 130 131 /* Reserve new minor number for the new device. */ 132 mutex_lock(&binderfs_minors_mutex); 133 if (++info->device_count <= info->mount_opts.max) 134 minor = ida_alloc_max(&binderfs_minors, 135 use_reserve ? BINDERFS_MAX_MINOR : 136 BINDERFS_MAX_MINOR_CAPPED, 137 GFP_KERNEL); 138 else 139 minor = -ENOSPC; 140 if (minor < 0) { 141 --info->device_count; 142 mutex_unlock(&binderfs_minors_mutex); 143 return minor; 144 } 145 mutex_unlock(&binderfs_minors_mutex); 146 147 ret = -ENOMEM; 148 device = kzalloc(sizeof(*device), GFP_KERNEL); 149 if (!device) 150 goto err; 151 152 inode = new_inode(sb); 153 if (!inode) 154 goto err; 155 156 inode->i_ino = minor + INODE_OFFSET; 157 simple_inode_init_ts(inode); 158 init_special_inode(inode, S_IFCHR | 0600, 159 MKDEV(MAJOR(binderfs_dev), minor)); 160 inode->i_fop = &binder_fops; 161 inode->i_uid = info->root_uid; 162 inode->i_gid = info->root_gid; 163 164 req->name[BINDERFS_MAX_NAME] = '\0'; /* NUL-terminate */ 165 name = kstrdup(req->name, GFP_KERNEL); 166 if (!name) 167 goto err; 168 169 refcount_set(&device->ref, 1); 170 device->binderfs_inode = inode; 171 device->context.binder_context_mgr_uid = INVALID_UID; 172 device->context.name = name; 173 device->miscdev.name = name; 174 device->miscdev.minor = minor; 175 mutex_init(&device->context.context_mgr_node_lock); 176 177 req->major = MAJOR(binderfs_dev); 178 req->minor = minor; 179 180 if (userp && copy_to_user(userp, req, sizeof(*req))) { 181 ret = -EFAULT; 182 goto err; 183 } 184 185 root = sb->s_root; 186 dentry = simple_start_creating(root, name); 187 if (IS_ERR(dentry)) { 188 ret = PTR_ERR(dentry); 189 goto err; 190 } 191 inode->i_private = device; 192 d_make_persistent(dentry, inode); 193 fsnotify_create(root->d_inode, dentry); 194 simple_done_creating(dentry); 195 196 binder_add_device(device); 197 198 return 0; 199 200 err: 201 kfree(name); 202 kfree(device); 203 mutex_lock(&binderfs_minors_mutex); 204 --info->device_count; 205 ida_free(&binderfs_minors, minor); 206 mutex_unlock(&binderfs_minors_mutex); 207 iput(inode); 208 209 return ret; 210 } 211 212 /** 213 * binder_ctl_ioctl - handle binder device node allocation requests 214 * 215 * The request handler for the binder-control device. All requests operate on 216 * the binderfs mount the binder-control device resides in: 217 * - BINDER_CTL_ADD 218 * Allocate a new binder device. 219 * 220 * Return: %0 on success, negative errno on failure. 221 */ 222 static long binder_ctl_ioctl(struct file *file, unsigned int cmd, 223 unsigned long arg) 224 { 225 int ret = -EINVAL; 226 struct inode *inode = file_inode(file); 227 struct binderfs_device __user *device = (struct binderfs_device __user *)arg; 228 struct binderfs_device device_req; 229 230 switch (cmd) { 231 case BINDER_CTL_ADD: 232 ret = copy_from_user(&device_req, device, sizeof(device_req)); 233 if (ret) { 234 ret = -EFAULT; 235 break; 236 } 237 238 ret = binderfs_binder_device_create(inode, device, &device_req); 239 break; 240 default: 241 break; 242 } 243 244 return ret; 245 } 246 247 static void binderfs_evict_inode(struct inode *inode) 248 { 249 struct binder_device *device = inode->i_private; 250 struct binderfs_info *info = BINDERFS_SB(inode->i_sb); 251 252 clear_inode(inode); 253 254 if (!S_ISCHR(inode->i_mode) || !device) 255 return; 256 257 mutex_lock(&binderfs_minors_mutex); 258 --info->device_count; 259 ida_free(&binderfs_minors, device->miscdev.minor); 260 mutex_unlock(&binderfs_minors_mutex); 261 262 if (refcount_dec_and_test(&device->ref)) { 