Shivakumar Malke
e687fa9aa3
Due to race condition, fd pointing to a particular dma buf is released by userspace before incrementing ref count and hence freed that dma buf. When the call returns it still uses the freed dma buf causing use-after-free. This fix includes get_file API to increment ref count before dma_buf_fd. CRs-Fixed: 3341070 Change-Id: I8ebc37b4ceb5f8691bbbb3d26b8b64878d832fbe Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>