connection: fix kdbus_conn_queue_user_quota() again

John was right - the quota accounting for 'user' needs to be done
unconditionally. That is because if we came to that code path for
reallocation, 'user' was not part of the array before and needs to
get its message count bumped.

Reported-by: John de la Garza <john@jjdev.com>
Signed-off-by: Daniel Mack <daniel@zonque.org>
Changelog additions
connection: fix user-quota reallocation

This fixes:

    commit 55f7e88709b7bee6f61651c08b0cbfd21f024365
    Author: Daniel Mack <daniel@zonque.org>
    Date:   Mon Nov 3 20:53:01 2014 +0100

        connection.c: use krealloc() in kdbus_conn_queue_user_quota()

We need to zero out any new memory from krealloc() in case we increase the
buffer. krealloc() doesn't do that by default, so add __GFP_ZERO.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: add cut-off value to quota accounting

Instead of accounting all early messages to the first user exceeding the
quota, we now have a cut-off value. All messages below that value are
never accounted. This means, we no longer incorrectly account messages to
the wrong user. Instead, we allow up to MAX_MSGS_PER_USER of un-accounted
messages before we start accounting. This means, at most twice the amount
of messages can be sent from a single user to another.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: fix off-by-one in quota accounting

We should properly enforce MAX_MSGS_PER_USER, not MAX_MSGS_PER_USER+1.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
queue: pin users while holding their messages

Imagine user A sends a quota-accounted message to B and exits before the
message is retrieved. If user C connects to the bus, it might get the same
user->idr value as A (as it is free now). If C talks to B, it will re-use
the quota-counter of user A, even though it's unrelated.

Fix this by pinning domain_user objects in the message queue. As long as a
message is accounted for in a user-quota, we need to keep the domain_user
object alive.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
test: allow running quota-test as root

Make sure "make stt" runs all tests. If we need to be non-root, lets
actually drop privileges and run as 'nobody'. Otherwise, it gets
cumbersome to always run "make tt" *AND* "make stt".

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
kdbus.h: re-order attached item types (ABI break)

Re-order item types so they match up with KDBUS_ATTACH flags. An
upcoming change in the metadata handling code will benefit from
an easier way of translating them into each other.

Also, clean up the usage of KDBUS_ITEM_NAME. We used to store both
simple strings (in item->str) and name with flags (in item->name)
in such an item, which is confusion. Introduce a new item type called
KDBUS_ITEM_OWNED_NAME to store item->name, and use that exclusively
for this matter. That also allows us to transport the connecion's
currently owned names in struct kdbus_name, and hence we can drop the
name flags from struct kdbus_name_info.

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: rework attach logic

In queue.c, we used to append the entire metadata object to each
message, and ignored the fact that we might attach more data to a
message that the receiving peer has originally requested.

Change that now, and introduce two new functions in metadata.c:

  kdbus_meta_size()
  kdbus_meta_write()

They are both given a mask of attach items, and one will just report
the size that excerpt is about to take, the other will write that
excerpt to a kdbus_pool_slice.

That buys as a number of things:

  a) we don't copy more data to the receiving peer than it requested

  b) we can now implement peer-to-peer matrix specific attach logic,
     and drop items on behalf of the sender or the receiver

  c) it's easier to implement namespace translation logic and just
     translate or drop some specific items per receiver

Signed-off-by: Daniel Mack <daniel@zonque.org>
Makefile: doc: also check kdbus.h

Signed-off-by: Daniel Mack <daniel@zonque.org>
kdbus.txt: follow the recent kdbus_name_info changes

Signed-off-by: Daniel Mack <daniel@zonque.org>
test-message: make sure that the user quota logic is working for all users

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
queue: fix error unwinding code in kdbus_queue_entry_alloc()

Unify jump labels, and fix their call sites.

Signed-off-by: Daniel Mack <daniel@zonque.org>
queue: convert kdbus_queue_entry_alloc() to object-return

Convert kdbus_queue_entry_alloc() to ERR_PTR/PTR_ERR logic.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: clean up kdbus_conn_entry_insert() parameters

To unify the parameter logic and make kdbus_conn_entry_insert()
take conn_src and conn_dst parameters.

Signed-off-by: Daniel Mack <daniel@zonque.org>
queue: add conn_src parameter to kdbus_queue_entry_alloc()

This parameter is unused for now, but it already fixes up the call
sites.

Signed-off-by: Daniel Mack <daniel@zonque.org>
main, bus: fix bogus IS_ERR usage

Oversights that happened during the rework ...

Signed-off-by: Daniel Mack <daniel@zonque.org>
test: fork() before running tests

We dont want to modify the environment for follow-up tests, so fork()
before running each test to guarantee the same environment for each of
them.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
message: force F_SEAL_SEAL on memfds (ABI break)

Lets be strict here and force F_SEAL_SEAL on memfds. Otherwise, new seals
might further lock down memfds in an unexpected way.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
test-connection: make sure that cmd_info always return the cached creds

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>