connection: fix cpu stall by checking kdbus item alignment

Fix the following stall triggered by a policy holder hello:
call test/kdbus-util.c:kdbus_hello_registrar() and pass
KDBUS_HELLO_POLICY_HOLDER as a flag.

While we are it make sure that kdbus_cmd_conn_update() also checks for
proper 8 byte alignment.

[  142.731011] INFO: rcu_sched self-detected stall on CPU { 3}  (t=65000 jiffies g=3085 c=3084 q=4316)
[  142.731011] sending NMI to all CPUs:
[  142.731011] NMI backtrace for cpu 3
[  142.731011] CPU: 3 PID: 1352 Comm: test-kdbus-poli Tainted: G OE 3.15.0-0.rc8.git4.1.fc21.x86_64 #1
[  142.731011] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  142.731011] task: ffff88005a2719d0 ti: ffff88004587c000 task.ti: ffff88004587c000
[  142.731011] RIP: 0010:[<ffffffff81055a12>]  [<ffffffff81055a12>] flat_send_IPI_all+0x92/0xd0
[  142.731011] RSP: 0018:ffff88005dc03dc0  EFLAGS: 00010006
[  142.731011] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
[  142.731011] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: 0000000000000300
[  142.731011] RBP: ffff88005dc03dd8 R08: 0000000000000001 R09: 0000000000000001
[  142.731011] R10: ffffffff81e5d720 R11: 0000000000000001 R12: 0000000000000046
[  142.731011] R13: 000000000000000f R14: ffffffff81e86880 R15: 0000000000000003
[  142.731011] FS:  00007f4b9d727740(0000) GS:ffff88005dc00000(0000) knlGS:0000000000000000
[  142.731011] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  142.731011] CR2: 0000000000401312 CR3: 000000005b66f000 CR4: 00000000000006e0
[  142.731011] Stack:
[  142.731011]  0000000000002710 ffffffff81e86880 ffffffff81fa3e40 ffff88005dc03df0
[  142.731011]  ffffffff81050654 ffff88005ddcf000 ffff88005dc03e48 ffffffff8111a194
[  142.731011]  0000000000000000 7fffffffffffffff 0000000000000046 00000000000010dc
[  142.731011] Call Trace:
[  142.731011]  <IRQ>

[  142.731011]  [<ffffffff81050654>] arch_trigger_all_cpu_backtrace+0x64/0xa0
[  142.731011]  [<ffffffff8111a194>] rcu_check_callbacks+0x584/0x850
[  142.731011]  [<ffffffff810a74a7>] update_process_times+0x47/0x70
[  142.731011]  [<ffffffff81126765>] tick_sched_handle.isra.19+0x25/0x60
[  142.731011]  [<ffffffff81127061>] tick_sched_timer+0x41/0x60
[  142.731011]  [<ffffffff810c7446>] __run_hrtimer+0x86/0x460
[  142.731011]  [<ffffffff81127020>] ? tick_sched_do_timer+0x40/0x40
[  142.731011]  [<ffffffff810c809f>] hrtimer_interrupt+0x10f/0x260
[  142.731011]  [<ffffffff8104e55a>] local_apic_timer_interrupt+0x3a/0x60
[  142.731011]  [<ffffffff8180089f>] smp_apic_timer_interrupt+0x3f/0x50
[  142.731011]  [<ffffffff817ff1f2>] apic_timer_interrupt+0x72/0x80
[  142.731011]  <EOI>

[  142.731011]  [<ffffffff817f42b3>] ? retint_restore_args+0x13/0x13
[  142.731011]  [<ffffffffa02a666b>] ? kdbus_conn_new+0x25b/0xf20 [kdbus]
[  142.731011]  [<ffffffffa02a6741>] ? kdbus_conn_new+0x331/0xf20 [kdbus]
[  142.731011]  [<ffffffffa02a8161>] kdbus_handle_ioctl+0x221/0xad0 [kdbus]
[  142.731011]  [<ffffffff81361a31>] ? inode_has_perm.isra.47+0x51/0x90
[  142.731011]  [<ffffffff81251f60>] do_vfs_ioctl+0x2f0/0x520
[  142.731011]  [<ffffffff81252211>] SyS_ioctl+0x81/0xa0
[  142.731011]  [<ffffffff817fe4e9>] system_call_fastpath+0x16/0x1b

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
kdbus-test: fix kdbus item alignment in kdbus_hello_registrar()

Currently running the test-kdbus-activator test will fail with -EINVAL

To fix this, remove the redundant offsetof() macros since it is already
handled. The KDBUS_ITEM_SIZE() will expand into KDBUS_ITEM_HEADER_SIZE()
which expands into an offsetof() one.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
util.h: KDBUS_ITEM_VALID fixed

Missing character leading to wrong variable name restored.

