From e72806d12996b91666ce2a5d8d5383113d1aa582 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Wed, 16 Jan 2019 23:13:25 +0100 Subject: [PATCH] SAUCE: binder: turn into module The Android binder driver needs to become a module for the sake of shipping Anbox. To do this we need to export the following functions since binder is currently still using them: - security_binder_set_context_mgr() - security_binder_transaction() - security_binder_transfer_binder() - security_binder_transfer_file() - can_nice() - __wake_up_pollfree() - __close_fd_get_file() - task_work_add() - map_kernel_range_noflush() - get_vm_area() - zap_page_range() - put_ipc_ns() - get_ipc_ns_exported() - show_init_ipc_ns() Rebased-by: Alexandre Frade Signed-off-by: Christian Brauner [ saf: fix additional reference to init_ipc_ns from 5.0-rc6 ] Signed-off-by: Seth Forshee Signed-off-by: Alexandre Frade --- drivers/android/Kconfig | 6 +++--- drivers/android/Makefile | 10 +++++++--- drivers/android/binder.c | 17 ++++++++++++++--- drivers/android/binder_alloc.h | 3 ++- drivers/android/binder_internal.h | 5 +++-- drivers/android/binderfs.c | 6 +++--- fs/file.c | 1 + include/linux/ipc_namespace.h | 3 +++ ipc/namespace.c | 17 +++++++++++++++++ kernel/sched/core.c | 1 + kernel/sched/wait.c | 1 + kernel/task_work.c | 1 + mm/memory.c | 1 + mm/vmalloc.c | 1 + security/security.c | 4 ++++ 15 files changed, 62 insertions(+), 15 deletions(-) diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig index 53b22e26266c3..2d821ed78453d 100644 --- a/drivers/android/Kconfig +++ b/drivers/android/Kconfig @@ -9,7 +9,7 @@ config ANDROID if ANDROID config ANDROID_BINDER_IPC - bool "Android Binder IPC Driver" + tristate "Android Binder IPC Driver" depends on MMU default n help @@ -21,8 +21,8 @@ config ANDROID_BINDER_IPC between said processes. config ANDROID_BINDERFS - bool "Android Binderfs filesystem" - depends on ANDROID_BINDER_IPC + tristate "Android Binderfs filesystem" + depends on (ANDROID_BINDER_IPC=y) || (ANDROID_BINDER_IPC=m && m) default n help Binderfs is a pseudo-filesystem for the Android Binder IPC driver diff --git a/drivers/android/Makefile b/drivers/android/Makefile index c9d3d0c99c257..b9d5ce8deca2b 100644 --- a/drivers/android/Makefile +++ b/drivers/android/Makefile @@ -1,6 +1,10 @@ # SPDX-License-Identifier: GPL-2.0-only ccflags-y += -I$(src) # needed for trace events -obj-$(CONFIG_ANDROID_BINDERFS) += binderfs.o -obj-$(CONFIG_ANDROID_BINDER_IPC) += binder.o binder_alloc.o -obj-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o +binder_linux-y := binder.o binder_alloc.o +obj-$(CONFIG_ANDROID_BINDER_IPC) += binder_linux.o +binder_linux-$(CONFIG_ANDROID_BINDERFS) += binderfs.o +binder_linux-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o + +# binder-$(CONFIG_ANDROID_BINDER_IPC) := binder.o binder_alloc.o +# binder-$(CONFIG_ANDROID_BINDERFS) += binderfs.o diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 8bac11d8e618a..664b95c51c748 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6515,9 +6515,20 @@ static int __init binder_init(void) return ret; } -device_initcall(binder_init); +module_init(binder_init); +/* + * binder will have no exit function since binderfs instances can be mounted + * multiple times and also in user namespaces finding and destroying them all + * is not feasible without introducing insane locking. Just ignoring existing + * instances on module unload also wouldn't work since we would loose track of + * what major numer was dynamically allocated and also what minor numbers are + * already given out. So this would get us into all kinds of issues with device + * number reuse. So simply don't