Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (33 commits)
  V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue
  V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U
  V4L/DVB (9092): gspca: Bad init values for sonixj ov7660.
  V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors.
  V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561.
  V4L/DVB (9053): fix buffer overflow in uvc-video
  V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow
  V4L/DVB (9037): Fix support for Hauppauge Nova-S SE
  V4L/DVB (9029): Fix deadlock in demux code
  V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick
  V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick
  V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600
  V4L/DVB (8963): s2255drv field count fix
  V4L/DVB (8961): zr36067: Fix RGBR pixel format
  V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h
  V4L/DVB (8958): zr36067: Return proper bytes-per-line value
  V4L/DVB (8957): zr36067: Restore the default pixel format
  V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open
  V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800)
  V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom.
  ...

29 files changed, 128 insertions, 85 deletions

diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 216025cf5d4b..2c5b6282b569 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -10,6 +10,7 @@
 #include "dvb_frontend.h"
 
 #define XC2028_DEFAULT_FIRMWARE "xc3028-v27.fw"
+#define XC3028L_DEFAULT_FIRMWARE "xc3028L-v36.fw"
 
 /*      Dmoduler                IF (kHz) */
 #define XC3028_FE_DEFAULT       0               /* Don't load SCODE */
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index 4eed783f4bce..a127a4175c40 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -491,6 +491,7 @@ static struct s5h1420_config skystar2_rev2_7_s5h1420_config = {
         .demod_address = 0x53,
         .invert = 1,
         .repeated_start_workaround = 1,
+        .serial_mpeg = 1,
 };
 
 static struct itd1000_config skystar2_rev2_7_itd1000_config = {
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 069d847ba887..0c733c66a441 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -364,15 +364,16 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                                        enum dmx_success success)
 {
         struct dmxdev_filter *dmxdevfilter = filter->priv;
+        unsigned long flags;
         int ret;
 
         if (dmxdevfilter->buffer.error) {
                 wake_up(&dmxdevfilter->buffer.queue);
                 return 0;
         }
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
         if (dmxdevfilter->state != DMXDEV_STATE_GO) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                 return 0;
         }
         del_timer(&dmxdevfilter->timer);
@@ -391,7 +392,7 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
         }
         if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
                 dmxdevfilter->state = DMXDEV_STATE_DONE;
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
         wake_up(&dmxdevfilter->buffer.queue);
         return 0;
 }
@@ -403,11 +404,12 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
 {
         struct dmxdev_filter *dmxdevfilter = feed->priv;
         struct dvb_ringbuffer *buffer;
+        unsigned long flags;
         int ret;
 
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
         if (dmxdevfilter->params.pes.output == DMX_OUT_DECODER) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                 return 0;
         }
 
@@ -417,7 +419,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
         else
                 buffer = &dmxdevfilter->dev->dvr_buffer;
         if (buffer->error) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                 wake_up(&buffer->queue);
                 return 0;
         }
@@ -428,7 +430,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                 dvb_ringbuffer_flush(buffer);
                 buffer->error = ret;
         }
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
         wake_up(&buffer->queue);
         return 0;
 }
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index e2eca0b1fe7c..a2c1fd5d2f67 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -399,7 +399,9 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                               size_t count)
 {
-        spin_lock(&demux->lock);
+        unsigned long flags;
+
+        spin_lock_irqsave(&demux->lock, flags);
 
         while (count--) {
                 if (buf[0] == 0x47)
@@ -407,16 +409,17 @@ void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                 buf += 188;
         }
 
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 
 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);
 
 void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
         int p = 0, i, j;
 
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
 
         if (demux->tsbufp) {
                 i = demux->tsbufp;
@@ -449,17 +452,18 @@ void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
         }
 
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 
 EXPORT_SYMBOL(dvb_dmx_swfilter);
 
 void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
         int p = 0, i, j;
         u8 tmppack[188];
 
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
 
         if (demux->tsbufp) {
                 i = demux->tsbufp;
@@ -500,7 +504,7 @@ void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
         }
 
