base: safeguard entrypoint against double manage

This patch adds sanity checks to the RPC entrypoint that detect attempts
to manage or dissolve the same RPC object twice. This is not always a
bug. I.e., if RPC objects are implemented in the modern way where the
object manages/dissolves itself. As the generic framework code (in
particular root/component.h) cannot rely on this pattern, it has to
call manage/dissolve for session objects anyway. For modern session
objects, this double attempt would result in a serious error (double
insertion into the object pool's AVL tree).

Issue #2398

repos/base/src/lib/base/rpc_dispatch_loop.cc

@@ -27,6 +27,12 @@ using namespace Genode;
 
 Untyped_capability Rpc_entrypoint::_manage(Rpc_object_base *obj)
 {
+	/* don't manage RPC object twice */
+	if (obj->cap().valid()) {
+		warning("attempt to manage RPC object twice");
+		return obj->cap();
+	}
+
 	Untyped_capability new_obj_cap = _alloc_rpc_cap(_pd_session, _cap);
 
 	/* add server object to object pool */

repos/base/src/lib/base/rpc_entrypoint.cc

@@ -26,6 +26,10 @@ using namespace Genode;
 
 void Rpc_entrypoint::_dissolve(Rpc_object_base *obj)
 {
+	/* don't dissolve RPC object twice */
+	if (!obj->cap().valid())
+		return;
+
 	/* make sure nobody is able to find this object */
 	remove(obj);