allow unloading unless we are forced to do so. + */ + +MODULE_AUTHOR("Google, Inc."); +MODULE_DESCRIPTION("Driver for Android binder device"); +MODULE_LICENSE("GPL v2"); #define CREATE_TRACE_POINTS #include "binder_trace.h" - -MODULE_LICENSE("GPL v2"); diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h index 1e4fd37af5e03..d37c721ccf6a1 100644 --- a/drivers/android/binder_alloc.h +++ b/drivers/android/binder_alloc.h @@ -6,6 +6,7 @@ #ifndef _LINUX_BINDER_ALLOC_H #define _LINUX_BINDER_ALLOC_H +#include #include #include #include @@ -115,7 +116,7 @@ struct binder_alloc { bool oneway_spam_detected; }; -#ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST +#if IS_ENABLED(CONFIG_ANDROID_BINDER_IPC_SELFTEST) void binder_selftest_alloc(struct binder_alloc *alloc); #else static inline void binder_selftest_alloc(struct binder_alloc *alloc) {} diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h index abe19d88c6ecc..7971e5d55a096 100644 --- a/drivers/android/binder_internal.h +++ b/drivers/android/binder_internal.h @@ -5,6 +5,7 @@ #include #include +#include #include #include #include @@ -77,7 +78,7 @@ extern const struct file_operations binder_fops; extern char *binder_devices_param; -#ifdef CONFIG_ANDROID_BINDERFS +#if IS_ENABLED(CONFIG_ANDROID_BINDERFS) extern bool is_binderfs_device(const struct inode *inode); extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name, const struct file_operations *fops, @@ -98,7 +99,7 @@ static inline struct dentry *binderfs_create_file(struct dentry *dir, static inline void binderfs_remove_file(struct dentry *dentry) {} #endif -#ifdef CONFIG_ANDROID_BINDERFS +#if IS_ENABLED(CONFIG_ANDROID_BINDERFS) extern int __init init_binderfs(void); #else static inline int __init init_binderfs(void) diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index 588d753a7a199..2aa0c07598595 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -123,7 +123,7 @@ static int binderfs_binder_device_create(struct inode *ref_inode, struct super_block *sb = ref_inode->i_sb; struct binderfs_info *info = sb->s_fs_info; #if defined(CONFIG_IPC_NS) - bool use_reserve = (info->ipc_ns == &init_ipc_ns); + bool use_reserve = (info->ipc_ns == show_init_ipc_ns()); #else bool use_reserve = true; #endif @@ -412,7 +412,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) struct dentry *root = sb->s_root; struct binderfs_info *info = sb->s_fs_info; #if defined(CONFIG_IPC_NS) - bool use_reserve = (info->ipc_ns == &init_ipc_ns); + bool use_reserve = (info->ipc_ns == show_init_ipc_ns()); #else bool use_reserve = true; #endif @@ -698,7 +698,7 @@ static int binderfs_fill_super(struct super_block *sb, struct fs_context *fc) return -ENOMEM; info = sb->s_fs_info; - info->ipc_ns = get_ipc_ns(current->nsproxy->ipc_ns); + info->ipc_ns = get_ipc_ns_exported(current->nsproxy->ipc_ns); info->root_gid = make_kgid(sb->s_user_ns, 0); if (!gid_valid(info->root_gid)) diff --git a/fs/file.c b/fs/file.c index 3bcc1ecc314a7..89600ae0a4f6b 100644 --- a/fs/file.c +++ b/fs/file.c @@ -797,6 +797,7 @@ struct file *__close_fd_get_file(unsigned int fd) { return pick_file(current->files, fd); } +EXPORT_SYMBOL(close_fd_get_file); /* * variant of close_fd that gets a ref on the file for later fput. diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h index e3e8c8662b490..2c4ef98ae436c 100644 --- a/include/linux/ipc_namespace.h +++ b/include/linux/ipc_namespace.h @@ -127,6 +127,9 @@ extern int mq_init_ns(struct ipc_namespace *ns); static inline int mq_init_ns(struct ipc_namespace *ns) { return 0; } #endif +extern struct ipc_namespace *get_ipc_ns_exported(struct ipc_namespace *ns); +extern struct ipc_namespace *show_init_ipc_ns(void); + #if defined(CONFIG_IPC_NS) extern struct ipc_namespace *copy_ipcs(unsigned long flags, struct user_namespace *user_ns, struct ipc_namespace *ns); diff --git a/ipc/namespace.c b/ipc/namespace.c index e1fcaedba4fae..328aeffd63e81 100644 --- a/ipc/namespace.c +++ b/ipc/namespace.c @@ -185,6 +185,23 @@ void put_ipc_ns(struct ipc_namespace *ns) schedule_work(&free_ipc_work); } } +EXPORT_SYMBOL(put_ipc_ns); + +struct ipc_namespace *get_ipc_ns_exported(struct ipc_namespace *ns) +{ + return get_ipc_ns(ns); +} +EXPORT_SYMBOL(get_ipc_ns_exported); + +struct ipc_namespace *show_init_ipc_ns(void) +{ +#if defined(CONFIG_IPC_NS) + return &init_ipc_ns; +#else + return NULL; +#endif +} +EXPORT_SYMBOL(show_init_ipc_ns); static inline struct ipc_namespace *to_ipc_ns(struct ns_common *ns) { diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 638c6143fa0d4..f6d8519af24c2 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -7037,6 +7037,7 @@ int can_nice(const struct task_struct *p, const int nice) { return is_nice_reduction(p, nice) || capable(CAP_SYS_NICE); } +EXPORT_SYMBOL(can_nice); #ifdef __ARCH_WANT_SYS_NICE diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c index 9860bb9a847cf..bfba50279d5fb 100644 --- a/kernel/sched/wait.c +++ b/kernel/sched/wait.c @@ -243,6 +243,7 @@ void __wake_up_pollfree(struct wait_queue_head *wq_head) /* POLLFREE must have cleared the queue. */ WARN_ON_ONCE(waitqueue_active(wq_head)); } +EXPORT_SYMBOL(__wake_up_pollfree); /* * Note: we use "set_current_state()" _after_ the wait-queue add, diff --git a/kernel/task_work.c b/kernel/task_work.c index dff75bcde1514..d550463566b49 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -73,6 +73,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work, return 0; } +EXPORT_SYMBOL(task_work_add); /** * task_work_cancel_match - cancel a pending work added by task_work_add() diff --git a/mm/memory.c b/mm/memory.c index d8c5632ae5548..fc0277a4da8cd 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1737,6 +1737,7 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long start, mmu_notifier_invalidate_range_end(&range); tlb_finish_mmu(&tlb); } +EXPORT_SYMBOL(zap_page_range); /** * zap_page_range_single - remove user pages in a given range diff --git a/mm/vmalloc.c b/mm/vmalloc.c index a1ab9b472571c..fccff941bb663 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2499,6 +2499,7 @@ struct vm_struct *get_vm_area(unsigned long size, unsigned long flags) NUMA_NO_NODE, GFP_KERNEL, __builtin_return_address(0)); } +EXPORT_SYMBOL(get_vm_area); struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags, const void *caller) diff --git a/security/security.c b/security/security.c index 8b62654ff3f97..5b2475ca76ebf 100644 --- a/security/security.c +++ b/security/security.c @@ -752,24 +752,28 @@ int security_binder_set_context_mgr(const struct cred *mgr) { return call_int_hook(binder_set_context_mgr, 0, mgr); } +EXPORT_SYMBOL(security_binder_set_context_mgr); int security_binder_transaction(const struct cred *from, const struct cred *to) { return call_int_hook(binder_transaction, 0, from, to); } +EXPORT_SYMBOL(security_binder_transaction); int security_binder_transfer_binder(const struct cred *from, const struct cred *to) { return call_int_hook(binder_transfer_binder, 0, from, to); } +EXPORT_SYMBOL(security_binder_transfer_binder); int security_binder_transfer_file(const struct cred *from, const struct cred *to, struct file *file) { return call_int_hook(binder_transfer_file, 0, from, to, file); } +EXPORT_SYMBOL(security_binder_transfer_file); int security_ptrace_access_check(struct task_struct *child, unsigned int mode) {