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 
 EXPORT_SYMBOL(dvb_dmx_swfilter_204);
diff --git a/drivers/media/dvb/frontends/s5h1420.c b/drivers/media/dvb/frontends/s5h1420.c
index 747d3fa2e5e5..2e9fd2893ede 100644
--- a/drivers/media/dvb/frontends/s5h1420.c
+++ b/drivers/media/dvb/frontends/s5h1420.c
@@ -59,7 +59,7 @@ struct s5h1420_state {
          * it does not support repeated-start, workaround: write addr-1
          * and then read
          */
-        u8 shadow[255];
+        u8 shadow[256];
 };
 
 static u32 s5h1420_getsymbolrate(struct s5h1420_state* state);
@@ -94,8 +94,11 @@ static u8 s5h1420_readreg(struct s5h1420_state *state, u8 reg)
                 if (ret != 3)
                         return ret;
         } else {
-                ret = i2c_transfer(state->i2c, &msg[1], 2);
-                if (ret != 2)
+                ret = i2c_transfer(state->i2c, &msg[1], 1);
+                if (ret != 1)
+                        return ret;
+                ret = i2c_transfer(state->i2c, &msg[2], 1);
+                if (ret != 1)
                         return ret;
         }
 
@@ -823,7 +826,7 @@ static int s5h1420_init (struct dvb_frontend* fe)
         struct s5h1420_state* state = fe->demodulator_priv;
 
         /* disable power down and do reset */
-        state->CON_1_val = 0x10;
+        state->CON_1_val = state->config->serial_mpeg << 4;
         s5h1420_writereg(state, 0x02, state->CON_1_val);
         msleep(10);
         s5h1420_reset(state);
diff --git a/drivers/media/dvb/frontends/s5h1420.h b/drivers/media/dvb/frontends/s5h1420.h
index 4c913f142bc4..ff308136d865 100644
--- a/drivers/media/dvb/frontends/s5h1420.h
+++ b/drivers/media/dvb/frontends/s5h1420.h
@@ -32,10 +32,12 @@ struct s5h1420_config
         u8 demod_address;
 
         /* does the inversion require inversion? */
-        u8 invert : 1;
+        u8 invert:1;
 
-        u8 repeated_start_workaround : 1;
-        u8 cdclk_polarity : 1; /* 1 == falling edge, 0 == raising edge */
+        u8 repeated_start_workaround:1;
+        u8 cdclk_polarity:1; /* 1 == falling edge, 0 == raising edge */
+
+        u8 serial_mpeg:1;
 };
 
 #if defined(CONFIG_DVB_S5H1420) || (defined(CONFIG_DVB_S5H1420_MODULE) && defined(MODULE))
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index cc5efb643f33..9da260fe3fd1 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -40,6 +40,8 @@ struct usb_device_id smsusb_id_table[] = {
                 .driver_info = SMS1XXX_BOARD_HAUPPAUGE_OKEMO_B },
         { USB_DEVICE(0x2040, 0x5500),
                 .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+        { USB_DEVICE(0x2040, 0x5510),
+                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
         { USB_DEVICE(0x2040, 0x5580),
                 .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
         { USB_DEVICE(0x2040, 0x5590),
@@ -87,7 +89,7 @@ static struct sms_board sms_boards[] = {
                 .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-nova-b-dvbt-01.fw",
         },
         [SMS1XXX_BOARD_HAUPPAUGE_WINDHAM] = {
-                .name   = "Hauppauge WinTV-Nova-T-MiniStick",
+                .name   = "Hauppauge WinTV MiniStick",
                 .type   = SMS_NOVA_B0,
                 .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-hcw-55xxx-dvbt-01.fw",
         },
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 6ae4cc860efe..933eaef41ead 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3431,7 +3431,7 @@ static int radio_open(struct inode *inode, struct file *file)
         dprintk("bttv: open minor=%d\n",minor);
 
         for (i = 0; i < bttv_num; i++) {
-                if (bttvs[i].radio_dev->minor == minor) {
+                if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
                         btv = &bttvs[i];
                         break;
                 }
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index c149b7d712e5..5405c30dbb04 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
 #include <linux/pci.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
diff --git a/drivers/media/video/cpia2/cpia2_usb.c b/drivers/media/video/cpia2/cpia2_usb.c
index a4574740350d..a8a199047cbd 100644
--- a/drivers/media/video/cpia2/cpia2_usb.c
+++ b/drivers/media/video/cpia2/cpia2_usb.c
@@ -632,7 +632,7 @@ int cpia2_usb_transfer_cmd(struct camera_data *cam,
 static int submit_urbs(struct camera_data *cam)
 {
         struct urb *urb;
-        int fx, err, i;
+        int fx, err, i, j;
 
         for(i=0; i<NUM_SBUF; ++i) {
                 if (cam->sbuf[i].data)
@@ -657,6 +657,9 @@ static int submit_urbs(struct camera_data *cam)
                 }
                 urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                 if (!urb) {
+                        ERR("%s: usb_alloc_urb error!\n", __func__);
+                        for (j = 0; j < i; j++)
+                                usb_free_urb(cam->sbuf[j].urb);
                         return -ENOMEM;
                 }
 
