Security patches

Signed-off-by: Mister Oyster <oysterized@gmail.com>

13 files changed, 117 insertions, 92 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a1389642b..1a921b0a2 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2068,7 +2068,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
 
 
 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-					 uint32_t desc)
+					uint32_t desc, bool need_strong_ref)
 {
 	struct rb_node *n = proc->refs_by_desc.rb_node;
 	struct binder_ref *ref;
@@ -2076,16 +2076,21 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
 	while (n) {
 		ref = rb_entry(n, struct binder_ref, rb_node_desc);
 
-		if (desc < ref->desc)
+		if (desc < ref->desc) {
 			n = n->rb_left;
-		else if (desc > ref->desc)
+		} else if (desc > ref->desc) {
 			n = n->rb_right;
-		else
+		} else if (need_strong_ref && !ref->strong) {
+			binder_user_error("tried to use weak ref as strong ref\n");
+			return NULL;
+		} else {
 			return ref;
+		}
 	}
 	return NULL;
 }
 
+
 static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
 						  struct binder_node *node)
 {
@@ -2350,7 +2355,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 		} break;
 		case BINDER_TYPE_HANDLE:
 		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+			struct binder_ref *ref = binder_get_ref(proc, fp->handle,
+					fp->type == BINDER_TYPE_HANDLE);
 			if (ref == NULL) {
 				pr_err("transaction release %d bad handle %d\n",
 				 debug_id, fp->handle);
@@ -2566,7 +2572,7 @@ static void binder_transaction(struct binder_proc *proc,
 	} else {
 		if (tr->target.handle) {
 			struct binder_ref *ref;
-			ref = binder_get_ref(proc, tr->target.handle);
+			ref = binder_get_ref(proc, tr->target.handle, true);
 			if (ref == NULL) {
 				binder_user_error("%d:%d got transaction to invalid handle\n",
 					proc->pid, thread->pid);
@@ -2926,7 +2932,8 @@ out_err:
 		} break;
 		case BINDER_TYPE_HANDLE:
 		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+			struct binder_ref *ref = binder_get_ref(proc, fp->handle,
+							fp->type == BINDER_TYPE_HANDLE);
 			if (ref == NULL) {
 				binder_user_error("%d:%d got transaction with invalid handle, %d\n",
 						proc->pid,
@@ -3212,7 +3219,9 @@ static int binder_thread_write(struct binder_proc *proc, struct binder_thread *t
 						ref->desc);
 				}
 			} else
-				ref = binder_get_ref(proc, target);
+				ref = binder_get_ref(proc, target,
+						cmd == BC_ACQUIRE ||
+						cmd == BC_RELEASE);
 			if (ref == NULL) {
 				binder_user_error("%d:%d refcount change on invalid ref %d\n",
 					proc->pid, thread->pid, target);
@@ -3421,7 +3430,7 @@ static int binder_thread_write(struct binder_proc *proc, struct binder_thread *t
 			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
 				return -EFAULT;
 			ptr += sizeof(binder_uintptr_t);
-			ref = binder_get_ref(proc, target);
+			ref = binder_get_ref(proc, target, false);
 			if (ref == NULL) {
 				binder_user_error("%d:%d %s invalid ref %d\n",
 					proc->pid, thread->pid,
@@ -4489,7 +4498,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 #ifdef CONFIG_CPU_CACHE_VIPT
 	if (cache_is_vipt_aliasing()) {
 		while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {
-			pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
+			pr_info("binder_mmap: %d %lx-%lx maps %pK bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
 			vma->vm_start += PAGE_SIZE;
 		}
 	}
@@ -4521,7 +4530,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 	proc->vma = vma;
 	proc->vma_vm_mm = vma->vm_mm;
 
-	/*pr_info("binder_mmap: %d %lx-%lx maps %p\n",
+	/*pr_info("binder_mmap: %d %lx-%lx maps %pK\n",
 		 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
 	return 0;
 
