domain: fix kref race condition around domain_user objects

domain_user currently suffers from a race condition bug:

CPU0				CPU1
-----------------------------   -----------------------------
kdbus_domain_user_unref()
  [u->kref->refcount == 1]
  kref_put()
    [u->kref->refcount == 0]
    __kdbus_domain_user_free()
				mutex_lock(...)
				kdbus_domain_get_user()
				  kdbus_domain_get_user_unlocked()
				    [→ u->kref->refcount == 0]
				    kref_get()
				      [→ u->kref->refcount == 1]
				mutex_unlock(...)
    mutex_lock(...)
    ...
    mutex_unlock(...)
    kfree(u)

Fix this by never acquiring a ref to a user-object with ref-count 0.
Instead, ignore any such objects as they're guaranteed to be removed in
parallel by another task.

As a side-effect, we can now have multiple user-objects in the hashtable
with the same uid. However, all but one must have a ref-count of 0 and
don't carry any useful information. Therefore, we can safely ignore those.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
tree-wide: convert more code to direct object return logic

Follow the logic of returning newly allocated or looked up objects
directly, rather than through a function argument.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: rename kdbus_conn_is_connected() to kdbus_conn_is_ordinary()

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
handle: avoid magic numbers for max-minor index

Instead of using magic 0xfffff directly, define a constant as
KDBUS_MINOR_MAX that explains this magic number.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
handle: make sure to never allocate minors above KDBUS_MINOR_MAX

It's not the register_chrdev() call that limits our minors, but the
idr_alloc() call. Make sure to limit it to KDBUS_MINOR_MAX so we never
allocate minors higher than that.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
pool.h: cosmetics

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: fix KDBUS_CONN_MAX_MSGS_PER_USER accounting

The user who caused msg_users array to be created has thereby
automatically exceeded its quote. Mark it as such.

Reported-by: John de la Garza <john@jjdev.com>
Signed-off-by: Daniel Mack <daniel@zonque.org>
test-message: add message quota test

Signed-off-by: John de la Garza <john@jjdev.com>