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 8fe5f38c4d7c..3cb9734ec07b 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -163,7 +163,7 @@ static const struct cx18_card cx18_card_h900 = {
         },
         .audio_inputs = {
                 { CX18_CARD_INPUT_AUD_TUNER,
-                  CX18_AV_AUDIO8, 0 },
+                  CX18_AV_AUDIO5, 0 },
                 { CX18_CARD_INPUT_LINE_IN1,
                   CX18_AV_AUDIO_SERIAL1, 0 },
         },
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index 9a1374a38ec7..6b922066a660 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -1070,6 +1070,7 @@ static int mpeg_open(struct inode *inode, struct file *file)
                 err = drv->request_acquire(drv);
                 if(err != 0) {
                         dprintk(1,"%s: Unable to acquire hardware, %d\n", __func__, err);
+                        unlock_kernel();
                         return err;
                 }
         }
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 3c006103c1eb..ac3292d7646c 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -117,10 +117,10 @@ static void em28xx_audio_isocirq(struct urb *urb)
 
                         if (oldptr + length >= runtime->buffer_size) {
                                 unsigned int cnt =
-                                    runtime->buffer_size - oldptr - 1;
+                                    runtime->buffer_size - oldptr;
                                 memcpy(runtime->dma_area + oldptr * stride, cp,
                                        cnt * stride);
-                                memcpy(runtime->dma_area, cp + cnt,
+                                memcpy(runtime->dma_area, cp + cnt * stride,
                                        length * stride - cnt * stride);
                         } else {
                                 memcpy(runtime->dma_area + oldptr * stride, cp,
@@ -161,8 +161,14 @@ static int em28xx_init_audio_isoc(struct em28xx *dev)
 
                 memset(dev->adev->transfer_buffer[i], 0x80, sb_size);
                 urb = usb_alloc_urb(EM28XX_NUM_AUDIO_PACKETS, GFP_ATOMIC);
-                if (!urb)
+                if (!urb) {
+                        em28xx_errdev("usb_alloc_urb failed!\n");
+                        for (j = 0; j < i; j++) {
+                                usb_free_urb(dev->adev->urb[j]);
+                                kfree(dev->adev->transfer_buffer[j]);
+                        }
                         return -ENOMEM;
+                }
 
                 urb->dev = dev->udev;
                 urb->context = dev;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 452da70e719f..de943cf6c169 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -93,28 +93,6 @@ struct em28xx_board em28xx_boards[] = {
                         .amux     = 0,
                 } },
         },
-        [EM2800_BOARD_KWORLD_USB2800] = {
-                .name         = "Kworld USB2800",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .is_em2800    = 1,
-                .vchannels    = 3,
-                .tuner_type   = TUNER_PHILIPS_FCV1236D,
-                .tda9887_conf = TDA9887_PRESENT,
-                .decoder      = EM28XX_SAA7113,
-                .input          = { {
-                        .type     = EM28XX_VMUX_TELEVISION,
-                        .vmux     = SAA7115_COMPOSITE2,
-                        .amux     = 0,
-                }, {
-                        .type     = EM28XX_VMUX_COMPOSITE1,
-                        .vmux     = SAA7115_COMPOSITE0,
-                        .amux     = 1,
-                }, {
-                        .type     = EM28XX_VMUX_SVIDEO,
-                        .vmux     = SAA7115_SVIDEO3,
-                        .amux     = 1,
-                } },
-        },
         [EM2820_BOARD_KWORLD_PVRTV2800RF] = {
                 .name         = "Kworld PVR TV 2800 RF",
                 .is_em2800    = 0,
@@ -599,7 +577,7 @@ struct em28xx_board em28xx_boards[] = {
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
+                        .amux     = 3,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
@@ -952,22 +930,23 @@ struct em28xx_board em28xx_boards[] = {
         },
         [EM2880_BOARD_KWORLD_DVB_310U] = {
                 .name         = "KWorld DVB-T 310U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                 .vchannels    = 3,
                 .tuner_type   = TUNER_XC2028,
+                .has_dvb      = 1,
+                .mts_firmware = 1,
                 .decoder      = EM28XX_TVP5150,
                 .input          = { {
                         .type     = EM28XX_VMUX_TELEVISION,
                         .vmux     = TVP5150_COMPOSITE0,
-                        .amux     = 0,
+                        .amux     = EM28XX_AMUX_VIDEO,
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
-                }, {
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
+                }, {    /* S-video has not been tested yet */
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
-                        .amux     = 1,
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
                 } },
         },
         [EM2881_BOARD_DNT_DA2_HYBRID] = {
@@ -1282,6 +1261,7 @@ static struct em28xx_reg_seq em2882_terratec_hybrid_xs_digital[] = {
 static struct em28xx_hash_table em28xx_eeprom_hash [] = {
         /* P/N: SA 60002070465 Tuner: TVF7533-MF */
         {0x6ce05a8f, EM2820_BOARD_PROLINK_PLAYTV_USB2, TUNER_YMEC_TVF_5533MF},
+        {0x966a0441, EM2880_BOARD_KWORLD_DVB_310U, TUNER_XC2028},
 };
 