@@ -4805,7 +4814,7 @@ static void binder_deferred_release(struct binder_proc *proc)
 
 			page_addr = proc->buffer + i * PAGE_SIZE;
 			binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-				     "%s: %d: page %d at %p not freed\n",
+				     "%s: %d: page %d at %pK not freed\n",
 				     __func__, proc->pid, i, page_addr);
 			unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
 			__free_page(proc->pages[i]);
@@ -4906,7 +4915,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
 	rtc_time_to_tm(t->tv.tv_sec, &tm);
 #endif
 	seq_printf(m,
-		   "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
 		   prefix, t->debug_id, t,
 		   t->from ? t->from->proc->pid : 0,
 		   t->from ? t->from->pid : 0,
@@ -4931,7 +4940,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
 		seq_printf(m, " node %d",
 			   t->buffer->target_node->debug_id);
 #ifdef BINDER_MONITOR
-	seq_printf(m, " size %zd:%zd data %p auf %d start %lu.%06lu"
+	seq_printf(m, " size %zd:%zd data %pK auf %d start %lu.%06lu"
 		   " android %d-%02d-%02d %02d:%02d:%02d.%03lu\n",
 		   t->buffer->data_size, t->buffer->offsets_size,
 		   t->buffer->data, t->buffer->allow_user_free,
@@ -4941,7 +4950,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
 		   tm.tm_hour, tm.tm_min, tm.tm_sec,
 		   (unsigned long)(t->tv.tv_usec / USEC_PER_MSEC));
 #else
-	seq_printf(m, " size %zd:%zd data %p\n",
+	seq_printf(m, " size %zd:%zd data %pK\n",
 		   t->buffer->data_size, t->buffer->offsets_size,
 		   t->buffer->data);
 #endif
diff --git a/drivers/misc/mediatek/power/mt6735/ncp1854.c b/drivers/misc/mediatek/power/mt6735/ncp1854.c
index 5956feebe..333e8609c 100644
--- a/drivers/misc/mediatek/power/mt6735/ncp1854.c
+++ b/drivers/misc/mediatek/power/mt6735/ncp1854.c
@@ -689,6 +689,9 @@ static int __init ncp1854_init(void)
 
 static void __exit ncp1854_exit(void)
 {
+    if (new_client != NULL)
+        kfree(new_client);
+
     i2c_del_driver(&ncp1854_driver);
 }
 
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
index 418bf63d8..b27329601 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amddulthro.c
@@ -553,6 +553,8 @@ ssize_t amddulthro_pid_write(struct file *file, const char __user *buf, size_t l
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
index 4bf8f6aad..4f7b628a7 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_amdtxctrl.c
@@ -541,6 +541,8 @@ ssize_t amdtxctrl_pid_write( struct file *filp, const char __user *buf, unsigned
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
index 62734a885..487abdaf6 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_bcct.c
@@ -320,6 +320,8 @@ static ssize_t _cl_bcct_write(struct file *filp, const char __user *buf, size_t
 	char tmp[128] = {0};
 	int klog_on, limit0, limit1, limit2;
 
+	len = (len < (128 - 1)) ? len : (128 - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
index 5b45933d3..fbfe3d9a3 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_cooler_mdulthro.c
@@ -773,6 +773,8 @@ ssize_t mdulthro_pid_write( struct file *filp, const char __user *buf, unsigned
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
index 2997a5446..bc9f20a5b 100644
--- a/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
+++ b/drivers/misc/mediatek/thermal/mt6735/mtk_ts_wmt.c
@@ -891,9 +891,6 @@ ssize_t wmt_wifi_algo_write(struct file *filp, const char __user *buf, size_t le
 
 	len = (len < (sizeof(desc) - 1)) ? len : (sizeof(desc) - 1);
 
-	if (len >= MAX_LEN-1)
-		len = MAX_LEN-1;
-
 	/* write data to the buffer */
 	if (copy_from_user(desc, buf, len)) {
 		return -EFAULT;
@@ -1008,6 +1005,8 @@ ssize_t wmt_tm_pid_write(struct file *filp, const char __user *buf, size_t len,
 	int ret = 0;
 	char tmp[MAX_LEN] = {0};
 
+	len = (len < (MAX_LEN - 1)) ? len : (MAX_LEN - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mt6735/tm_nth.c b/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
index 72e55d701..d9fa1e3a9 100644
--- a/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
+++ b/drivers/misc/mediatek/thermal/mt6735/tm_nth.c
@@ -193,6 +193,8 @@ static ssize_t _cl_tm_nth_write(struct file *filp, const char __user *buf, size_
 	int tmp_NTHNTHTHRESENTER, tmp_NTHNTHTHRESEXIT, tmp_CPULOADSMASAMPLECNT, tmp_TGTTEMP, tmp_KPINIT, tmp_KIINIT, tmp_KDINIT, tmp_NTHPOLLINGINTERVAL;
 	int tmp_CPU_POWER_LIMIT0, tmp_CPU_POWER_LIMIT1, tmp_CPU_POWER_LIMIT2, tmp_CPU_POWER_LIMIT3, tmp_CPU_POWER_LIMIT4, tmp_CPU_POWER_LIMIT5, tmp_CPU_POWER_LIMIT6;
 
