diff --git a/sdm/libs/hwc2/hwc_layers.cpp b/sdm/libs/hwc2/hwc_layers.cpp
index ef636b4..a18cb4a 100644
--- a/sdm/libs/hwc2/hwc_layers.cpp
+++ b/sdm/libs/hwc2/hwc_layers.cpp
@@ -43,7 +43,7 @@
     close(release_fences_.front());
     release_fences_.pop();
   }
-
+  close(ion_fd_);
   if (layer_) {
     if (layer_->input_buffer) {
       delete (layer_->input_buffer);
@@ -64,6 +64,16 @@
   }
 
   const private_handle_t *handle = static_cast<const private_handle_t *>(buffer);
+
+  // Validate and dup ion fd from surfaceflinger
+  // This works around bug 30281222
+  if (handle->fd < 0) {
+    return HWC2::Error::BadParameter;
+  } else {
+    close(ion_fd_);
+    ion_fd_ = dup(handle->fd);
+  }
+
   LayerBuffer *layer_buffer = layer_->input_buffer;
   layer_buffer->width = UINT32(handle->width);
   layer_buffer->height = UINT32(handle->height);
@@ -83,7 +93,7 @@
     layer_buffer->flags.secure_display = true;
   }
 
-  layer_buffer->planes[0].fd = handle->fd;
+  layer_buffer->planes[0].fd = ion_fd_;
   layer_buffer->planes[0].offset = handle->offset;
   layer_buffer->planes[0].stride = UINT32(handle->width);
   layer_buffer->acquire_fence_fd = acquire_fence;
diff --git a/sdm/libs/hwc2/hwc_layers.h b/sdm/libs/hwc2/hwc_layers.h
index b3314c9..ed93a5a 100644
--- a/sdm/libs/hwc2/hwc_layers.h
+++ b/sdm/libs/hwc2/hwc_layers.h
@@ -86,6 +86,7 @@
   const hwc2_display_t display_id_;
   static std::atomic<hwc2_layer_t> next_id_;
   std::queue<int32_t> release_fences_;
+  int ion_fd_ = -1;
 
   // Composition requested by client(SF)
   HWC2::Composition client_requested_ = HWC2::Composition::Device;