 /* I2C devicelist hash table for devices with generic USB IDs */
@@ -1552,9 +1532,12 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                 /* djh - Not sure which demod we need here */
                 ctl->demod = XC3028_FE_DEFAULT;
                 break;
+        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
+                ctl->demod = XC3028_FE_DEFAULT;
+                ctl->fname = XC3028L_DEFAULT_FIRMWARE;
+                break;
         case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
         case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                 /* FIXME: Better to specify the needed IF */
                 ctl->demod = XC3028_FE_DEFAULT;
                 break;
@@ -1764,6 +1747,20 @@ void em28xx_card_setup(struct em28xx *dev)
                 break;
         case EM2820_BOARD_UNKNOWN:
         case EM2800_BOARD_UNKNOWN:
+                /*
+                 * The K-WORLD DVB-T 310U is detected as an MSI Digivox AD.
+                 *
+                 * This occurs because they share identical USB vendor and
+                 * product IDs.
+                 *
+                 * What we do here is look up the EEPROM hash of the K-WORLD
+                 * and if it is found then we decide that we do not have
+                 * a DIGIVOX and reset the device to the K-WORLD instead.
+                 *
+                 * This solution is only valid if they do not share eeprom
+                 * hash identities which has not been determined as yet.
+                 */
+        case EM2880_BOARD_MSI_DIGIVOX_AD:
                 if (!em28xx_hint_board(dev))
                         em28xx_set_model(dev);
                 break;
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 4b992bc0083c..d2b1a1a52689 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -452,6 +452,15 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
+        case EM2880_BOARD_KWORLD_DVB_310U:
+                dvb->frontend = dvb_attach(zl10353_attach,
+                                                &em28xx_zl10353_with_xc3028,
+                                                &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
         default:
                 printk(KERN_ERR "%s/2: The frontend of your DVB/ATSC card"
                                 " isn't supported yet\n",
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 7be69284da03..ac95c55887df 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -459,6 +459,7 @@ static int create_urbs(struct gspca_dev *gspca_dev,
                 urb = usb_alloc_urb(npkt, GFP_KERNEL);
                 if (!urb) {
                         err("usb_alloc_urb failed");
+                        destroy_urbs(gspca_dev);
                         return -ENOMEM;
                 }
                 urb->transfer_buffer = usb_buffer_alloc(gspca_dev->dev,
@@ -468,8 +469,8 @@ static int create_urbs(struct gspca_dev *gspca_dev,
 
