16 files changed, 82 insertions, 28 deletions

diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 939d1e512974..a6724019c66f 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -1299,7 +1299,7 @@ set_tvnorm(struct bttv *btv, unsigned int norm)
 
         tvnorm = &bttv_tvnorms[norm];
 
-        if (!memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
+        if (memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
                     sizeof (tvnorm->cropcap))) {
                 bttv_crop_reset(&btv->crop[0], norm);
                 btv->crop[1] = btv->crop[0]; /* current = default */
@@ -3800,11 +3800,34 @@ bttv_irq_next_video(struct bttv *btv, struct bttv_buffer_set *set)
                 if (!V4L2_FIELD_HAS_BOTH(item->vb.field) &&
                     (item->vb.queue.next != &btv->capture)) {
                         item = list_entry(item->vb.queue.next, struct bttv_buffer, vb.queue);
+                        /* Mike Isely <isely@pobox.com> - Only check
+                         * and set up the bottom field in the logic
+                         * below.  Don't ever do the top field.  This
+                         * of course means that if we set up the
+                         * bottom field in the above code that we'll
+                         * actually skip a field.  But that's OK.
+                         * Having processed only a single buffer this
+                         * time, then the next time around the first
+                         * available buffer should be for a top field.
+                         * That will then cause us here to set up a
+                         * top then a bottom field in the normal way.
+                         * The alternative to this understanding is
+                         * that we set up the second available buffer
+                         * as a top field, but that's out of order
+                         * since this driver always processes the top
+                         * field first - the effect will be the two
+                         * buffers being returned in the wrong order,
+                         * with the second buffer also being delayed
+                         * by one field time (owing to the fifo nature
+                         * of videobuf).  Worse still, we'll be stuck
+                         * doing fields out of order now every time
+                         * until something else causes a field to be
+                         * dropped.  By effectively forcing a field to
+                         * drop this way then we always get back into
+                         * sync within a single frame time.  (Out of
+                         * order fields can screw up deinterlacing
+                         * algorithms.) */
                         if (!V4L2_FIELD_HAS_BOTH(item->vb.field)) {
-                                if (NULL == set->top &&
-                                    V4L2_FIELD_TOP == item->vb.field) {
-                                        set->top = item;
-                                }
                                 if (NULL == set->bottom &&
                                     V4L2_FIELD_BOTTOM == item->vb.field) {
                                         set->bottom = item;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 7bd8a70f0a0b..ac947aecb9c3 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -383,6 +383,11 @@ static int snd_em28xx_hw_capture_free(struct snd_pcm_substream *substream)
 
 static int snd_em28xx_prepare(struct snd_pcm_substream *substream)
 {
+        struct em28xx *dev = snd_pcm_substream_chip(substream);
+
+        dev->adev.hwptr_done_capture = 0;
+        dev->adev.capture_transfer_done = 0;
+
         return 0;
 }
 
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index 59400e858965..a27afeb6f39b 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -35,12 +35,25 @@ static
     const
         struct dmi_system_id s5k4aa_vflip_dmi_table[] = {
         {
+                .ident = "BRUNEINIT",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"),
+                        DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001")
+                }
+        }, {
                 .ident = "Fujitsu-Siemens Amilo Xa 2528",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
                 }
         }, {
+                .ident = "Fujitsu-Siemens Amilo Xi 2528",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528")
+                }
+        }, {
                 .ident = "Fujitsu-Siemens Amilo Xi 2550",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -57,6 +70,13 @@ static
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
+                        DMI_MATCH(DMI_BIOS_DATE, "12/02/2008")
+                }
+        }, {
+                .ident = "MSI GX700",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
                         DMI_MATCH(DMI_BIOS_DATE, "07/26/2007")
                 }
         }, {
diff --git a/drivers/media/video/gspca/mr97310a.c b/drivers/media/video/gspca/mr97310a.c
index 140c8f320e47..f8328b9efae5 100644
--- a/drivers/media/video/gspca/mr97310a.c
+++ b/drivers/media/video/gspca/mr97310a.c
@@ -483,7 +483,7 @@ static int start_cif_cam(struct gspca_dev *gspca_dev)
                 data[3] = 0x2c;                    /* reg 2, H size/8 */
                 data[4] = 0x48;                    /* reg 3, V size/4 */
                 data[6] = 0x06;                    /* reg 5, H start  */
-                data[8] = 0x06 + sd->sensor_type;  /* reg 7, V start  */
+                data[8] = 0x06 - sd->sensor_type;  /* reg 7, V start  */
                 break;
         }
         err_code = mr_write(gspca_dev, 11);
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
index 2f6e135d94bc..a5c190e93799 100644
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -2919,7 +2919,7 @@ static void ov518_pkt_scan(struct gspca_dev *gspca_dev,
         /* A false positive here is likely, until OVT gives me
          * the definitive SOF/EOF format */
         if ((!(data[0] | data[1] | data[2] | data[3] | data[5])) && data[6]) {
-                gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
+                frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
                 gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, 0);
                 sd->packet_nr = 0;
         }
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index 65489d6b0d89..bfae63f5584c 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -394,7 +394,8 @@ frame_data:
                         PDEBUG(D_PACK, "End of frame detected");
 
