tree 3ebcb75605f846336acf14b0e038209624a03fa6
parent 0682eaefc21999ef7ba37bd96e9323879e55d9be
author Daniel Rosenberg <drosen@google.com> 1478133831 -0700
committer Ben Fennema <fennema@google.com> 1503696786 -0700

ion: Fix use after free during ION_IOC_ALLOC

If a user happens to call ION_IOC_FREE during an
ION_IOC_ALLOC on the just allocated id, and the
copy_to_user fails, the cleanup code will attempt
to free an already freed handle.

This adds a wrapper for ion_alloc that adds an
ion_handle_get to avoid this.

Bug: 31568617
Bug: 32987001
Change-Id: I476e5bd5372b5178a213f1fea143d270cf9361ed
Signed-off-by: Daniel Rosenberg <drosen@google.com>