Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
  V4L/DVB (11652): au0828: fix kernel oops regression on USB disconnect.
  V4L/DVB (11626): cx23885: Two fixes for DViCO FusionHDTV DVB-T Dual Express
  V4L/DVB (11612): mx3_camera: Fix compilation with CONFIG_PM
  V4L/DVB (11570): patch: s2255drv: fix race condition on set mode
  V4L/DVB (11568): cx18: Fix the handling of i2c bus registration error
  V4L/DVB (11561a): move media after i2c
  V4L/DVB (11516): drivers/media/video/saa5246a.c: fix use-after-free
  V4L/DVB (11515): drivers/media/video/saa5249.c: fix use-after-free and leak
  V4L/DVB (11494a): cx231xx Kconfig fixes
  V4L/DVB (11494): cx18: Send correct input routing value to external audio multiplexers

11 files changed, 49 insertions, 41 deletions

diff --git a/drivers/Makefile b/drivers/Makefile
index 2618a6169a13..1266ead6ace0 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -36,7 +36,7 @@ obj-$(CONFIG_FB_INTEL)          += video/intelfb/
 
 obj-y                           += serial/
 obj-$(CONFIG_PARPORT)           += parport/
-obj-y                           += base/ block/ misc/ mfd/ media/
+obj-y                           += base/ block/ misc/ mfd/
 obj-$(CONFIG_NUBUS)             += nubus/
 obj-y                           += macintosh/
 obj-$(CONFIG_IDE)               += ide/
@@ -71,7 +71,7 @@ obj-$(CONFIG_GAMEPORT)		+= input/gameport/
 obj-$(CONFIG_INPUT)             += input/
 obj-$(CONFIG_I2O)               += message/
 obj-$(CONFIG_RTC_LIB)           += rtc/
-obj-y                           += i2c/
+obj-y                           += i2c/ media/
 obj-$(CONFIG_W1)                += w1/
 obj-$(CONFIG_POWER_SUPPLY)      += power/
 obj-$(CONFIG_HWMON)             += hwmon/
diff --git a/drivers/media/video/au0828/au0828-core.c b/drivers/media/video/au0828/au0828-core.c
index 4cee0b92eeee..a1e4c0d769a6 100644
--- a/drivers/media/video/au0828/au0828-core.c
+++ b/drivers/media/video/au0828/au0828-core.c
@@ -192,8 +192,6 @@ static int au0828_usb_probe(struct usb_interface *interface,
         dev->usbdev = usbdev;
         dev->boardnr = id->driver_info;
 
-        usb_set_intfdata(interface, dev);
-
         /* Create the v4l2_device */
         retval = v4l2_device_register(&interface->dev, &dev->v4l2_dev);
         if (retval) {
@@ -222,6 +220,10 @@ static int au0828_usb_probe(struct usb_interface *interface,
         /* Digital TV */
         au0828_dvb_register(dev);
 
+        /* Store the pointer to the au0828_dev so it can be accessed in
+           au0828_usb_disconnect */
+        usb_set_intfdata(interface, dev);
+
         printk(KERN_INFO "Registered device AU0828 [%s]\n",
                 dev->board.name == NULL ? "Unset" : dev->board.name);
 
diff --git a/drivers/media/video/cx18/cx18-audio.c b/drivers/media/video/cx18/cx18-audio.c
index 1519e91c677a..7a8ad5963de8 100644
--- a/drivers/media/video/cx18/cx18-audio.c
+++ b/drivers/media/video/cx18/cx18-audio.c
@@ -44,7 +44,7 @@ int cx18_audio_set_io(struct cx18 *cx)
 
