tree 502e68d555b5d8c6ed827e9acd46dd08b240effe
parent ebe8f069cb56ca7fd8610c3d72e4b02ac07b0ea5
author Nick Desaulniers <ndesaulniers@google.com> 1486752896 -0800
committer John Dias <joaodias@google.com> 1487192024 +0000

ANDROID: ion: Protect kref from userspace manipulation

This separates the kref for ion handles into two components.
Userspace requests through the ioctl will hold at most one
reference to the internally used kref. All additional requests
will increment a separate counter, and the original reference is
only put once that counter hits 0. This protects the kernel from
a poorly behaving userspace.

Bug: 34276203

Change-Id: Ibc36bc4405788ed0fea7337b541cad3be2b934c0
Signed-off-by: Daniel Rosenberg <drosen@google.com>