+	len = (len < (sizeof(tmp) - 1)) ? len : (sizeof(tmp) - 1);
+
 	/* write data to the buffer */
 	if ( copy_from_user(tmp, buf, len) ) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
index dc5fe0a0e..0a3a474a8 100644
--- a/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
+++ b/drivers/misc/mediatek/thermal/mtk_cooler_shutdown.c
@@ -121,6 +121,8 @@ static ssize_t _mtk_cl_sd_pid_write(struct file *filp, const char __user *buf, s
 	int ret = 0;
 	char tmp[MAX_LEN] = { 0 };
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if (copy_from_user(tmp, buf, len)) {
 		return -EFAULT;
@@ -166,6 +168,8 @@ static ssize_t _mtk_cl_sd_debouncet_write(struct file *filp, const char __user *
 	char desc[MAX_LEN] = {0};
 	int tmp_dbt = -1;
 
+	len = (len < (MAX_LEN-1)) ? len : MAX_LEN-1;
+
 	/* write data to the buffer */
 	if (copy_from_user(desc, buf, len)) {
 		return -EFAULT;
diff --git a/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c b/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
index 934f2577d..2bc7b0514 100644
--- a/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
+++ b/drivers/misc/mediatek/videocodec/mt6735/videocodec_kernel_driver_D3.c
@@ -1424,7 +1424,7 @@ static long vcodec_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned
         case VCODEC_GET_CPU_LOADING_INFO:
         {
             VAL_UINT8_T *user_data_addr;
-            VAL_VCODEC_CPU_LOADING_INFO_T _temp;
+            VAL_VCODEC_CPU_LOADING_INFO_T _temp = {0};
 
             MFV_LOGD("VCODEC_GET_CPU_LOADING_INFO +\n");
             user_data_addr = (VAL_UINT8_T *)arg;
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index be626df37..a6a9b6ede 100755
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -259,8 +259,8 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
 		table = ERR_PTR(-EINVAL);
 	if (IS_ERR(table)) {
                 IONMSG("%s table is err 0x%pK.\n", __func__, table);
-        ret = -EINVAL;
-        goto err1;
+		ret = -EINVAL;
+		goto err1;
 	}
 	buffer->sg_table = table;
 	if (ion_buffer_fault_user_mappings(buffer)) {
@@ -465,6 +465,7 @@ int ion_handle_put(struct ion_handle *handle)
 	return ret;
 }
 
+
 static struct ion_handle *ion_handle_lookup(struct ion_client *client,
 					    struct ion_buffer *buffer)
 {
@@ -548,7 +549,7 @@ static int ion_handle_add(struct ion_client *client, struct ion_handle *handle)
 
 struct ion_handle *__ion_alloc(struct ion_client *client, size_t len,
 			     size_t align, unsigned int heap_id_mask,
-			     unsigned int flags)
+			     unsigned int flags, bool grab_handle)
 {
 	struct ion_handle *handle;
 	struct ion_device *dev = client->dev;
@@ -572,7 +573,7 @@ struct ion_handle *__ion_alloc(struct ion_client *client, size_t len,
         }
 
     //add by k.zhang for sgtable_init KE bug
-	if((len > 1024*1024*1024))
+	if ((len > 1024*1024*1024))
 	{
 		IONMSG("%s error: size (%zu) is more than 1G !!\n", __FUNCTION__,len);
 		return ERR_PTR(-EINVAL);
@@ -614,6 +615,8 @@ struct ion_handle *__ion_alloc(struct ion_client *client, size_t len,
         }
 
 	mutex_lock(&client->lock);
+	if (grab_handle)
+		ion_handle_get(handle);
 	ret = ion_handle_add(client, handle);
 	mutex_unlock(&client->lock);
 	if (ret) {
@@ -631,16 +634,7 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
                              size_t align, unsigned int heap_id_mask,
                              unsigned int flags)
 {
-    struct ion_handle * handle;
-    handle = __ion_alloc(client, len, align, heap_id_mask, flags);
-    if(IS_ERR_OR_NULL(handle)) {
-        IONMSG("%s handle is error 0x%p", __func__, handle);
-	return handle;
-    }
-
-    ion_debug_kern_rec(client, handle->buffer, handle, ION_FUNCTION_ALLOC, 0, 0, 0, 0);
-
-    return handle;
+	return __ion_alloc(client, len, align, heap_id_mask, flags, false);
 }
 EXPORT_SYMBOL(ion_alloc);
 