                 if (urb->transfer_buffer == NULL) {
                         usb_free_urb(urb);
-                        destroy_urbs(gspca_dev);
                         err("usb_buffer_urb failed");
+                        destroy_urbs(gspca_dev);
                         return -ENOMEM;
                 }
                 gspca_dev->urb[n] = urb;
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index d4be51843286..ba865b7f1ed8 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -1063,6 +1063,7 @@ static __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x093a, 0x2621), .driver_info = SENSOR_PAC7302},
         {USB_DEVICE(0x093a, 0x2624), .driver_info = SENSOR_PAC7302},
         {USB_DEVICE(0x093a, 0x2626), .driver_info = SENSOR_PAC7302},
+        {USB_DEVICE(0x093a, 0x262a), .driver_info = SENSOR_PAC7302},
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 5dd78c6766ea..12b81ae526b7 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -232,7 +232,7 @@ static struct ctrl sd_ctrls[] = {
 static struct v4l2_pix_format vga_mode[] = {
         {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                 .bytesperline = 160,
-                .sizeimage = 160 * 120 * 5 / 4,
+                .sizeimage = 160 * 120,
                 .colorspace = V4L2_COLORSPACE_SRGB,
                 .priv = 2 | MODE_RAW},
         {160, 120, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
@@ -264,7 +264,7 @@ static struct v4l2_pix_format sif_mode[] = {
                 .priv = 1 | MODE_REDUCED_SIF},
         {176, 144, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                 .bytesperline = 176,
-                .sizeimage = 176 * 144 * 5 / 4,
+                .sizeimage = 176 * 144,
                 .colorspace = V4L2_COLORSPACE_SRGB,
                 .priv = 1 | MODE_RAW},
         {176, 144, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index d75b1d20b318..572b0f363b64 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -707,6 +707,7 @@ static void i2c_w8(struct gspca_dev *gspca_dev,
                         0x08, 0,                /* value, index */
                         gspca_dev->usb_buf, 8,
                         500);
+        msleep(2);
 }
 
 /* read 5 bytes in gspca_dev->usb_buf */
@@ -976,13 +977,13 @@ static int sd_init(struct gspca_dev *gspca_dev)
         case BRIDGE_SN9C105:
                 if (regF1 != 0x11)
                         return -ENODEV;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                 break;
         case BRIDGE_SN9C120:
                 if (regF1 != 0x12)
                         return -ENODEV;
                 regGpio[1] = 0x70;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                 break;
         default:
 /*      case BRIDGE_SN9C110: */
@@ -1183,7 +1184,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
         static const __u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
         static const __u8 CE[] = { 0x32, 0xdd, 0x2d, 0xdd };    /* MI0360 */
         static const __u8 CE_ov76xx[] =
-                        { 0x32, 0xdd, 0x32, 0xdd };     /* OV7630/48 */
+                                { 0x32, 0xdd, 0x32, 0xdd };
 
         sn9c1xx = sn_tb[(int) sd->sensor];
         configure_gpio(gspca_dev, sn9c1xx);
@@ -1223,8 +1224,15 @@ static void sd_start(struct gspca_dev *gspca_dev)
         reg_w(gspca_dev, 0x20, gamma_def, sizeof gamma_def);
         for (i = 0; i < 8; i++)
                 reg_w(gspca_dev, 0x84, reg84, sizeof reg84);
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+                reg_w1(gspca_dev, 0x9a, 0x05);
+                break;
+        default:
                 reg_w1(gspca_dev, 0x9a, 0x08);
                 reg_w1(gspca_dev, 0x99, 0x59);
+                break;
+        }
 
         mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
         if (mode)
@@ -1275,8 +1283,8 @@ static void sd_start(struct gspca_dev *gspca_dev)
 /*                      reg1 = 0x44; */
 /*                      reg1 = 0x46;    (done) */
                 } else {
-                        reg17 = 0x22;   /* 640 MCKSIZE */
-                        reg1 = 0x06;
+                        reg17 = 0xa2;   /* 640 */
+                        reg1 = 0x44;
                 }
                 break;
         }
@@ -1285,6 +1293,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
         switch (sd->sensor) {
         case SENSOR_OV7630:
         case SENSOR_OV7648:
+        case SENSOR_OV7660:
                 reg_w(gspca_dev, 0xce, CE_ov76xx, 4);
                 break;
         default:
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index cfbc9ebc5c5d..95fcfcb9e31b 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -225,7 +225,7 @@ static int i2c_read(struct gspca_dev *gspca_dev, __u16 reg, __u8 mode)
         reg_w_val(gspca_dev->dev, 0x8802, (mode | 0x01));
         do {
                 reg_r(gspca_dev, 0x8803, 1);
-                if (!gspca_dev->usb_buf)
+                if (!gspca_dev->usb_buf[0])
                         break;
         } while (--retry);
         if (retry == 0)
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 8d7c27e6ac77..d61ef727e0c2 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -6576,8 +6576,8 @@ static int setlightfreq(struct gspca_dev *gspca_dev)
                  cs2102_60HZ, cs2102_60HZScale},
 /* SENSOR_CS2102K 1 */
                 {cs2102_NoFliker, cs2102_NoFlikerScale,
-                 cs2102_50HZ, cs2102_50HZScale,
-                 cs2102_60HZ, cs2102_60HZScale},
+                 NULL, NULL, /* currently disabled */
+                 NULL, NULL},
 /* SENSOR_GC0305 2 */
                 {gc0305_NoFliker, gc0305_NoFliker,
                  gc0305_50HZ, gc0305_50HZ,
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index 3d3c48db45d9..c6852402c5e9 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -3591,7 +3591,7 @@ static int
 ov51x_init_isoc(struct usb_ov511 *ov)
 {
         struct urb *urb;
-        int fx, err, n, size;
+        int fx, err, n, i, size;
 
