kdbus.txt: grammer fixes from Peter Meerwald
kdbus.h: rename KDBUS_{ITEM,ATTACH}_CONN_NAME → KDBUS_{ITEM,ATTACH}_CONN_DESCRIPTION

To not overload the term 'name' too much, rename the attach flag and
the item type to 'DESCRIPTION'.

Signed-off-by: Daniel Mack <daniel@zonque.org>
Add Changelog as template for next cover letter

Signed-off-by: Daniel Mack <daniel@zonque.org>
domain: fix kref race condition around domain_user objects

domain_user currently suffers from a race condition bug:

CPU0				CPU1
-----------------------------   -----------------------------
kdbus_domain_user_unref()
  [u->kref->refcount == 1]
  kref_put()
    [u->kref->refcount == 0]
    __kdbus_domain_user_free()
				mutex_lock(...)
				kdbus_domain_get_user()
				  kdbus_domain_get_user_unlocked()
				    [→ u->kref->refcount == 0]
				    kref_get()
				      [→ u->kref->refcount == 1]
				mutex_unlock(...)
    mutex_lock(...)
    ...
    mutex_unlock(...)
    kfree(u)

Fix this by never acquiring a ref to a user-object with ref-count 0.
Instead, ignore any such objects as they're guaranteed to be removed in
parallel by another task.

As a side-effect, we can now have multiple user-objects in the hashtable
with the same uid. However, all but one must have a ref-count of 0 and
don't carry any useful information. Therefore, we can safely ignore those.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
tree-wide: convert more code to direct object return logic

Follow the logic of returning newly allocated or looked up objects
directly, rather than through a function argument.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: rename kdbus_conn_is_connected() to kdbus_conn_is_ordinary()

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
handle: avoid magic numbers for max-minor index

Instead of using magic 0xfffff directly, define a constant as
KDBUS_MINOR_MAX that explains this magic number.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
handle: make sure to never allocate minors above KDBUS_MINOR_MAX

It's not the register_chrdev() call that limits our minors, but the
idr_alloc() call. Make sure to limit it to KDBUS_MINOR_MAX so we never
allocate minors higher than that.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
pool.h: cosmetics

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: fix KDBUS_CONN_MAX_MSGS_PER_USER accounting

The user who caused msg_users array to be created has thereby
automatically exceeded its quote. Mark it as such.

Reported-by: John de la Garza <john@jjdev.com>
Signed-off-by: Daniel Mack <daniel@zonque.org>
test-message: add message quota test

Signed-off-by: John de la Garza <john@jjdev.com>
test: add more tests for KDBUS_CMD_CONN_INFO ioctl

We still have to add privileged -> unprivileged KDBUS_CMD_CONN_INFO
ioctl calls.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection.c: use krealloc() in kdbus_conn_queue_user_quota()

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: fix kdbus_conn_queue_user_quota() again

John was right - the quota accounting for 'user' needs to be done
unconditionally. That is because if we came to that code path for
reallocation, 'user' was not part of the array before and needs to
get its message count bumped.

Reported-by: John de la Garza <john@jjdev.com>
Signed-off-by: Daniel Mack <daniel@zonque.org>
Changelog additions
connection: fix user-quota reallocation

This fixes:

    commit 55f7e88709b7bee6f61651c08b0cbfd21f024365
    Author: Daniel Mack <daniel@zonque.org>
    Date:   Mon Nov 3 20:53:01 2014 +0100

        connection.c: use krealloc() in kdbus_conn_queue_user_quota()

We need to zero out any new memory from krealloc() in case we increase the
buffer. krealloc() doesn't do that by default, so add __GFP_ZERO.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: add cut-off value to quota accounting

Instead of accounting all early messages to the first user exceeding the
quota, we now have a cut-off value. All messages below that value are
never accounted. This means, we no longer incorrectly account messages to
the wrong user. Instead, we allow up to MAX_MSGS_PER_USER of un-accounted
messages before we start accounting. This means, at most twice the amount
of messages can be sent from a single user to another.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: fix off-by-one in quota accounting

We should properly enforce MAX_MSGS_PER_USER, not MAX_MSGS_PER_USER+1.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
queue: pin users while holding their messages

Imagine user A sends a quota-accounted message to B and exits before the
message is retrieved. If user C connects to the bus, it might get the same
user->idr value as A (as it is free now). If C talks to B, it will re-use
the quota-counter of user A, even though it's unrelated.

Fix this by pinning domain_user objects in the message queue. As long as a
message is accounted for in a user-quota, we need to keep the domain_user
object alive.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
test: allow running quota-test as root

Make sure "make stt" runs all tests. If we need to be non-root, lets
actually drop privileges and run as 'nobody'. Otherwise, it gets
cumbersome to always run "make tt" *AND* "make stt".

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>