@@ -666,6 +660,8 @@ void ion_free(struct ion_client *client, struct ion_handle *handle)
 	mutex_lock(&client->lock);
 	ion_free_nolock(client, handle);
 	mutex_unlock(&client->lock);
+
+	ion_debug_kern_rec(client, handle->buffer, NULL, ION_FUNCTION_FREE, 0, 0, 0, 0);
 }
 EXPORT_SYMBOL(ion_free);
 
@@ -858,7 +854,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused)
 		sizes[id] += handle->buffer->size;
 
 		struct ion_buffer *buffer = handle->buffer;
-		seq_printf(s, "%16.s %3d %8zu %3d %p %p.\n", buffer->heap->name,
+		seq_printf(s, "%16.s %3d %8zu %3d %pK %pK.\n", buffer->heap->name,
 			       client->pid, buffer->size, buffer->handle_count, handle, buffer);
 	}
 	mutex_unlock(&client->lock);
@@ -1001,7 +997,7 @@ struct ion_client *ion_client_create(struct ion_device *dev,
     struct ion_client *client;
 
     client = __ion_client_create(dev, name);
-    if(IS_ERR_OR_NULL(client)) {
+    if (IS_ERR_OR_NULL(client)) {
         IONMSG("%s client is error or null 0x%pK.\n", __func__, client);
 	return client;
     }
@@ -1040,7 +1036,7 @@ void __ion_client_destroy(struct ion_client *client, int from_kern)
 	kfree(client->display_name);
 	kfree(client->name);
 #if ION_DEBUG
-    if(from_kern)
+    if (from_kern)
         ion_debug_kern_rec(client, NULL, NULL, ION_FUNCTION_DESTROY_CLIENT, 0, 0, 0, 0);
 	ion_debug_db_destroy_clentry(client->pid);
 #endif
@@ -1183,7 +1179,7 @@ static void ion_vm_open(struct vm_area_struct *vma)
 	mutex_lock(&buffer->lock);
 	list_add(&vma_list->list, &buffer->vmas);
 	mutex_unlock(&buffer->lock);
-	pr_debug("%s: adding %p\n", __func__, vma);
+	pr_debug("%s: adding %pK\n", __func__, vma);
 }
 
 static void ion_vm_close(struct vm_area_struct *vma)
@@ -1198,7 +1194,7 @@ static void ion_vm_close(struct vm_area_struct *vma)
 			continue;
 		list_del(&vma_list->list);
 		kfree(vma_list);
-		pr_debug("%s: deleting %p\n", __func__, vma);
+		pr_debug("%s: deleting %pK\n", __func__, vma);
 		break;
 	}
 	mutex_unlock(&buffer->lock);
@@ -1357,7 +1353,7 @@ int __ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle,
 		dma_buf_put(dmabuf);
         }
 #if ION_DEBUG
-    if(from_kern)
+    if (from_kern)
         ion_debug_kern_rec(client, handle->buffer, handle, ION_FUNCTION_SHARE, 0, 0, 0, fd);
 #endif
 
@@ -1514,7 +1510,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		handle = __ion_alloc(client, data.allocation.len,
 						data.allocation.align,
 						data.allocation.heap_id_mask,
-						data.allocation.flags);
+					  data.allocation.flags, true);
 		if (IS_ERR(handle)) {
                         ret = PTR_ERR(handle);
                         IONMSG("ION_IOC_ALLOC handle is invalid. ret = %d.\n", ret);
@@ -1534,6 +1530,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		handle = ion_handle_get_by_id_nolock(client, data.handle.handle);
 		if (IS_ERR(handle)) {
 			mutex_unlock(&client->lock);
+			IONMSG("ION_IOC_FREE handle is invalid. handle = %d, ret = %d.\n", data.handle.handle, ret);
 			return PTR_ERR(handle);
 		}
 		ion_free_nolock(client, handle);
@@ -1596,12 +1593,16 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 
 	if (dir & _IOC_READ) {
 		if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) {
-			if (cleanup_handle)
-				ion_free(client, cleanup_handle);
+			if (cleanup_handle) {
+					ion_free(client, cleanup_handle);
+					ion_handle_put(cleanup_handle);
+			}
                         IONMSG("ion_ioctl copy_to_user fail! cmd = %d, n = %d.\n", cmd, _IOC_SIZE(cmd));
 			return -EFAULT;
 		}
 	}
+	if (cleanup_handle)
+		ion_handle_put(cleanup_handle);
 	return ret;
 }
 