                         /* Complete the last frame (if any) */
-                        gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
+                        frame = gspca_frame_add(gspca_dev, LAST_PACKET,
+                                                frame, data, 0);
 
                         if (chunk_len)
                                 PDEBUG(D_ERR, "Chunk length is "
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 6952e9602d5d..51b683c63b70 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -26,6 +26,7 @@
 #include <linux/device.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/sched.h>
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
@@ -1432,7 +1433,9 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
                 icd->sense = &sense;
 
         cam_f.fmt.pix.pixelformat = cam_fmt->fourcc;
-        ret = v4l2_subdev_call(sd, video, s_fmt, f);
+        ret = v4l2_subdev_call(sd, video, s_fmt, &cam_f);
+        cam_f.fmt.pix.pixelformat = pix->pixelformat;
+        *pix = cam_f.fmt.pix;
 
         icd->sense = NULL;
 
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 9e3262c0ba37..2c0bb06cab3b 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -598,11 +598,6 @@ static int s2255_got_frame(struct s2255_dev *dev, int chn, int jpgsize)
         buf = list_entry(dma_q->active.next,
                          struct s2255_buffer, vb.queue);
 
-        if (!waitqueue_active(&buf->vb.done)) {
-                /* no one active */
-                rc = -1;
-                goto unlock;
-        }
         list_del(&buf->vb.queue);
         do_gettimeofday(&buf->vb.ts);
         dprintk(100, "[%p/%d] wakeup\n", buf, buf->vb.i);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 71145bff94fa..09013229d4aa 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3428,6 +3428,7 @@ struct saa7134_board saa7134_boards[] = {
                 .tuner_config   = 3,
                 .mpeg           = SAA7134_MPEG_DVB,
                 .ts_type        = SAA7134_MPEG_TS_SERIAL,
+                .ts_force_val   = 1,
                 .gpiomask       = 0x0800100, /* GPIO 21 is an INPUT */
                 .inputs         = {{
                         .name = name_tv,
diff --git a/drivers/media/video/saa7134/saa7134-ts.c b/drivers/media/video/saa7134/saa7134-ts.c
index 3fa652279ac0..03488ba4c99c 100644
--- a/drivers/media/video/saa7134/saa7134-ts.c
+++ b/drivers/media/video/saa7134/saa7134-ts.c
@@ -262,11 +262,13 @@ int saa7134_ts_start(struct saa7134_dev *dev)
         switch (saa7134_boards[dev->board].ts_type) {
         case SAA7134_MPEG_TS_PARALLEL:
                 saa_writeb(SAA7134_TS_SERIAL0, 0x40);
-                saa_writeb(SAA7134_TS_PARALLEL, 0xec);
+                saa_writeb(SAA7134_TS_PARALLEL, 0xec |
+                        (saa7134_boards[dev->board].ts_force_val << 4));
                 break;
         case SAA7134_MPEG_TS_SERIAL:
                 saa_writeb(SAA7134_TS_SERIAL0, 0xd8);
-                saa_writeb(SAA7134_TS_PARALLEL, 0x6c);
+                saa_writeb(SAA7134_TS_PARALLEL, 0x6c |
+                        (saa7134_boards[dev->board].ts_force_val << 4));
                 saa_writeb(SAA7134_TS_PARALLEL_SERIAL, 0xbc);
                 saa_writeb(SAA7134_TS_SERIAL1, 0x02);
                 break;
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 6ee3e9b7769e..f8697d46ff5f 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -360,6 +360,7 @@ struct saa7134_board {
         enum saa7134_mpeg_type  mpeg;
         enum saa7134_mpeg_ts_type ts_type;
         unsigned int            vid_port_opts;
+        unsigned int            ts_force_val:1;
 };
 