263 binder_remove_device(device); 264 kfree(device->context.name); 265 kfree(device); 266 } 267 } 268 269 static int binderfs_fs_context_parse_param(struct fs_context *fc, 270 struct fs_parameter *param) 271 { 272 int opt; 273 struct binderfs_mount_opts *ctx = fc->fs_private; 274 struct fs_parse_result result; 275 276 opt = fs_parse(fc, binderfs_fs_parameters, param, &result); 277 if (opt < 0) 278 return opt; 279 280 switch (opt) { 281 case Opt_max: 282 if (result.uint_32 > BINDERFS_MAX_MINOR) 283 return invalfc(fc, "Bad value for '%s'", param->key); 284 285 ctx->max = result.uint_32; 286 break; 287 case Opt_stats_mode: 288 if (!capable(CAP_SYS_ADMIN)) 289 return -EPERM; 290 291 ctx->stats_mode = result.uint_32; 292 break; 293 default: 294 return invalfc(fc, "Unsupported parameter '%s'", param->key); 295 } 296 297 return 0; 298 } 299 300 static int binderfs_fs_context_reconfigure(struct fs_context *fc) 301 { 302 struct binderfs_mount_opts *ctx = fc->fs_private; 303 struct binderfs_info *info = BINDERFS_SB(fc->root->d_sb); 304 305 if (info->mount_opts.stats_mode != ctx->stats_mode) 306 return invalfc(fc, "Binderfs stats mode cannot be changed during a remount"); 307 308 info->mount_opts.stats_mode = ctx->stats_mode; 309 info->mount_opts.max = ctx->max; 310 return 0; 311 } 312 313 static int binderfs_show_options(struct seq_file *seq, struct dentry *root) 314 { 315 struct binderfs_info *info = BINDERFS_SB(root->d_sb); 316 317 if (info->mount_opts.max <= BINDERFS_MAX_MINOR) 318 seq_printf(seq, ",max=%d", info->mount_opts.max); 319 320 switch (info->mount_opts.stats_mode) { 321 case binderfs_stats_mode_unset: 322 break; 323 case binderfs_stats_mode_global: 324 seq_printf(seq, ",stats=global"); 325 break; 326 } 327 328 return 0; 329 } 330 331 static const struct super_operations binderfs_super_ops = { 332 .evict_inode = binderfs_evict_inode, 333 .show_options = binderfs_show_options, 334 .statfs = simple_statfs, 335 }; 336 337 static inline bool is_binderfs_control_device(const struct dentry *dentry) 338 { 339 struct binderfs_info *info = dentry->d_sb->s_fs_info; 340 341 return info->control_dentry == dentry; 342 } 343 344 static int binderfs_rename(struct mnt_idmap *idmap, 345 struct inode *old_dir, struct dentry *old_dentry, 346 struct inode *new_dir, struct dentry *new_dentry, 347 unsigned int flags) 348 { 349 if (is_binderfs_control_device(old_dentry) || 350 is_binderfs_control_device(new_dentry)) 351 return -EPERM; 352 353 return simple_rename(idmap, old_dir, old_dentry, new_dir, 354 new_dentry, flags); 355 } 356 357 static int binderfs_unlink(struct inode *dir, struct dentry *dentry) 358 { 359 if (is_binderfs_control_device(dentry)) 360 return -EPERM; 361 362 return simple_unlink(dir, dentry); 363 } 364 365 static const struct file_operations binder_ctl_fops = { 366 .owner = THIS_MODULE, 367 .open = nonseekable_open, 368 .unlocked_ioctl = binder_ctl_ioctl, 369 .compat_ioctl = binder_ctl_ioctl, 370 .llseek = noop_llseek, 371 }; 372 373 /** 374 * binderfs_binder_ctl_create - create a new binder-control device 375 * @sb: super block of the binderfs mount 376 * 377 * This function creates a new binder-control device node in the binderfs mount 378 * referred to by @sb. 379 * 380 * Return: 0 on success, negative errno on failure 381 */ 382 static int binderfs_binder_ctl_create(struct super_block *sb) 383 { 384 int minor, ret; 385 struct dentry *dentry; 386 struct binder_device *device; 387 struct inode *inode = NULL; 388 struct dentry *root = sb->s_root; 389 struct binderfs_info *info = sb->s_fs_info; 390 #if defined(CONFIG_IPC_NS) 391 bool use_reserve = (info->ipc_ns == &init_ipc_ns); 392 #else 393 bool use_reserve = true; 394 #endif 395 396 device = kzalloc(sizeof(*device), GFP_KERNEL); 397 if (!device) 398 return -ENOMEM; 399 400 ret = -ENOMEM; 401 inode = new_inode(sb); 402 if (!inode) 403 goto out; 404 405 /* Reserve a new minor number for the new device. */ 406 mutex_lock(&binderfs_minors_mutex); 407 minor = ida_alloc_max(&binderfs_minors, 408 use_reserve ? BINDERFS_MAX_MINOR : 409 BINDERFS_MAX_MINOR_CAPPED, 410 GFP_KERNEL); 411 mutex_unlock(&binderfs_minors_mutex); 412 if (minor < 0) { 413 ret = minor; 414 goto out; 415 } 416 417 inode->i_ino = SECOND_INODE; 418 simple_inode_init_ts(inode); 419 init_special_inode(inode, S_IFCHR | 0600, 420 MKDEV(MAJOR(binderfs_dev), minor)); 421 inode->i_fop = &binder_ctl_fops; 422 inode->i_uid = info->root_uid; 423 inode->i_gid = info->root_gid; 424 425 refcount_set(&device->ref, 1); 426 device->binderfs_inode = inode; 427 device->miscdev.minor = minor; 428 429 dentry = d_alloc_name(root, "binder-control"); 430 if (!dentry) 431 goto out; 432 433 inode->i_private = device; 434 info->control_dentry = dentry; 435 d_make_persistent(dentry, inode); 436 dput(dentry); 437 438 return 0; 439 440 out: 441 kfree(device); 442 iput(inode); 443 444 return ret; 445 } 446 447 static const struct inode_operations binderfs_dir_inode_operations = { 448 .lookup = simple_lookup, 449 .rename = binderfs_rename, 450 .unlink = binderfs_unlink, 451 }; 452 453 static struct inode *binderfs_make_inode(struct super_block *sb, int mode) 454 { 455 struct inode *ret; 456 457 ret = new_inode(sb); 458 if (ret) { 459 ret->i_ino = iunique(sb, BINDERFS_MAX_MINOR + INODE_OFFSET); 460 ret->i_mode = mode; 461 simple_inode_init_ts(ret); 462 } 463 return ret; 464 } 465 466 struct dentry *binderfs_create_file(struct dentry *parent, const char *name, 467 const struct file_operations *fops, 468 void *data) 469 { 470 struct dentry *dentry; 471 struct inode *new_inode, *parent_inode; 472 struct super_block *sb; 473 474 parent_inode = d_inode(parent); 475 476 dentry = simple_start_creating(parent, name); 477 if (IS_ERR(dentry)) 478 return dentry; 479 480 sb = parent_inode->i_sb; 481 new_inode = binderfs_make_inode(sb, S_IFREG | 0444); 482 if (!new_inode) { 483 simple_done_creating(dentry); 484 return ERR_PTR(-ENOMEM); 485 } 486 487 new_inode->i_fop = fops; 488 new_inode->i_private = data; 489 d_make_persistent(dentry, new_inode); 490 fsnotify_create(parent_inode, dentry); 491 simple_done_creating(dentry); 492 return dentry; // borrowed 493 } 494 495 static struct dentry *binderfs_create_dir(struct dentry *parent, 496 const char *name) 497 { 498 struct dentry *dentry; 499 struct inode *new_inode, *parent_inode; 500 struct super_block *sb; 501 502 parent_inode = d_inode(parent); 503 504 dentry = simple_start_creating(parent, name); 505 if (IS_ERR(dentry)) 506 return dentry; 507 508 sb = parent_inode->i_sb; 509 new_inode = binderfs_make_inode(sb, S_IFDIR | 0755); 510 if (!new_inode) { 511 simple_done_creating(dentry); 512 return ERR_PTR(-ENOMEM); 513 } 514 515 new_inode->i_fop = &simple_dir_operations; 516 new_inode->i_op = &simple_dir_inode_operations; 517 518 set_nlink(new_inode, 2); 519 d_make_persistent(dentry, new_inode); 520 inc_nlink(parent_inode); 521 fsnotify_mkdir(parent_inode, dentry); 522 simple_done_creating(dentry); 523 return dentry; 524 } 525 526 static int