@@ -1740,7 +1741,15 @@ static int ion_debug_heap_pool_show(struct seq_file *s, void *unused)
 	struct ion_heap *heap = s->private;
 	struct ion_device *dev = heap->dev;
 	struct rb_node *n;
-	size_t total_size = heap->ops->page_pool_total(heap);
+	size_t total_size;
+
+	if (!heap->ops->page_pool_total) {
+		pr_err("%s: ion page pool total is not implemented by heap(%s).\n",
+		       __func__, heap->name);
+		return -ENODEV;
+	}
+
+	total_size = heap->ops->page_pool_total(heap);
 
 	seq_printf(s, "%16.s %16zu\n", "total_in_pool ", total_size);
 
@@ -2004,7 +2013,7 @@ int ion_device_destory_heaps(struct ion_device *dev, int need_lock)
 	struct ion_heap *heap, *tmp;
 	int i;
 
-	if(need_lock)
+	if (need_lock)
 		down_write(&dev->lock);
 
 	plist_for_each_entry_safe(heap, tmp, &dev->heaps, node) {
@@ -2012,7 +2021,7 @@ int ion_device_destory_heaps(struct ion_device *dev, int need_lock)
 		ion_heap_destroy(heap);
 	}
 
-	if(need_lock)
+	if (need_lock)
 		up_write(&dev->lock);
 	return 0;
 }
@@ -2022,17 +2031,17 @@ struct ion_heap * ion_drv_get_heap(struct ion_device *dev, int heap_id, int need
 	struct ion_heap *_heap, *heap = NULL, *tmp;
 	int i;
 
-	if(need_lock)
+	if (need_lock)
 		down_write(&dev->lock);
 
 	plist_for_each_entry_safe(_heap, tmp, &dev->heaps, node) {
-		if(_heap->id == heap_id) {
+		if (_heap->id == heap_id) {
 			heap = _heap;
 			break;
 		}
 	}
 
-	if(need_lock)
+	if (need_lock)
 		up_write(&dev->lock);
 
 	return heap;
@@ -2052,7 +2061,7 @@ static int ion_debug_kern_rec(struct ion_client *client,
     ion_sys_record_t record_param;
     record_param.client = client;
     record_param.pid = client->pid;
-    if(current->pid != current->tgid)
+    if (current->pid != current->tgid)
     {
             record_param.group_id = current->tgid;
             printk(ION_DEBUG_INFO "[KERNEL tgid is %d]\n",(unsigned int)current->tgid);
@@ -2196,7 +2205,7 @@ static int ion_debugdb_show_backtrace(struct seq_file *s, struct ion_record_basi
 		backtrace_count = tmp->numEntries;
 	} else if (sbt == RELEASE_BACKTRACE_INFO) {
 		tmp = (ObjectEntry *)ti->release_backtrace;
-		if(tmp == NULL)
+		if (tmp == NULL)
 			return 0;
 		backtrace_count = tmp->numEntries;
 	}
@@ -2328,7 +2337,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 							/* Lv2 - all buffer-usage */
 
 							usg_rec = ion_get_list_from_buffer(buffer, BUFFER_ALLOCATION_LIST);
-							if(usg_rec != NULL)
+							if (usg_rec != NULL)
 								seq_printf(s, "%s\n","  <BUFFER_ALLOCATION_LIST>");
 							while (!!usg_rec) {
 								seq_printf(s, "%s [0x%x] %10s [%d] (%s [%d]) \n","    client",
@@ -2344,7 +2353,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 							}
 #if 0
 							usg_rec = ion_get_list_from_buffer(buffer, BUFFER_FREE_LIST);
-							if(usg_rec != NULL)
+							if (usg_rec != NULL)
 								seq_printf(s, "%s\n","  <BUFFER_FREE_LIST>");
 							while (!!usg_rec) {
 								seq_printf(s, "%s [0x%x] %10s [%d] \n","    client",
@@ -2370,7 +2379,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 
                                         while ((!!usg_rec) &&(usg_rec->tracking_info.recordID.pid== raw_key)) {
 						buffer_count++;
-						if(buffer_count == 1)
+						if (buffer_count == 1)
 						{
 							seq_printf(s, "%8s[%2d] buffer: 0x%pK buffer structure adr: 0x%pK size(%d)\n", "buffer", buffer_cnt++, buf_rec->buffer, buf_rec->buffer_address, buf_rec->buffer->size);
 						}
@@ -2434,7 +2443,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 							mutex_unlock(&buffer->lock);
 							/* Lv2 - all buffer-mmaps */
 							adr_rec = ion_get_list_from_buffer(buffer, ADDRESS_ALLOCATION_LIST);
-							if(adr_rec != NULL)
+							if (adr_rec != NULL)
 							{
 							seq_printf(s, "%10s\n","<ADDRESS_ALLOCATION_LIST_IN_KERNELSPACE>");
 							}
@@ -2450,7 +2459,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 							}
 
