21 files changed, 60 insertions, 40 deletions

diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 12a26b979bf1..f2f9b39b274a 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -231,6 +231,6 @@ __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
 }
 
 unsigned long
-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
+copy_user_handle_tail(char *to, char *from, unsigned len);
 
 #endif /* _ASM_X86_UACCESS_64_H */
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index c905e89e19fe..1f33b3d1fd68 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -69,21 +69,20 @@ EXPORT_SYMBOL(copy_in_user);
  * it is not necessary to optimize tail handling.
  */
 __visible unsigned long
-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
+copy_user_handle_tail(char *to, char *from, unsigned len)
 {
-        char c;
-        unsigned zero_len;
-
         for (; len; --len, to++) {
+                char c;
+
                 if (__get_user_nocheck(c, from++, sizeof(char)))
                         break;
                 if (__put_user_nocheck(c, to, sizeof(char)))
                         break;
         }
-
-        for (c = 0, zero_len = len; zerorest && zero_len; --zero_len)
-                if (__put_user_nocheck(c, to++, sizeof(char)))
-                        break;
         clac();
+
+        /* If the destination is a kernel buffer, we always clear the end */
+        if ((unsigned long)to >= TASK_SIZE_MAX)
+                memset(to, 0, len);
         return len;
 }
diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
index 5d2d8f45b4b6..67faa8d6950e 100644
--- a/drivers/media/dvb-frontends/rtl2832.c
+++ b/drivers/media/dvb-frontends/rtl2832.c
@@ -1240,7 +1240,7 @@ static int rtl2832_probe(struct i2c_client *client,
         dev->regmap_config.max_register = 5 * 0x100,
         dev->regmap_config.ranges = regmap_range_cfg,
         dev->regmap_config.num_ranges = ARRAY_SIZE(regmap_range_cfg),
-        dev->regmap_config.cache_type = REGCACHE_RBTREE,
+        dev->regmap_config.cache_type = REGCACHE_NONE,
         dev->regmap = regmap_init(&client->dev, &regmap_bus, client,
                                   &dev->regmap_config);
         if (IS_ERR(dev->regmap)) {
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index e4901a503c73..63c0ee5d0bf5 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1339,14 +1339,13 @@ static int vidioc_querycap(struct file *file, void  *priv,
         strlcpy(cap->driver, dev->name, sizeof(cap->driver));
         strlcpy(cap->card, cx23885_boards[tsport->dev->board].name,
                 sizeof(cap->card));
-        sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
-        cap->capabilities =
-                V4L2_CAP_VIDEO_CAPTURE |
-                V4L2_CAP_READWRITE     |
-                V4L2_CAP_STREAMING     |
-                0;
+        sprintf(cap->bus_info, "PCIe:%s", pci_name(dev->pci));
+        cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE |
+                           V4L2_CAP_STREAMING;
         if (dev->tuner_type != TUNER_ABSENT)
-                cap->capabilities |= V4L2_CAP_TUNER;
+                cap->device_caps |= V4L2_CAP_TUNER;
+        cap->capabilities = cap->device_caps | V4L2_CAP_VBI_CAPTURE |
+                V4L2_CAP_AUDIO | V4L2_CAP_DEVICE_CAPS;
 
         return 0;
 }
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 12f7452edce3..a92ff4249d10 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1845,6 +1845,9 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
         struct s5p_jpeg_addr jpeg_addr;
         u32 pix_size, padding_bytes = 0;
 
+        jpeg_addr.cb = 0;
+        jpeg_addr.cr = 0;
+
         pix_size = ctx->cap_q.w * ctx->cap_q.h;
 
         if (ctx->mode == S5P_JPEG_ENCODE) {
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c b/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
index e8c2cad93962..0974b9a7a584 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c
@@ -20,7 +20,7 @@
 
 void exynos3250_jpeg_reset(void __iomem *regs)
 {
-        u32 reg = 0;
+        u32 reg = 1;
         int count = 1000;
 
         writel(1, regs + EXYNOS3250_SW_RESET);
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 8e44a59d8ec2..98374e8bad3e 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -833,6 +833,7 @@ static int s5p_mfc_open(struct file *file)
         q->type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
         q->io_modes = VB2_MMAP;
         q->drv_priv = &ctx->fh;
+        q->lock = &dev->mfc_mutex;
         if (vdev == dev->vfd_dec) {
                 q->io_modes = VB2_MMAP;
                 q->ops = get_dec_queue_ops();
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
index 15f7663dd9f5..24262bbb1a35 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@@ -29,7 +29,7 @@
 
