tree db97e5742e17e173348c11375425afa33c96c762
parent 504e1d6ee65d5b5a053253ae62f46035d774353c
author Daniel Rosenberg <drosen@google.com> 1643120287 +0000
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1643447758 +0100

ion: Protect kref from userspace manipulation

This separates the kref for ion handles into two components.
Userspace requests through the ioctl will hold at most one
reference to the internally used kref. All additional requests
will increment a separate counter, and the original reference is
only put once that counter hits 0. This protects the kernel from
a poorly behaving userspace.

Signed-off-by: Daniel Rosenberg <drosen@google.com>
[d-cagle@codeaurora.org: Resolve style issues]
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>