 							adr_rec = ion_get_list_from_buffer(buffer, ADDRESS_FREE_LIST);
-							if(adr_rec != NULL)
+							if (adr_rec != NULL)
 							{
 								seq_printf(s, "%10s\n","<ADDRESS_FREE_LIST_IN_KERNELSPACE>");
 							}
@@ -2467,10 +2476,10 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 
 						}
 						        client_rec = (struct ion_client_usage_record *)ion_get_client_record(client);
-                                                        if(client_rec != NULL)
+                                                        if (client_rec != NULL)
                                                         {
                                                                 adr_rec = ion_get_list_from_process(client_rec->tracking_info.recordID.pid, ADDRESS_ALLOCATION_LIST);
-								if(adr_rec != NULL)
+								if (adr_rec != NULL)
 									seq_printf(s, "%10s\n","<ADDRESS_ALLOCATION_LIST_IN_USERSPACE>");
                                                         while (!!adr_rec)
 							{
@@ -2484,7 +2493,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
                                                                         adr_rec = (struct ion_address_usage_record *)ion_get_data_from_record((void *)adr_rec, RECORD_NEXT);
                                                                 }
                                                                 adr_rec = ion_get_list_from_process(client_rec->tracking_info.recordID.pid, ADDRESS_FREE_LIST);
-                                                               	if(adr_rec != NULL)
+                                                               	if (adr_rec != NULL)
 									seq_printf(s, "%10s\n","<ADDRESS_FREE_LIST_IN_USERSPACE>");
                                                         while (!!adr_rec)
 							{
@@ -2522,11 +2531,11 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
 						/* Lv1 - all buffers */
 					 	client_rec = (struct ion_client_usage_record *)ion_get_client_record(client);
                                                 //printk("[FD] client_rec  %x input is %x groupd id is %d\n",client_rec,client,client->pid);
-                                                if(client_rec != NULL)
+                                                if (client_rec != NULL)
                                                 {
                                                 	//printk("[FD] client pid is %d\n",client_rec->tracking_info.recordID.pid);
                                                 	fd_rec = ion_get_list_from_process(client_rec->tracking_info.recordID.pid, FD_ALLOCATION_LIST);
-                                                	if(fd_rec != NULL)
+                                                	if (fd_rec != NULL)
                                                 		seq_printf(s, "%10s\n","<FD_ALLOCATION_LIST>");
                                                         //printk("[FD] get fd_rec %x\n",fd_rec);
                                                         while (!!fd_rec) {
@@ -2540,7 +2549,7 @@ static int ion_debug_dbcl_show(struct seq_file *s, void *unused)
                                                  	}
 						#if 0
                                                         fd_rec = ion_get_list_from_process(client_rec->tracking_info.recordID.pid, FD_FREE_LIST);
-                                                        if(fd_rec != NULL)
+                                                        if (fd_rec != NULL)
                                                         	seq_printf(s, "%10s\n","<FD_FREE_LIST>");
                                                         while (!!fd_rec) {
                                                                 seq_printf(s, "%10s [%d] %10s [%d]\n",
@@ -2729,13 +2738,13 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 					seq_printf(s, "%8s[%2d][0x%x] buffer structure: 0x%pK size(%d)\n", "buffer", buffer_cnt++,(unsigned int)buf_rec->buffer,buf_rec->buffer_address, buf_rec->buffer->size);
 					/* Allocation */
 					usg_rec = ion_get_list(LIST_BUFFER,buf_rec, BUFFER_ALLOCATION_LIST);
-					if(usg_rec)
+					if (usg_rec)
 					{
 					seq_printf(s, "%30s\n","<BUFFER_ALLOCATION_LIST>");
 					}
 					while (!!usg_rec)
 					{
-						if(usg_rec->function_type == ION_FUNCTION_ALLOC)
+						if (usg_rec->function_type == ION_FUNCTION_ALLOC)
 						{
 							seq_printf(s, "%15s [%d] (%s [%d]) %s (0x%x) FUNCTION %s\n","Process", usg_rec->tracking_info.recordID.pid,
 											"GroupLeader", usg_rec->tracking_info.recordID.group_pid,"handle",(unsigned int)usg_rec->handle,"ION_ALLOC");
@@ -2780,15 +2789,15 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
                                         /* USER MMAP */
                                         adr_rec_user = ion_get_list(LIST_PROCESS,process_rec, ADDRESS_ALLOCATION_LIST);
 					adr_rec_user_free = ion_get_list(LIST_PROCESS,process_rec, ADDRESS_FREE_LIST);
-					if((adr_rec_user == NULL) && (adr_rec_user_free == NULL))
+					if ((adr_rec_user == NULL) && (adr_rec_user_free == NULL))
 					{
 						process_rec = process_rec->next;
 						continue;
 					}
-					if(process_rec == NULL)
+					if (process_rec == NULL)
 						break;
 					seq_printf(s, "[%2d]%8s[0x%x] [%d] group_id [%d]\n",process_cnt++,"process",(unsigned int)process_rec, process_rec->pid, process_rec->group_id);
-					if(adr_rec_user != NULL)
+					if (adr_rec_user != NULL)
                                         {
                                                 seq_printf(s, "  %s\n","<ADDRESS_ALLOCATION_LIST>");
                                         }
@@ -2809,7 +2818,7 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
                                                 adr_rec_user = (struct ion_address_usage_record *)ion_get_data_from_record((void *)adr_rec_user, RECORD_NEXT);
                                         }
 