         PDEBUG(3, "*** Initializing capture ***");
 
@@ -3662,6 +3662,8 @@ ov51x_init_isoc(struct usb_ov511 *ov)
                 urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                 if (!urb) {
                         err("init isoc: usb_alloc_urb ret. NULL");
+                        for (i = 0; i < n; i++)
+                                usb_free_urb(ov->sbuf[i].urb);
                         return -ENOMEM;
                 }
                 ov->sbuf[n].urb = urb;
@@ -5651,7 +5653,7 @@ static ssize_t show_exposure(struct device *cd,
         if (!ov->dev)
                 return -ENODEV;
         sensor_get_exposure(ov, &exp);
-        return sprintf(buf, "%d\n", exp >> 8);
+        return sprintf(buf, "%d\n", exp);
 }
 static DEVICE_ATTR(exposure, S_IRUGO, show_exposure, NULL);
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-devattr.c b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
index 88e175168438..cbe2a3417851 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
@@ -489,6 +489,8 @@ static const struct pvr2_device_desc pvr2_device_751xx = {
 struct usb_device_id pvr2_device_table[] = {
         { USB_DEVICE(0x2040, 0x2900),
           .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
+        { USB_DEVICE(0x2040, 0x2950), /* Logically identical to 2900 */
+          .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
         { USB_DEVICE(0x2040, 0x2400),
           .driver_info = (kernel_ulong_t)&pvr2_device_24xxx},
         { USB_DEVICE(0x1164, 0x0622),
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index b1d09d8e2b85..92b83feae366 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -669,7 +669,7 @@ static void s2255_fillbuff(struct s2255_dev *dev, struct s2255_buffer *buf,
                 (unsigned long)vbuf, pos);
         /* tell v4l buffer was filled */
 
-        buf->vb.field_count++;
+        buf->vb.field_count = dev->frame_count[chn] * 2;
         do_gettimeofday(&ts);
         buf->vb.ts = ts;
         buf->vb.state = VIDEOBUF_DONE;
@@ -1268,6 +1268,7 @@ static int vidioc_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
         dev->last_frame[chn] = -1;
         dev->bad_payload[chn] = 0;
         dev->cur_frame[chn] = 0;
+        dev->frame_count[chn] = 0;
         for (j = 0; j < SYS_FRAMES; j++) {
                 dev->buffer[chn].frame[j].ulState = 0;
                 dev->buffer[chn].frame[j].cur_size = 0;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 6ef3e5297de8..feab12aa2c7b 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video_device *video,
         if (ctrl == NULL)
                 return -EINVAL;
 
-        data = kmalloc(8, GFP_KERNEL);
+        data = kmalloc(ctrl->info->size, GFP_KERNEL);
         if (data == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/video/w9968cf.c b/drivers/media/video/w9968cf.c
index 168baabe4659..11edf79f57be 100644
--- a/drivers/media/video/w9968cf.c
+++ b/drivers/media/video/w9968cf.c
@@ -911,7 +911,6 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
 
         for (i = 0; i < W9968CF_URBS; i++) {
                 urb = usb_alloc_urb(W9968CF_ISO_PACKETS, GFP_KERNEL);
-                cam->urb[i] = urb;
                 if (!urb) {
                         for (j = 0; j < i; j++)
                                 usb_free_urb(cam->urb[j]);
@@ -919,6 +918,7 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
                         return -ENOMEM;
                 }
 