         /* handle muxer chips */
         v4l2_subdev_call(cx->sd_extmux, audio, s_routing,
-                        in->audio_input, 0, 0);
+                         (u32) in->muxer_input, 0, 0);
 
         err = cx18_call_hw_err(cx, cx->card->hw_audio_ctrl,
                                audio, s_routing, in->audio_input, 0, 0);
diff --git a/drivers/media/video/cx18/cx18-i2c.c b/drivers/media/video/cx18/cx18-i2c.c
index b9b7064a2be8..8591e4fc359f 100644
--- a/drivers/media/video/cx18/cx18-i2c.c
+++ b/drivers/media/video/cx18/cx18-i2c.c
@@ -211,7 +211,7 @@ static struct i2c_algo_bit_data cx18_i2c_algo_template = {
 /* init + register i2c algo-bit adapter */
 int init_cx18_i2c(struct cx18 *cx)
 {
-        int i;
+        int i, err;
         CX18_DEBUG_I2C("i2c init\n");
 
         for (i = 0; i < 2; i++) {
@@ -268,8 +268,18 @@ int init_cx18_i2c(struct cx18 *cx)
         cx18_call_hw(cx, CX18_HW_GPIO_RESET_CTRL,
                      core, reset, (u32) CX18_GPIO_RESET_I2C);
 
-        return i2c_bit_add_bus(&cx->i2c_adap[0]) ||
-                i2c_bit_add_bus(&cx->i2c_adap[1]);
+        err = i2c_bit_add_bus(&cx->i2c_adap[0]);
+        if (err)
+                goto err;
+        err = i2c_bit_add_bus(&cx->i2c_adap[1]);
+        if (err)
+                goto err_del_bus_0;
+        return 0;
+
+ err_del_bus_0:
+        i2c_del_adapter(&cx->i2c_adap[0]);
+ err:
+        return err;
 }
 
 void exit_cx18_i2c(struct cx18 *cx)
diff --git a/drivers/media/video/cx231xx/Kconfig b/drivers/media/video/cx231xx/Kconfig
index 91156546a07a..477d4ab5e9ac 100644
--- a/drivers/media/video/cx231xx/Kconfig
+++ b/drivers/media/video/cx231xx/Kconfig
@@ -1,12 +1,11 @@
 config VIDEO_CX231XX
-       tristate "Conexant cx231xx USB video capture support"
-       depends on VIDEO_DEV && I2C && INPUT
-       select VIDEO_TUNER
-       select VIDEO_TVEEPROM
-       select VIDEO_IR
-       select VIDEOBUF_VMALLOC
-       select VIDEO_CX25840
-       select VIDEO_CX231XX_ALSA
+        tristate "Conexant cx231xx USB video capture support"
+        depends on VIDEO_DEV && I2C && INPUT
+        select VIDEO_TUNER
+        select VIDEO_TVEEPROM
+        select VIDEO_IR
+        select VIDEOBUF_VMALLOC
+        select VIDEO_CX25840
 
         ---help---
           This is a video4linux driver for Conexant 231xx USB based TV cards.
@@ -15,21 +14,22 @@ config VIDEO_CX231XX
           module will be called cx231xx
 
 config VIDEO_CX231XX_ALSA
-    tristate "Conexant Cx231xx ALSA audio module"
-       depends on VIDEO_CX231XX && SND
-       select SND_PCM
+        tristate "Conexant Cx231xx ALSA audio module"
+        depends on VIDEO_CX231XX && SND
+        select SND_PCM
 
-       ---help---
-         This is an ALSA driver for Cx231xx USB based TV cards.
+        ---help---
+          This is an ALSA driver for Cx231xx USB based TV cards.
 
-         To compile this driver as a module, choose M here: the
-         module will be called cx231xx-alsa
+          To compile this driver as a module, choose M here: the
+          module will be called cx231xx-alsa
 
