pool slice: introduce slice->public

When a user calls KDBUS_CMD_MSG_RECV with KDBUS_RECV_PEEK, we return the
offset of a message in the pool and allow the user to call KDBUS_CMD_FREE
on it. That, however, is a problem as the message remains in the pool at
this point, and later, when the user calls KDBUS_CMD_MSG_RECV again, we
access invalid memory.

Fix this by introducing a 'public' flag in a slice, and check for it
when KDBUS_CMD_FREE is called. Only if the slice was flagged public
before, allow the user to free it. Otherwise, return -EINVAL. The flag
is set by normal message delivery, connection info and name listing, but
not of the message was just PEEKed or if the user guesses an offset.

Signed-off-by: Daniel Mack <daniel@zonque.org>
handle: allow KDBUS_NAME_MAX_LEN long names in KDBUS_CMD_NAME_{ACQUIRE,RELEASE}

Now that names are stored in an item for those commands, make sure to allow
for a large enough buffer to be duped so we can actually contain a string
of KDBUS_NAME_MAX_LEN bytes.

Signed-off-by: Daniel Mack <daniel@zonque.org>
handle: clean up max sizes of ioctls

Make KDBUS_MATCH_MAX_SIZE and KDBUS_UPDATE_MAX_SIZE the absolute maximum
size a ioctl in approprate cases can have, and don't add that value to
the base struct operates on.

We'll yet have to tweak those values in the future, and they're larger
now than what we actually expect, so it doesn't matter. But this patch
at least brings the addressed cases in sync with the others in the same
file.

Signed-off-by: Daniel Mack <daniel@zonque.org>
clean up include files

Remove some unneeded include files, and sort all of them alphabetically.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: inline kdbus_check_strlen()

There's only one user left, so we can inline that macro into
kdbus_cmd_conn_info().

Signed-off-by: Daniel Mack <daniel@zonque.org>
pool: don't access slices after they're public

Once a slice is marked public, it can be freed via KDBUS_CMD_FREE. With
sufficiently large slices, flushing all pages can take a significant
amount of time. Therefore, make sure we flush them _before_ marking them
public to prevent races against KDBUS_CMD_FREE.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
pool: fix race when dropping public slices

Two problems right now:
 * kdbus_pool_slice_find() is unlocked..
 * a slice might be freeds between slice_find() and slice_free() by
   another process

Fix this by introducing a generic helper kdbus_pool_release_offset(). This
takes a public offset and frees the underlying slice iff it is public.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
pool: No need for braces around single-line statements

Signed-off-by: Daniel Mack <daniel@zonque.org>
endpoint: make sure EP_UPDATE can clear policies

There is no reason to disallow items_size==0 for EP policy updates. If an
endpoint should not have a single policy, let them achieve that easily.
Note that they could just install a policy for a random name instead, to
achieve no effective policy is set. So allow items_size==0 to avoid hacks
in user-space.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
kdbus: drop KDBUS_ITEM_MEMFD_NAME (ABI BREAK!)

This is unused, drop it. memfds now have native names.

This breaks ABI!

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
item: introduce item.c

Move all item-related helpers into item.[ch].

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
item: add generic item validation

We lack proper item payload checks in a lot of places. To make sure we
don't allow malicious input data in items, add a generic item checker that
verifies items before we work on them.

This is just a first try, more checks will have to be added later. Once
done, we can drop all the redundant checks deep down in our kdbus_cmd_*
handlers.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
rename defaults.h → limits.h

Rename default.h to limits.h, as what it really defines are limits
enforced in various areas of the driver.

Signed-off-by: Daniel Mack <daniel@zonque.org>
item.c: consolidate cases

Consolidate cases with identical code.

Signed-off-by: Daniel Mack <daniel@zonque.org>
tree-wide: remove item checks

As we now have a proper incoming QA check in item.c, we can remove
scattered checks from various places elsewhere.

Signed-off-by: Daniel Mack <daniel@zonque.org>
item.c: move KDBUS_ITEM_VALID to item.c

There are no users left except for item.c, so move the macro there.

Signed-off-by: Daniel Mack <daniel@zonque.org>
item: move message-item validation into item validation

Instead of hard-coding the item validation for messages, merge it with all
the other item validations.

Also, while at it, fix some integer-overflow bugs and remove weird root
overrides.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
test: beautify kdbus_create_bus() a little

Group and unify item style a little.

Signed-off-by: Daniel Mack <daniel@zonque.org>
item: verify strings in NAME_ADD/REMOVE/CHANGE

Make sure strings are properly 0-terminated in NAME_* items. Also adjust
our tests to set size values according to the actual string-length, not
to the buffer size.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Makefile: install kdbus.ko to $(KERNELVER)/kernel/drivers/misc/kdbus/

So you can mix intergration tree builds out-of-tree builds.

Signed-off-by: Daniel Mack <daniel@zonque.org>