Android Binder Use-After-Free

Android Binder Use-After-Free
Android suffer from a binder use-after-free via a racy initialization of ->allow_user_free.