binderfs: prevent renaming the control dentry

This change “binderfs: prevent renaming the control dentry” in Linux kernel is authored by Christian Brauner <christian [at]> on Mon Jan 21 11:48:03 2019 +0100.

binderfs: prevent renaming the control dentry

- make binderfs control dentry immutable:
  We don't allow to unlink it since it is crucial for binderfs to be
  useable but if we allow to rename it we make the unlink trivial to
  bypass. So prevent renaming too and simply treat the control dentry as

- add is_binderfs_control_device() helper:
  Take the opportunity and turn the check for the control dentry into a
  separate helper is_binderfs_control_device() since it's now used in two

- simplify binderfs_rename():
  Instead of hand-rolling our custom version of simple_rename() just dumb
  the whole function down to first check whether we're trying to rename the
  control dentry. If we do EPERM the caller and if not call simple_rename().

Suggested-by: Al Viro <>
Signed-off-by: Christian Brauner <>
Signed-off-by: Greg Kroah-Hartman <>

This Linux change may have been applied to various maintained Linux releases and you can find Linux releases including commit e98e6fa.

There are 28 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/android/binderfs.c | 28 ++++++++++------------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 898d847..e73f9db 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -346,34 +346,26 @@ static int binderfs_show_mount_opts(struct seq_file *seq, struct dentry *root)
 	.statfs         = simple_statfs,
+static inline bool is_binderfs_control_device(const struct dentry *dentry)
+	struct binderfs_info *info = dentry->d_sb->s_fs_info;
+	return info->control_dentry == dentry;
 static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 			   struct inode *new_dir, struct dentry *new_dentry,
 			   unsigned int flags)
-	struct inode *inode = d_inode(old_dentry);
-	/* binderfs doesn't support directories. */
-	if (d_is_dir(old_dentry))
+	if (is_binderfs_control_device(old_dentry) ||
+	    is_binderfs_control_device(new_dentry))
 		return -EPERM;
-	if (flags & ~RENAME_NOREPLACE)
-		return -EINVAL;
-	if (!simple_empty(new_dentry))
-		return -ENOTEMPTY;
-	if (d_really_is_positive(new_dentry))
-		simple_unlink(new_dir, new_dentry);
-	old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
-		new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
-	return 0;
+	return simple_rename(old_dir, old_dentry, new_dir, new_dentry, flags);
 static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
-	if (BINDERFS_I(dir)->control_dentry == dentry)
+	if (is_binderfs_control_device(dentry))
 		return -EPERM;
 	return simple_unlink(dir, dentry);

The commit for this change in Linux stable tree is e98e6fa (patch).

Leave a Reply

Your email address will not be published. Required fields are marked *