 /* Offset base used to differentiate between CAPTURE and OUTPUT
 *  while mmaping */
-#define DST_QUEUE_OFF_BASE      (TASK_SIZE / 2)
+#define DST_QUEUE_OFF_BASE      (1 << 30)
 
 #define MFC_BANK1_ALLOC_CTX     0
 #define MFC_BANK2_ALLOC_CTX     1
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h b/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
index de2b8c69daa5..22dfb3effda8 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr.h
@@ -302,7 +302,7 @@ struct s5p_mfc_hw_ops {
         void (*write_info)(struct s5p_mfc_ctx *ctx, unsigned int data,
                         unsigned int ofs);
         unsigned int (*read_info)(struct s5p_mfc_ctx *ctx,
-                        unsigned int ofs);
+                        unsigned long ofs);
         int (*get_dspl_y_adr)(struct s5p_mfc_dev *dev);
         int (*get_dec_y_adr)(struct s5p_mfc_dev *dev);
         int (*get_dspl_status)(struct s5p_mfc_dev *dev);
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
index 0c4fcf2dfd09..b09bcd140491 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
@@ -263,15 +263,15 @@ static void s5p_mfc_release_dev_context_buffer_v5(struct s5p_mfc_dev *dev)
 static void s5p_mfc_write_info_v5(struct s5p_mfc_ctx *ctx, unsigned int data,
                         unsigned int ofs)
 {
-        writel(data, (volatile void __iomem *)(ctx->shm.virt + ofs));
+        writel(data, (void *)(ctx->shm.virt + ofs));
         wmb();
 }
 
 static unsigned int s5p_mfc_read_info_v5(struct s5p_mfc_ctx *ctx,
-                                unsigned int ofs)
+                                unsigned long ofs)
 {
         rmb();
-        return readl((volatile void __iomem *)(ctx->shm.virt + ofs));
+        return readl((void *)(ctx->shm.virt + ofs));
 }
 
 static void s5p_mfc_dec_calc_dpb_size_v5(struct s5p_mfc_ctx *ctx)
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
index d826c58b5d53..cefad184fe96 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
@@ -1852,17 +1852,17 @@ static void s5p_mfc_write_info_v6(struct s5p_mfc_ctx *ctx, unsigned int data,
                 unsigned int ofs)
 {
         s5p_mfc_clock_on();
-        writel(data, (volatile void __iomem *)((unsigned long)ofs));
+        writel(data, (void *)((unsigned long)ofs));
         s5p_mfc_clock_off();
 }
 
 static unsigned int
-s5p_mfc_read_info_v6(struct s5p_mfc_ctx *ctx, unsigned int ofs)
+s5p_mfc_read_info_v6(struct s5p_mfc_ctx *ctx, unsigned long ofs)
 {
         int ret;
 
         s5p_mfc_clock_on();
-        ret = readl((volatile void __iomem *)((unsigned long)ofs));
+        ret = readl((void *)ofs);
         s5p_mfc_clock_off();
 
         return ret;
diff --git a/drivers/media/platform/s5p-tv/Kconfig b/drivers/media/platform/s5p-tv/Kconfig
index 5a1835dd65e8..697aaed42486 100644
--- a/drivers/media/platform/s5p-tv/Kconfig
+++ b/drivers/media/platform/s5p-tv/Kconfig
@@ -20,6 +20,7 @@ if VIDEO_SAMSUNG_S5P_TV
 config VIDEO_SAMSUNG_S5P_HDMI
         tristate "Samsung HDMI Driver"
         depends on VIDEO_V4L2
+        depends on I2C
         depends on VIDEO_SAMSUNG_S5P_TV
         select VIDEO_SAMSUNG_S5P_HDMIPHY
         help
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index a901b6248557..2554f3719b9e 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -1158,6 +1158,7 @@ static int sh_veu_probe(struct platform_device *pdev)
         }
 
         *vdev = sh_veu_videodev;
+        vdev->v4l2_dev = &veu->v4l2_dev;
         spin_lock_init(&veu->lock);
         mutex_init(&veu->fop_lock);
         vdev->lock = &veu->fop_lock;
diff --git a/drivers/media/platform/soc_camera/atmel-isi.c b/drivers/media/platform/soc_camera/atmel-isi.c
index 8526bf5c8429..c835beb2a1a8 100644
--- a/drivers/media/platform/soc_camera/atmel-isi.c
+++ b/drivers/media/platform/soc_camera/atmel-isi.c
@@ -843,6 +843,8 @@ static int isi_camera_set_bus_param(struct soc_camera_device *icd)
         if (isi->pdata.full_mode)
                 cfg1 |= ISI_CFG1_FULL_MODE;
 
