github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/linux/dev_binderfs.txt (about)

     1  # Copyright 2021 syzkaller project authors. All rights reserved.
     2  # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
     3  
     4  include <linux/fcntl.h>
     5  include <linux/unistd.h>
     6  include <linux/android/binderfs.h>
     7  
     8  # ./binderfs will be mounted by syz-executor, but let's also see how a single process
     9  # operates with multiple ones.
    10  binderfs_mountpoint = "./binderfs", "./binderfs2"
    11  
    12  # Control paths.
    13  binderfs_ctrlpath = "./binderfs/binder-control", "./binderfs2/binder-control"
    14  
    15  # Device names.
    16  binderfs_devname = "binder0", "binder1", "custom0", "custom1"
    17  
    18  # Unfortunately, syzlang does not currently favor string concatenation for open (and related) syscalls. So we concatenate it manually.
    19  binderfs_devpath = "./binderfs/binder0", "./binderfs/binder1", "./binderfs/custom0", "./binderfs/custom1", "./binderfs2/binder0", "./binderfs2/binder1", "./binderfs2/custom0", "./binderfs2/custom1"
    20  
    21  mkdirat$binderfs(fd const[AT_FDCWD], path ptr[in, string[binderfs_mountpoint]], mode const[0x1ff])
    22  mount$binderfs(src ptr[in, string["binder"]], dst ptr[in, string[binderfs_mountpoint]], type ptr[in, string["binder"]], flags flags[mount_flags], opts ptr[in, fs_options[binderfs_options]])
    23  unlinkat$binderfs_device(fd const[AT_FDCWD], path ptr[in, string[binderfs_devpath]])
    24  
    25  binderfs_options [
    26  	max	fs_opt_oct["max", int32]
    27  	stats	stringnoz["stats=global"]
    28  ] [varlen]
    29  
    30  define BINDERFS_NAME_LEN	BINDERFS_MAX_NAME + 1
    31  
    32  binderfs_device {
    33  	name	string[binderfs_devname, BINDERFS_NAME_LEN]	(in)
    34  	major	int32	(out)
    35  	minor	int32	(out)
    36  }
    37  
    38  resource fd_binderfs_ctrl[fd]
    39  openat$binderfs_ctrl(fd const[AT_FDCWD], file ptr[in, string[binderfs_ctrlpath]], flags flags[binder_open_flags], mode const[0]) fd_binderfs_ctrl
    40  ioctl$BINDER_CTL_ADD(fd fd_binderfs_ctrl, cmd const[BINDER_CTL_ADD], arg ptr[inout, binderfs_device])