ion: Fix use after free during ION_IOC_ALLOC

If a user happens to call ION_IOC_FREE during an ION_IOC_ALLOC
on the just allocated id, and the copy_to_user fails, the cleanup
code will attempt to free an already freed handle.

This adds a wrapper for ion_alloc that adds an ion_handle_get to
avoid this.

Signed-off-by: Daniel Rosenberg <>
Signed-off-by: Dennis Cagle <>
Signed-off-by: Patrick Daly <>
Signed-off-by: Lee Jones <>
Signed-off-by: Greg Kroah-Hartman <>
3 files changed