binder_features_show(struct seq_file *m, void *unused) 527 { 528 bool *feature = m->private; 529 530 seq_printf(m, "%d\n", *feature); 531 532 return 0; 533 } 534 DEFINE_SHOW_ATTRIBUTE(binder_features); 535 536 static int init_binder_features(struct super_block *sb) 537 { 538 struct dentry *dentry, *dir; 539 540 dir = binderfs_create_dir(sb->s_root, "features"); 541 if (IS_ERR(dir)) 542 return PTR_ERR(dir); 543 544 dentry = binderfs_create_file(dir, "oneway_spam_detection", 545 &binder_features_fops, 546 &binder_features.oneway_spam_detection); 547 if (IS_ERR(dentry)) 548 return PTR_ERR(dentry); 549 550 dentry = binderfs_create_file(dir, "extended_error", 551 &binder_features_fops, 552 &binder_features.extended_error); 553 if (IS_ERR(dentry)) 554 return PTR_ERR(dentry); 555 556 dentry = binderfs_create_file(dir, "freeze_notification", 557 &binder_features_fops, 558 &binder_features.freeze_notification); 559 if (IS_ERR(dentry)) 560 return PTR_ERR(dentry); 561 562 dentry = binderfs_create_file(dir, "transaction_report", 563 &binder_features_fops, 564 &binder_features.transaction_report); 565 if (IS_ERR(dentry)) 566 return PTR_ERR(dentry); 567 568 return 0; 569 } 570 571 static int init_binder_logs(struct super_block *sb) 572 { 573 struct dentry *binder_logs_root_dir, *dentry, *proc_log_dir; 574 const struct binder_debugfs_entry *db_entry; 575 struct binderfs_info *info; 576 int ret = 0; 577 578 binder_logs_root_dir = binderfs_create_dir(sb->s_root, 579 "binder_logs"); 580 if (IS_ERR(binder_logs_root_dir)) { 581 ret = PTR_ERR(binder_logs_root_dir); 582 goto out; 583 } 584 585 binder_for_each_debugfs_entry(db_entry) { 586 dentry = binderfs_create_file(binder_logs_root_dir, 587 db_entry->name, 588 db_entry->fops, 589 db_entry->data); 590 if (IS_ERR(dentry)) { 591 ret = PTR_ERR(dentry); 592 goto out; 593 } 594 } 595 596 proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc"); 597 if (IS_ERR(proc_log_dir)) { 598 ret = PTR_ERR(proc_log_dir); 599 goto out; 600 } 601 info = sb->s_fs_info; 602 info->proc_log_dir = proc_log_dir; 603 604 out: 605 return ret; 606 } 607 608 static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc) 609 { 610 int ret; 611 struct binderfs_info *info; 612 struct binderfs_mount_opts *ctx = fc->fs_private; 613 struct inode *inode = NULL; 614 struct binderfs_device device_info = {}; 615 const char *name; 616 size_t len; 617 618 sb->s_blocksize = PAGE_SIZE; 619 sb->s_blocksize_bits = PAGE_SHIFT; 620 621 /* 622 * The binderfs filesystem can be mounted by userns root in a 623 * non-initial userns. By default such mounts have the SB_I_NODEV flag 624 * set in s_iflags to prevent security issues where userns root can 625 * just create random device nodes via mknod() since it owns the 626 * filesystem mount. But binderfs does not allow to create any files 627 * including devices nodes. The only way to create binder devices nodes 628 * is through the binder-control device which userns root is explicitly 629 * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both 630 * necessary and safe. 631 */ 632 sb->s_iflags &= ~SB_I_NODEV; 633 sb->s_iflags |= SB_I_NOEXEC; 634 sb->s_magic = BINDERFS_SUPER_MAGIC; 635 sb->s_op = &binderfs_super_ops; 636 sb->s_time_gran = 1; 637 638 sb->s_fs_info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL); 639 if (!sb->s_fs_info) 640 return -ENOMEM; 641 info = sb->s_fs_info; 642 643 info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); 644 645 info->root_gid = make_kgid(sb->s_user_ns, 0); 646 if (!gid_valid(info->root_gid)) 647 info->root_gid = GLOBAL_ROOT_GID; 648 info->root_uid = make_kuid(sb->s_user_ns, 0); 649 if (!uid_valid(info->root_uid)) 650 info->root_uid = GLOBAL_ROOT_UID; 651 info->mount_opts.max = ctx->max; 652 info->mount_opts.stats_mode = ctx->stats_mode; 653 654 inode = new_inode(sb); 655 if (!inode) 656 return -ENOMEM; 657 658 inode->i_ino = FIRST_INODE; 659 inode->i_fop = &simple_dir_operations; 660 inode->i_mode = S_IFDIR | 0755; 661 simple_inode_init_ts(inode); 662 inode->i_op = &binderfs_dir_inode_operations; 663 set_nlink(inode, 2); 664 665 sb->s_root = d_make_root(inode); 666 if (!sb->s_root) 667 return -ENOMEM; 668 669 ret = binderfs_binder_ctl_create(sb); 670 if (ret) 671 return ret; 672 673 name = binder_devices_param; 674 for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { 675 strscpy(device_info.name, name, len + 1); 676 ret = binderfs_binder_device_create(inode, NULL, &device_info); 677 if (ret) 678 return ret; 679 name += len; 680 if (*name == ',') 681 name++; 682 } 683 684 ret = init_binder_features(sb); 685 if (ret) 686 return ret; 687 688 if (info->mount_opts.stats_mode == binderfs_stats_mode_global) 689 return init_binder_logs(sb); 690 691 return 0; 692 } 693 694 static int binderfs_fs_context_get_tree(struct fs_context *fc) 695 { 696 return get_tree_nodev(fc, binderfs_fill_super); 697 } 698 699 static void binderfs_fs_context_free(struct fs_context *fc) 700 { 701 struct binderfs_mount_opts *ctx = fc->fs_private; 702 703 kfree(ctx); 704 } 705 706 static const struct fs_context_operations binderfs_fs_context_ops = { 707 .free = binderfs_fs_context_free, 708 .get_tree = binderfs_fs_context_get_tree, 709 .parse_param = binderfs_fs_context_parse_param, 710 .reconfigure = binderfs_fs_context_reconfigure, 711 }; 712 713 static int binderfs_init_fs_context(struct fs_context *fc) 714 { 715 struct binderfs_mount_opts *ctx; 716 717 ctx = kzalloc(sizeof(struct binderfs_mount_opts), GFP_KERNEL); 718 if (!ctx) 719 return -ENOMEM; 720 721 ctx->max = BINDERFS_MAX_MINOR; 722 ctx->stats_mode = binderfs_stats_mode_unset; 723 724 fc->fs_private = ctx; 725 fc->ops = &binderfs_fs_context_ops; 726 727 return 0; 728 } 729 730 static void binderfs_kill_super(struct super_block *sb) 731 { 732 struct binderfs_info *info = sb->s_fs_info; 733 734 /* 735 * During inode eviction struct binderfs_info is needed. 736 * So first wipe the super_block then free struct binderfs_info. 737 */ 738 kill_anon_super(sb); 739 740 if (info && info->ipc_ns) 741 put_ipc_ns(info->ipc_ns); 742 743 kfree(info); 744 } 745 746 static struct file_system_type binder_fs_type = { 747 .name = "binder", 748 .init_fs_context = binderfs_init_fs_context, 749 .parameters = binderfs_fs_parameters, 750 .kill_sb = binderfs_kill_super, 751 .fs_flags = FS_USERNS_MOUNT, 752 }; 753 754 int __init init_binderfs(void) 755 { 756 int ret; 757 const char *name; 758 size_t len; 759 760 /* Verify that the default binderfs device names are valid. */ 761 name = binder_devices_param; 762 for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { 763 if (len > BINDERFS_MAX_NAME) 764 return -E2BIG; 765 name += len; 766 if (*name == ',') 767 name++; 768 } 769 770 /* Allocate new major number for binderfs. */ 771 ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR, 772 "binder"); 773 if (ret) 774 return ret; 775 776 ret = register_filesystem(&binder_fs_type); 777 if (ret) { 778 unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR); 779 return ret; 780 } 781 782 return ret; 783 } 784