 config VIDEO_CX231XX_DVB
-       tristate "DVB/ATSC Support for Cx231xx based TV cards"
-       depends on VIDEO_CX231XX && DVB_CORE
-       select VIDEOBUF_DVB
-       select MEDIA_TUNER_XC5000 if !DVB_FE_CUSTOMISE
-       ---help---
-         This adds support for DVB cards based on the
-         Conexant cx231xx chips.
+        tristate "DVB/ATSC Support for Cx231xx based TV cards"
+        depends on VIDEO_CX231XX && DVB_CORE
+        select VIDEOBUF_DVB
+        select MEDIA_TUNER_XC5000 if !DVB_FE_CUSTOMISE
+
+        ---help---
+          This adds support for DVB cards based on the
+          Conexant cx231xx chips.
diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
index a3c0565be1a9..6d6293f7d428 100644
--- a/drivers/media/video/cx23885/cx23885-cards.c
+++ b/drivers/media/video/cx23885/cx23885-cards.c
@@ -441,9 +441,9 @@ int cx23885_tuner_callback(void *priv, int component, int command, int arg)
         case CX23885_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL_EXP:
                 /* Two identical tuners on two different i2c buses,
                  * we need to reset the correct gpio. */
-                if (port->nr == 0)
+                if (port->nr == 1)
                         bitmask = 0x01;
-                else if (port->nr == 1)
+                else if (port->nr == 2)
                         bitmask = 0x04;
                 break;
         }
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index f48454ab3900..0c49a98213c4 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -314,6 +314,7 @@ static struct zl10353_config dvico_fusionhdtv_xc3028 = {
         .demod_address = 0x0f,
         .if2           = 45600,
         .no_tuner      = 1,
+        .disable_i2c_gate_ctrl = 1,
 };
 
 static struct stv0900_config netup_stv0900_config = {
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index c462b811e994..2d0781118eb0 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -1063,10 +1063,6 @@ static struct soc_camera_host_ops mx3_soc_camera_host_ops = {
         .owner          = THIS_MODULE,
         .add            = mx3_camera_add_device,
         .remove         = mx3_camera_remove_device,
-#ifdef CONFIG_PM
-        .suspend        = mx3_camera_suspend,
-        .resume         = mx3_camera_resume,
-#endif
         .set_crop       = mx3_camera_set_crop,
         .set_fmt        = mx3_camera_set_fmt,
         .try_fmt        = mx3_camera_try_fmt,
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 5202cadb2aae..30f4698be90a 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -1237,6 +1237,7 @@ static int s2255_set_mode(struct s2255_dev *dev, unsigned long chn,
         buffer[1] = (u32) chn_rev;
         buffer[2] = CMD_SET_MODE;
         memcpy(&buffer[3], &dev->mode[chn], sizeof(struct s2255_mode));
+        dev->setmode_ready[chn] = 0;
         res = s2255_write_config(dev->udev, (unsigned char *)buffer, 512);
         if (debug)
                 dump_verify_mode(dev, mode);
@@ -1245,7 +1246,6 @@ static int s2255_set_mode(struct s2255_dev *dev, unsigned long chn,
 
         /* wait at least 3 frames before continuing */
         if (mode->restart) {
-                dev->setmode_ready[chn] = 0;
                 wait_event_timeout(dev->wait_setmode[chn],
                                    (dev->setmode_ready[chn] != 0),
                                    msecs_to_jiffies(S2255_SETMODE_TIMEOUT));
diff --git a/drivers/media/video/saa5246a.c b/drivers/media/video/saa5246a.c
index da47b2f05288..155804b061e9 100644
--- a/drivers/media/video/saa5246a.c
+++ b/drivers/media/video/saa5246a.c
@@ -1092,9 +1092,8 @@ static int saa5246a_probe(struct i2c_client *client,
         /* Register it */
         err = video_register_device(t->vdev, VFL_TYPE_VTX, -1);
         if (err < 0) {
-                kfree(t);
                 video_device_release(t->vdev);
-                t->vdev = NULL;
+                kfree(t);
                 return err;
         }
         return 0;
diff --git a/drivers/media/video/saa5249.c b/drivers/media/video/saa5249.c
index 48b27fe48087..271d6e931b75 100644
--- a/drivers/media/video/saa5249.c
+++ b/drivers/media/video/saa5249.c
@@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_client *client,
         /* Now create a video4linux device */
         t->vdev = video_device_alloc();
         if (t->vdev == NULL) {
+                kfree(t);
                 kfree(client);
                 return -ENOMEM;
         }
@@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_client *client,
         /* Register it */
         err = video_register_device(t->vdev, VFL_TYPE_VTX, -1);
         if (err < 0) {
-                kfree(t);
                 video_device_release(t->vdev);
-                t->vdev = NULL;
+                kfree(t);
                 return err;
         }
         return 0;