Signed-off-by: Jacek Janczyk <j.janczyk@samsung.com>
util.h: KDBUS_ITEM_VALID - fix size check
policy: pass items, not &items
ease installation on non-running kernels

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
connection: update attach_flags only if KDBUS_ITEM_ATTACH_FLAGS is provided

Fix a bug introcuded in commit d92d68414fab which fixed another bug.

conn->attach_flags should only be update if KDBUS_ITEM_ATTACH_FLAGS was
provided.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
policy: kdbus_policy_set() make sure we restore the right entries

If kdbus_policy_set() fails we try to restore the entries that were
previously saved in a list, however due to a typo that logic was trying
to access a previously freed entry which will just break things...
So fix the typo 'l->e' instead of 'e'.

This fixes a bug triggered by test-kdbus-policy and makes the code able
to restore previously saved entries in case of errors.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
policy: kdbus_policy_set() fix a use after free bug

If we try to register the same name twice then kdbus_policy_add_one()
will fail with -EEXIST

In kdbus_policy_set() we have two calls to kdbus_policy_add_one() if
they fail we clean things up with kdbus_policy_entry_free(), but since
we failed ret == -EEXIST ,we hit the error path where we have another:

if (e)
	kdbus_policy_entry_free(e);

We have a use after free bug here, Since 'e' is freed but never set to
NULL.

To fix this we can set that 'e' to NULL after each
kdbus_policy_entry_free() call, but it is better to just clean things up
in a one place, in the error path and remove the other
kdbus_policy_entry_free() calls.

Thix fixes the bug triggered by test-kdbus-policy when we try to
register the same name twice.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
policy: kdbus_policy_check_own_access() returns 0 on success not true

kdbus_policy_check_own_access() returns 0 if access is granted,
otherwise a negative errno.

So fix this by returning 0. We did not hit this since callers were
checking negative values for errors.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: when freeing a connection purge its cached entries

When freeing a connection remove also all the cached entries related
to this connection, otherwise if we access this cached entry through
another valid connection, we will hit memory corruption bugs.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: export kdbus_hello_registrar()

Export this function since we will use it to register policy holders
connections.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: make msg_send() return -errno

Make msg_send() return negative errno not EXIT_FAILURE. We need this
since we will add tests that fork() and drop privileges and we want all
the error codes, especially -EPERM.

After a quick grep it seems the return value of msg_send() is never
used, so it is safe to convert it, this wont break any test.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: add simple helper to drop privileges

This is needed since we will add tests to fork() + drop privileges

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: add conn_update() to test KDBUS_CMD_CONN_UPDATE

Add conn_update() to perform KDBUS_CMD_CONN_UPDATE ioctl() calls.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: add the test-kdbus-policy test

Add the test-kdbus-policy that performs:

1) Register a policy holder
2) Try to register the same name as an activator:
   kdbus will break here due to a corrupted db->entries_hash
   in kdbus_policy_set().
   Will be fixed in the next patches.
3) Acquire the name for the policy holder
4) Create and test the connections
5) Fork and drop privileges, then create and test connections which
   should be cached in the send cache after the tests.

   Here we inspect the send cache and we have located several bugs,
   which will be fixed in the next patches.

6) Call kdbus_set_policy_talk() to test KDBUS_CMD_CONN_UPDATE ioctl
   and restrict TALK access to KDBUS_POLICY_ACCESS_USER

7) Redo test 5), now connections should all fail with -EPERM since
   TALK access was restricted.

To test this we need the right capabilities to perform the setuid() and
drop privileges, so this test just check if it was exec by root.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
policy: use the db->entries_hash to access the policy db entries

Use the db->entries_hash to access the policy db entries instead of the
db->send_access_hash which is just a cache for send entries.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
policy: kdbus_policy_set() use another variable to save entries

In kdbus_policy_set() function, we use the 'e' variable to reference
each entry of the 'db->entries_hash', so at the end the variable 'e' will
for sure point to a valid one.

Next in the KDBUS_ITEMS_FOREACH() iterator and if we fail at the first
KDBUS_ITEM_VALID() test, we jmp to exit:

Which contains the following:
if (e)
	kdbus_policy_entry_free(e);

Here 'e' points to a valid entry and it will be freed, so even we
restore all the other entries from that list, there will be always one
missing, the last one pointed by that 'e' variable.

To fix this, just use another 'tmp_entry' variable to reference hash
entries.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>