ion: replace userspace handle cookies with idr

Userspace handles should not leak kernel virtual addresses to
userspace.  They have to be validated by looking them up in an
rbtree anyways, so replace them with an idr and validate them
by using idr_find to convert the id number to the struct
ion_handle pointer.

Change-Id: Iab5667ba6f3a73256fec3949b23a9a6f8e14a283
Signed-off-by: Colin Cross <ccross@android.com>
ion: index client->handles rbtree by buffer

The only remaining users of the client->handles rbtree are
iterating through it like a list.  Keep the rbtree, but change
its index to be the buffer address instead of the handle address,
which makes ion_handle_lookup a fast rbtree search.

Change-Id: Ie7d974b3a5d9831c0d664de85ddae8db3c3abdf9
Signed-off-by: Colin Cross <ccross@android.com>
ion: don't use id 0 for handle cookie

ion userspace clients think that the cookie is a pointer, so they
use NULL to check if the handle has been initialized.  Set the first
id number to 1.

Change-Id: Ifb9af6029a8b08f57e41bc6160cc11e11001a2a9
Signed-off-by: Colin Cross <ccross@android.com>
ion: hold reference to handle after ion_uhandle_get

commit 1262ab1846cf76f7549c66ef709120dbfbe6d49f (ion: replace
userspace handle cookies with idr) broke the locking in ion.
The ION_IOC_FREE and ION_IOC_MAP ioctls were relying on
ion_handle_validate to detect the case where a call raced
with another ION_IOC_FREE which may have freed the struct
ion_handle.

Rename ion_uhandle_get to ion_handle_get_by_id, and have it
take the client lock and return with an extra reference to
the handle.  Make each caller put its reference once it
is done with the handle.

Also modify users of ion_handle_validate to continue to hold
the client lock after calling ion_handle_validate until
they are done with the handle, and warn if ion_handle_validate
is called without the client lock held.

Change-Id: I56da5624fca3bed4ee24806b6ec39de903543341
Signed-off-by: Colin Cross <ccross@android.com>
ion: fix ERR_PTR return

ERR_PTR takes -errno, not errno.

Change-Id: I0f09fc419619df859023fb63ac7def67ae237951
Signed-off-by: Colin Cross <ccross@android.com>