+        cfg1 |= ISI_CFG1_THMASK_BEATS_16;
+
         isi_writel(isi, ISI_CTRL, ISI_CTRL_DIS);
         isi_writel(isi, ISI_CFG1, cfg1);
 
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index cee7b56f8404..66634b469c98 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -1665,7 +1665,7 @@ eclkreg:
 eaddpdev:
         platform_device_put(sasc->pdev);
 eallocpdev:
-        devm_kfree(ici->v4l2_dev.dev, sasc);
+        devm_kfree(ici->v4l2_dev.dev, info);
         dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
 
         return ret;
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 77dcfdf547ac..87fc0fe29ebd 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -780,8 +780,6 @@ static int rtl2832u_frontend_callback(void *adapter_priv, int component,
                 case TUNER_RTL2832_TUA9001:
                         return rtl2832u_tua9001_tuner_callback(d, cmd, arg);
                 }
-        default:
-                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/media/usb/gspca/Kconfig b/drivers/media/usb/gspca/Kconfig
index 60af3b167f3b..3fd94fe7e1eb 100644
--- a/drivers/media/usb/gspca/Kconfig
+++ b/drivers/media/usb/gspca/Kconfig
@@ -1,6 +1,7 @@
 menuconfig USB_GSPCA
         tristate "GSPCA based webcams"
         depends on VIDEO_V4L2
+        depends on INPUT || INPUT=n
         default m
         ---help---
           Say Y here if you want to enable selecting webcams based
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index bc08a829bc13..cc16e76a2493 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -3230,18 +3230,13 @@ int vb2_thread_stop(struct vb2_queue *q)
 
         if (threadio == NULL)
                 return 0;
-        call_void_qop(q, wait_finish, q);
         threadio->stop = true;
-        vb2_internal_streamoff(q, q->type);
-        call_void_qop(q, wait_prepare, q);
+        /* Wake up all pending sleeps in the thread */
+        vb2_queue_error(q);
         err = kthread_stop(threadio->thread);
-        q->fileio = NULL;
-        fileio->req.count = 0;
-        vb2_reqbufs(q, &fileio->req);
-        kfree(fileio);
+        __vb2_cleanup_fileio(q);
         threadio->thread = NULL;
         kfree(threadio);
-        q->fileio = NULL;
         q->threadio = NULL;
         return err;
 }
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index b481d20c8372..69e0483adfee 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -632,8 +632,7 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         }
 
         /* extract page list from userspace mapping */
-        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma,
-                                    dma_dir == DMA_FROM_DEVICE);
+        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir);
         if (ret) {
                 unsigned long pfn;
                 if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
diff --git a/include/media/atmel-isi.h b/include/media/atmel-isi.h
index c2e570336269..6008b0985b7b 100644
--- a/include/media/atmel-isi.h
+++ b/include/media/atmel-isi.h
@@ -59,6 +59,10 @@
 #define         ISI_CFG1_FRATE_DIV_MASK         (7 << 8)
 #define ISI_CFG1_DISCR                          (1 << 11)
 #define ISI_CFG1_FULL_MODE                      (1 << 12)
+/* Definition for THMASK(ISI_V2) */
+#define         ISI_CFG1_THMASK_BEATS_4         (0 << 13)
+#define         ISI_CFG1_THMASK_BEATS_8         (1 << 13)
+#define         ISI_CFG1_THMASK_BEATS_16        (2 << 13)
 
 /* Bitfields in CFG2 */
 #define ISI_CFG2_GRAYSCALE                      (1 << 13)
diff --git a/kernel/module.c b/kernel/module.c
index 99fdf94efce8..ec53f594e9c9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2479,6 +2479,23 @@ static int elf_header_check(struct load_info *info)
         return 0;
 }
 
+#define COPY_CHUNK_SIZE (16*PAGE_SIZE)
+
+static int copy_chunked_from_user(void *dst, const void __user *usrc, unsigned long len)
+{
+        do {
+                unsigned long n = min(len, COPY_CHUNK_SIZE);
+
+                if (copy_from_user(dst, usrc, n) != 0)
+                        return -EFAULT;
+                cond_resched();
+                dst += n;
+                usrc += n;
+                len -= n;
+        } while (len);
+        return 0;
+}
+
 /* Sets info->hdr and info->len. */
 static int copy_module_from_user(const void __user *umod, unsigned long len,
                                   struct load_info *info)
@@ -2498,7 +2515,7 @@ static int copy_module_from_user(const void __user *umod, unsigned long len,
         if (!info->hdr)
                 return -ENOMEM;
 
-        if (copy_from_user(info->hdr, umod, info->len) != 0) {
+        if (copy_chunked_from_user(info->hdr, umod, info->len) != 0) {
                 vfree(info->hdr);
                 return -EFAULT;
         }