 #define card_has_radio(dev)   (NULL != saa7134_boards[dev->board].radio.name)
diff --git a/drivers/media/video/saa7164/saa7164-cmd.c b/drivers/media/video/saa7164/saa7164-cmd.c
index c45966edc0cf..9c1d3ac43869 100644
--- a/drivers/media/video/saa7164/saa7164-cmd.c
+++ b/drivers/media/video/saa7164/saa7164-cmd.c
@@ -347,7 +347,7 @@ int saa7164_cmd_send(struct saa7164_dev *dev, u8 id, tmComResCmd_t command,
 
         /* Prepare some basic command/response structures */
         memset(&command_t, 0, sizeof(command_t));
-        memset(&response_t, 0, sizeof(&response_t));
+        memset(&response_t, 0, sizeof(response_t));
         pcommand_t = &command_t;
         presponse_t = &response_t;
         command_t.id = id;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 65ac474c517a..2f78b4f263f5 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -1173,8 +1173,8 @@ static int get_scales(struct soc_camera_device *icd,
         width_in = scale_up(cam->ceu_rect.width, *scale_h);
         height_in = scale_up(cam->ceu_rect.height, *scale_v);
 
-        *scale_h = calc_generic_scale(cam->ceu_rect.width, icd->user_width);
-        *scale_v = calc_generic_scale(cam->ceu_rect.height, icd->user_height);
+        *scale_h = calc_generic_scale(width_in, icd->user_width);
+        *scale_v = calc_generic_scale(height_in, icd->user_height);
 
         return 0;
 }
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 59aa7a3694c2..36e617bd13c7 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1160,13 +1160,15 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
                 if (icd->iface == ici->nr) {
                         /* The bus->remove will be called */
                         device_unregister(&icd->dev);
-                        /* Not before device_unregister(), .remove
-                         * needs parent to call ici->ops->remove() */
-                        icd->dev.parent = NULL;
-
-                        /* If the host module is loaded again, device_register()
-                         * would complain "already initialised" */
-                        memset(&icd->dev.kobj, 0, sizeof(icd->dev.kobj));
+                        /*
+                         * Not before device_unregister(), .remove
+                         * needs parent to call ici->ops->remove().
+                         * If the host module is loaded again, device_register()
+                         * would complain "already initialised," since 2.6.32
+                         * this is also needed to prevent use-after-free of the
+                         * device private data.
+                         */
+                        memset(&icd->dev, 0, sizeof(icd->dev));
                 }
         }
 
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index c3225a561748..1b89735e62fd 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -348,7 +348,7 @@ static void uvc_ctrl_set_zoom(struct uvc_control_mapping *mapping,
         __s32 value, __u8 *data)
 {
         data[0] = value == 0 ? 0 : (value > 0) ? 1 : 0xff;
-        data[2] = min(abs(value), 0xff);
+        data[2] = min((int)abs(value), 0xff);
 }
 
 static struct uvc_control_mapping uvc_ctrl_mappings[] = {
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index f960e8ea4f17..a6e41d12b221 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -90,7 +90,8 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
                 ctrl->dwMaxVideoFrameSize =
                         frame->dwMaxVideoFrameBufferSize;
 
-        if (stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
+        if (!(format->flags & UVC_FMT_FLAG_COMPRESSED) &&
+            stream->dev->quirks & UVC_QUIRK_FIX_BANDWIDTH &&
             stream->intf->num_altsetting > 1) {
                 u32 interval;
                 u32 bandwidth;