-					if(adr_rec_user_free != NULL)
+					if (adr_rec_user_free != NULL)
                                         {
                                                 seq_printf(s, "  %s\n","<ADDRESS_FREE_LIST>");
                                         }
@@ -2842,14 +2851,14 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 					/* Unmapping */
                                         adr_rec_free = ion_get_list(LIST_BUFFER,buf_rec, ADDRESS_FREE_LIST);
 					mutex_unlock(&buf_rec->ion_address_usage_mutex);
-					if((adr_rec == NULL)&&(adr_rec_free == NULL))
+					if ((adr_rec == NULL)&&(adr_rec_free == NULL))
 					{
 						buf_rec = buf_rec->next;
 						continue;
 					}
 
 					seq_printf(s, "%8s[%2d] size(%d) %12p\n", "buffer", buffer_cnt++, buf_rec->buffer->size, buf_rec->buffer);
-					if(adr_rec != NULL)
+					if (adr_rec != NULL)
 					{
 						seq_printf(s, "  %s\n","<ADDRESS_ALLOCATION_LIST>");
 					}
@@ -2864,7 +2873,7 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 						/* Next address record */
 						adr_rec = (struct ion_address_usage_record *)ion_get_data_from_record((void *)adr_rec, RECORD_NEXT);
 					}
-                                        if(adr_rec_free != NULL)
+                                        if (adr_rec_free != NULL)
                                         {
 						seq_printf(s, "  %s\n","<ADDRESS_FREE_LIST>");
 					}
@@ -2895,13 +2904,13 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 					/* FD */
 					fd_rec = ion_get_list(LIST_PROCESS,process_rec, FD_ALLOCATION_LIST);
 					//fd_rec2 = ion_get_list(LIST_PROCESS,process_rec, FD_FREE_LIST);
-					if(fd_rec == NULL)
+					if (fd_rec == NULL)
 					{
 						process_rec = process_rec->next;
                                                 continue;
 					}
 					seq_printf(s, "[%2d] %8s[0x%x] [%d] group_id [%d]\n",process_cnt++, "process",(unsigned int)process_rec, process_rec->pid,process_rec->group_id);
-					if(fd_rec != NULL)
+					if (fd_rec != NULL)
                                         {
                                                 seq_printf(s, "  %s\n","<FD_ALLOCATION_LIST>");
                                         }
@@ -2920,7 +2929,7 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 						fd_rec = (struct ion_fd_usage_record *)ion_get_data_from_record((void *)fd_rec, RECORD_NEXT);
 					}
 				#if 0
-					if(fd_rec2 != NULL)
+					if (fd_rec2 != NULL)
                                         {
                                                 seq_printf(s, "  %s\n","<FD_FREE_LIST>");
                                         }
@@ -2985,7 +2994,7 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 						current_client_rec = (struct ion_client_usage_record *)client_rec;
 						while(current_client_rec != NULL)
 						{
-							if((current_client_rec->tracking_info.recordID.client_address == (unsigned int)client)&&(current_client_rec->tracking_info.recordID.pid == pe->pid))
+							if ((current_client_rec->tracking_info.recordID.client_address == (unsigned int)client)&&(current_client_rec->tracking_info.recordID.pid == pe->pid))
 							{
 								printk("found client client address 0x%x",current_client_rec->tracking_info.recordID.client_address);
 								break;
@@ -3011,7 +3020,7 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 							current_fd_usage_rec = current_process_rec->fd_using_list;
 							while (current_fd_usage_rec != NULL)
 							{
-								if((current_fd_usage_rec->buffer == buffer) && (current_fd_usage_rec->handle == handle))
+								if ((current_fd_usage_rec->buffer == buffer) && (current_fd_usage_rec->handle == handle))
 								{
 									break;
 								}
@@ -3022,19 +3031,19 @@ static int ion_debug_dbis_show(struct seq_file *s, void *unused)
 							{
 								seq_printf(s, "%14s[%2d] fd(%d) heap(%s) ref_count(%d)flags(%d) buffer(0x%x) addr(0x%x) size(%d) \n",
 									"--buffer", buffer_cnt++,current_fd_usage_rec->fd, buffer->heap->name,(int)atomic_read(&buffer->ref.refcount),(int)buffer->flags,
-									(unsigned int)buffer,(unsigned int)buffer->vaddr,(int)buffer->size );
+									(unsigned int)buffer,(unsigned int)buffer->vaddr,(int)buffer->size);
 							}
 							else
 							{
 								seq_printf(s, "%14s[%2d] heap(%s) flags(%d) buffer (0x%x) addr(0x%x) size(%d) kmap_cnt(%d) kvaddr(0x%x)\n",
-                                                                        "--buffer", buffer_cnt++,buffer->heap->name, (int)buffer->flags,
-                                                                        (unsigned int)buffer,(unsigned int)buffer->vaddr ,(int)buffer->size,(int)buffer->kmap_cnt, (unsigned int)buffer->vaddr);
+									"--buffer", buffer_cnt++,buffer->heap->name, (int)buffer->flags,
+									(unsigned int)buffer,(unsigned int)buffer->vaddr ,(int)buffer->size,(int)buffer->kmap_cnt, (unsigned int)buffer->vaddr);
 							}
 							mutex_unlock(&buffer->lock);
 							current_mmap_usage_rec = current_process_rec->address_using_list;
                                                         while (current_mmap_usage_rec != NULL)
-                                                        {
-								if(current_mmap_usage_rec->buffer == buffer)
+							{
+								if (current_mmap_usage_rec->buffer == buffer)
 								{
 									seq_printf(s,"%16s mapping address[0x%x - 0x%x] size(%d)\n","----buffer",current_mmap_usage_rec->mapping_address,current_mmap_usage_rec->mapping_address+current_mmap_usage_rec->size,current_mmap_usage_rec->size);
 								}
diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
index da28ad7c7..963a8ab25 100644
--- a/drivers/staging/android/ion/ion_heap.c
+++ b/drivers/staging/android/ion/ion_heap.c
@@ -327,8 +327,8 @@ struct ion_heap *ion_heap_create(struct ion_platform_heap *heap_data)
 
