The uvcvideo driver's uvc_v4l2_open() method is called from videodev's
video_open() function, which means it is called with the videodev_lock
mutex held.  uvc_v4l2_open() then takes uvc_driver.open_mutex to check
dev->state and avoid racing against a device disconnect, which means
that open_mutex must nest inside videodev_lock.

However uvc_disconnect() takes the open_mutex around setting
dev->state and also around putting its device reference.  However, if
uvc_disconnect() ends up dropping the last reference, it will call
uvc_delete(), which calls into the videodev code to unregister its
device, and this will end up taking videodev_lock.  This opens a
(unlikely in practice) window for an AB-BA deadlock and also causes a
lockdep warning because of the lock misordering.

Fortunately there is no apparent reason to hold open_mutex when doing
kref_put() in uvc_disconnect(): if uvc_v4l2_open() runs before the
state is set to UVC_DEV_DISCONNECTED, then it will take another
reference to the device and kref_put() won't call uvc_delete; if
uvc_v4l2_open() runs after the state is set, it will run before
uvc_delete(), see the state, and return immediately -- uvc_delete()
does uvc_unregister_video() (and hence video_unregister_device(),
which is synchronized with videodev_lock) as its first thing, so there
is no risk of use-after-free in uvc_v4l2_open().

Bug diagnosed based on a lockdep warning reported by Romano Giannetti
<romano@dea.icai.upcomillas.es>.
Signed-off-by: NRoland Dreier <roland@digitalvampire.org>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

drivers/media/video/uvc/uvc_v4l2.c: In function `uvc_v4l2_mmap':
drivers/media/video/uvc/uvc_v4l2.c:1035: warning: 'buffer' might be used uninitialized in this function
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

/home/v4l/master/v4l/gspca.c: In function 'gspca_frame_add':
/home/v4l/master/v4l/gspca.c:222: warning: format '%d' expects type 'int', but argument 2 has type 'long int'
/home/v4l/master/v4l/gspca.c: In function 'dev_read':
/home/v4l/master/v4l/gspca.c:1568: warning: format '%d' expects type 'int', but argument 2 has type 'size_t'
/home/v4l/master/v4l/gspca.c:1618: warning: format '%d' expects type 'int', but argument 3 has type 'size_t'
Acked-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

1) Remove a useless initialisation of 'i'

2) Avoid clearing the memory allocated twice (once in 'kcalloc', once
   in 'sg_init_table')

3) Remove a test that can never trigger.  The function returns NULL in
   such a case, so we know that at this point 'pages[0]' != NULL
Signed-off-by: NChristophe Jaillet <jaillet.christophe@wanadoo.fr>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Fix casts of pointers to integers of different sizes in the ivtv framebuffer
driver.

These were introduced in patch 38eb6ba5b8487d15b020fe391d324edd2b659b03.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The tvaudio driver is using "official" I2C device IDs for internal
purpose. There must be some historical reason behind this but anyway,
it shouldn't do that. As the stored values are never used, the easiest
way to fix the problem is simply to remove them altogether.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

I2C_HW_SMBUS_OVFX2 is referenced in ovcamchip_core.c, but no bus uses
this driver ID, so we can remove the reference. As far as I can see,
the Cypress FX2 webcam is handled by a different driver (dvb-usb).
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The following patch updates saa7134 driver to add support for AVerMedia
M103 MiniPCI DVB-T Hybrid card.
Signed-off-by: NMassimo Piccioni <alsa@piccio.org>
[mchehab@infradead.org: fixed merge conflicts and a small codingstyle]
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The new revision of this board uses the same pci subsystem id as the first
revision, but uses a S5H1411 demodulator instead of the S5H1409.

In the case of the FusionHDTV7 Dual Express,
if s5h1409_attach fails, try s5h1411_attach.
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NTim Gardner <tim.gardner@canonical.com>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

UVC devices can report button events. The uvcvideo driver depends on
CONFIG_INPUT to report events to the input layer. This patch removes the hard
dependency by introducing a new CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV option.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

main:     Change the packet copy mechanism for userptr.
          Cannot do reqbufs ioctl when already done and count != 0.
          Accept count < frame size in read().
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

etoms:    Do not declare the webcams declared by the driver et61x251.
sonixb, sonixj:
          Do not declare the webcams declared by the driver sn9c102.
zc3xx:    Do not declare the webcams declared by the driver zc0301.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Also remove some blank lines that were used to split compat code at -devel
tree.
Signed-off-by: NHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

All submitted URBs must be killed at suspend time, but URB buffers don't have
to be freed. Avoiding a free on suspend/reallocate on resume lowers the presure
on system memory.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The swap device might still be asleep, so memory allocated in the resume
handler must use GFP_NOIO. Thanks to Oliver Neukum for catching and reporting
this bug.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Thanks to Oliver Neukum for catching and reporting this bug.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NAndoni Zubimendi <andoni.zubimendi@gmail.com>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

spca508:  Cleanup code.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

pac207:   Set the sizeimage to the max value for 352x288.
Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

main:     Parameter comp_fac removed.
main, pac207:
          get_buff_size op removed.
(all)     v4l2_pix_format in each subdriver.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHarvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

videodev2: New pixfmt
pac207:   Remove the specific decoding.
main:     get_buff_size operation added for the subdriver.
Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

The low (half) res modes of the spca561 are not spca561 compressed, but are
raw bayer, this patches fixes this and adds a PIX_FMT define for the GBRG
bayer format used by the spca561 in low res mode.
Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Done for conex, etoms, pac7311, sonixj, t613 and tv8532.
Code cleanup for some other subdrivers.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NHans de Goede <j.w.r.degoede@hhs.nl>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Change the Yuan MPC718 cards entry to use the correct GPIO pin for resetting
the Xceive 3028 tuner.  Thanks to Brian Hope <brian@hopefamily.info> for
taking the time and figuring out which pin to use.
Signed-off-by: NAndy Walls <awalls@radix.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

cx18: Add a missing reset recovery delay in cx18-i2c.c after
the final deassert.
Signed-off-by: NAndy Walls <awalls@radix.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

Added ID vendor/product for Clone Digital Webcam 11043.
Thanks to Ivan Brasil Fuzzer <ivan@fuzzer.com.br> for testing and data collection.
Signed-off-by: NDouglas Schilling Landgraf <dougsland@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

After adding support for AVerTVHD Volar, DVB_USB_CXUSB must
select MEDIA_TUNER_MXL5005S if !DVB_FE_CUSTOMISE
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

main:     Remove some vidioc_xx traces.
main:     read() did not work (user irq instead of mmap irq).
main:     Lack of v4l1 compat.
main:     Process loop inside kernel when no frame arriving.
main:     Double qbuf in read() when too many buffered frames.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

main, etoms, mars, pac207, pac7311, sonixb, sonixj, spca500, spca505:
	 Cleanup source.
sunplus: Compilation error when VIDEO_ADV_DEBUG set.
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>

When switching video standard, ensure that video GOP size remains
appropriately configured.
Signed-off-by: NMike Isely <isely@pobox.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>