+                cam->urb[i] = urb;
                 urb->dev = udev;
                 urb->context = (void*)cam;
                 urb->pipe = usb_rcvisocpipe(udev, 1);
diff --git a/drivers/media/video/wm8739.c b/drivers/media/video/wm8739.c
index 95c79ad80487..54ac3fe26ec2 100644
--- a/drivers/media/video/wm8739.c
+++ b/drivers/media/video/wm8739.c
@@ -274,10 +274,8 @@ static int wm8739_probe(struct i2c_client *client,
                         client->addr << 1, client->adapter->name);
 
         state = kmalloc(sizeof(struct wm8739_state), GFP_KERNEL);
-        if (state == NULL) {
-                kfree(client);
+        if (state == NULL)
                 return -ENOMEM;
-        }
         state->vol_l = 0x17; /* 0dB */
         state->vol_r = 0x17; /* 0dB */
         state->muted = 0;
diff --git a/drivers/media/video/zoran_card.c b/drivers/media/video/zoran_card.c
index d842a7cb99d2..3282be730298 100644
--- a/drivers/media/video/zoran_card.c
+++ b/drivers/media/video/zoran_card.c
@@ -988,7 +988,7 @@ zoran_open_init_params (struct zoran *zr)
         zr->v4l_grab_seq = 0;
         zr->v4l_settings.width = 192;
         zr->v4l_settings.height = 144;
-        zr->v4l_settings.format = &zoran_formats[4];    /* YUY2 - YUV-4:2:2 packed */
+        zr->v4l_settings.format = &zoran_formats[7];    /* YUY2 - YUV-4:2:2 packed */
         zr->v4l_settings.bytesperline =
             zr->v4l_settings.width *
             ((zr->v4l_settings.format->depth + 7) / 8);
diff --git a/drivers/media/video/zoran_driver.c b/drivers/media/video/zoran_driver.c
index ec6f59674b10..2dab9eea4def 100644
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -134,7 +134,7 @@ const struct zoran_format zoran_formats[] = {
         }, {
                 .name = "16-bit RGB BE",
                 ZFMT(-1,
-                     V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
+                     V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
                 .depth = 16,
                 .flags = ZORAN_FORMAT_CAPTURE |
                          ZORAN_FORMAT_OVERLAY,
@@ -2737,7 +2737,8 @@ zoran_do_ioctl (struct inode *inode,
                                     fh->v4l_settings.format->fourcc;
                                 fmt->fmt.pix.colorspace =
                                     fh->v4l_settings.format->colorspace;
-                                fmt->fmt.pix.bytesperline = 0;
+                                fmt->fmt.pix.bytesperline =
+                                    fh->v4l_settings.bytesperline;
                                 if (BUZ_MAX_HEIGHT <
                                     (fh->v4l_settings.height * 2))
                                         fmt->fmt.pix.field =
@@ -2833,13 +2834,6 @@ zoran_do_ioctl (struct inode *inode,
                                 fmt->fmt.pix.pixelformat,
                                 (char *) &printformat);
 
-                        if (fmt->fmt.pix.bytesperline > 0) {
-                                dprintk(5,
-                                        KERN_ERR "%s: bpl not supported\n",
-                                        ZR_DEVNAME(zr));
-                                return -EINVAL;
-                        }
-
                         /* we can be requested to do JPEG/raw playback/capture */
                         if (!
                             (fmt->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ||
@@ -2923,6 +2917,7 @@ zoran_do_ioctl (struct inode *inode,
                                 fh->jpg_buffers.buffer_size =
                                     zoran_v4l2_calc_bufsize(&fh->
                                                             jpg_settings);
+                                fmt->fmt.pix.bytesperline = 0;
                                 fmt->fmt.pix.sizeimage =
                                     fh->jpg_buffers.buffer_size;
 
@@ -2979,6 +2974,8 @@ zoran_do_ioctl (struct inode *inode,
 
                                 /* tell the user the
                                  * results/missing stuff */
+                                fmt->fmt.pix.bytesperline =
+                                        fh->v4l_settings.bytesperline;
                                 fmt->fmt.pix.sizeimage =
                                         fh->v4l_settings.height *
                                         fh->v4l_settings.bytesperline;