 	switch ((int)heap_data->type) {
 	case ION_HEAP_TYPE_SYSTEM_CONTIG:
-		heap = ion_system_contig_heap_create(heap_data);
-		break;
+		pr_err("%s: Heap type is disabled: %d\n", __func__, heap_data->type);
+		return ERR_PTR(-EINVAL);
 	case ION_HEAP_TYPE_SYSTEM:
 		heap = ion_system_heap_create(heap_data);
 		break;
@@ -372,7 +372,7 @@ void ion_heap_destroy(struct ion_heap *heap)
 
 	switch ((int)heap->type) {
 	case ION_HEAP_TYPE_SYSTEM_CONTIG:
-		ion_system_contig_heap_destroy(heap);
+		pr_err("%s: Heap type is disabled: %d\n", __func__, heap->type);
 		break;
 	case ION_HEAP_TYPE_SYSTEM:
 		ion_system_heap_destroy(heap);
diff --git a/drivers/staging/android/ion/mtk/ion_drv.c b/drivers/staging/android/ion/mtk/ion_drv.c
index fcdca6c67..f14a413b0 100644
--- a/drivers/staging/android/ion/mtk/ion_drv.c
+++ b/drivers/staging/android/ion/mtk/ion_drv.c
@@ -610,15 +610,6 @@ int ion_drv_remove(struct platform_device *pdev)
 static struct ion_platform_heap ion_drv_platform_heaps[] = 
 {
     {
-        .type = ION_HEAP_TYPE_SYSTEM_CONTIG,
-        .id = ION_HEAP_TYPE_SYSTEM_CONTIG,
-        .name = "ion_system_contig_heap",
-        .base = 0,
-        .size = 0,
-        .align = 0,
-        .priv = NULL,
-    },
-    {
         .type = ION_HEAP_TYPE_MULTIMEDIA,
         .id = ION_HEAP_TYPE_MULTIMEDIA,
         .name = "ion_mm_heap",