Error handling code following a kzalloc should free the allocated data.
Similarly for usb-alloc urb.

The semantic match that finds the first problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@

x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...x...+> }
(
x->f1 = E
|
 (x->f1 == NULL || ...)
|
 f(...,x->f1,...)
)
...>
(
 return \(0\|<+...x...+>\|ptr\);
|
 return@p2 ...;
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The reg_pair2[j].reg was tested twice.

Cc: <stable@kernel.org>
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Acked-by: NMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

All read transactions initiated by firedtv are only quadlet-sized, hence
the backend->read call can be simplified a little.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Packet DMA buffers are queued either initially all at once (then, a
queueing failure will cause firedtv to release the DMA context as a
whole) or subsequently one by one as they recycled after use (then a
failure is extremely unlikely).  Therefore we can be a little less
cautious when counting at which packet buffer to set the interrupt flag.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Cache only addresses of whole pages, not of each buffer chunk.  Besides,
page addresses can be obtained by page_address() instead of kmap() since
they were allocated in lowmem.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add Prof 7301 PCI DVB-S2 card

The card based on stv0903 demod, stb6100 tuner.
Signed-off-by: NIgor M. Liplianin <liplianin@me.by>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Remove duplicated #include('s) in
  drivers/media/dvb/pt1/pt1.c
Signed-off-by: NHuang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Patch adds autosuspend support for mr800 radio driver.
Signed-off-by: NOliver Neukum <oliver@neukum.org>
Acked-by: NAlexey Klimov <klimov.linux@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The firedtv DVB driver will now work not only on top of the old ieee1394
driver stack but also on the new firewire driver stack.

Alongside to the firedtv-1394.c backend for driver binding and I/O, the
firedtv-fw.c backend is added.  Depending on which of the two 1394
stacks is configured, one or the other or both backends will be built
into the firedtv driver.

This has been tested with a DVB-T and a DVB-C box on x86-64 and x86-32
together with a few different controllers (Agere FW323, a NEC chip, TI
TSB82AA2, TSB43AB22/A, VIA VT6306).
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add #include <dvb_demux.h> for dvb_dmx_swfilter_packets().  This was
already indirectly included via firedtv.h, but don't rely on it.

The 4 bytes which were referred to as FIREWIRE_HEADER_SIZE are actually
the source packet header from IEC 61883-4 (MPEG2-TS data transmission
over 1394), not e.g. the IEEE 1394 isochronous packet header.  So choose
a more precise name.

Also, express the payload size as a preprocessor constant too.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Preparation for the port of firedtv to the firewire-core kernel API:
The fdtv->backend->lock() hook and thus the CMP code is slightly changed
to better fit with the new API.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Preparation for the port of firedtv to the firewire-core kernel API:
Canceling of the remote control workqueue job is factored into
firedtv-rc.c.  Plus trivial whitespace change.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This initialization of the value of audio_mode is the one used if nothing
matches in the subsequent switch.  The variable audio_mode is subsequently
assigned to constants such as TUNER_AUDIO_MONO and TUNER_AUDIO_STEREO.
TUNER_AUDIO_STEREO has the same value as V4L2_TUNER_MODE_STEREO, so it
would seem better to use that value here.
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NHIRANO Takahito <hiranotaka@zng.info>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NMarton Nemeth <nm127@freemail.hu>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NMarton Nemeth <nm127@freemail.hu>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The valid values for these controls are 0..3 (lower two bits) which was
identified by trial and error on Labtec Webcam 2200 (USB ID 093a:2626).
The upper 6 bits are ignored on page 0, registers 0xc5 and 0xc7 by the camera.
Signed-off-by: NMárton Németh <nm127@freemail.hu>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

- the i2c base address is now taken from the sn9c1xx register table
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The usb_control_msg() can fail any time. Only continue writing
sequence if there was no error with the previous write. If there
was any problem stop sending URBs and propagate the error to the
gspca_main.
Signed-off-by: NMárton Németh <nm127@freemail.hu>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The stream off command is sent to the device twice, one is enough.
Signed-off-by: NMárton Németh <nm127@freemail.hu>
Signed-off-by: NJean-Francois Moine <moinejf@free.fr>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Make id signed so we can't get an invalid pointer when we pass a negative
id.
Signed-off-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

In driver ./drivers/media/video/usbvideo/quickcam_messenger.c in line 91:

  91         usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));

After this line we use strncat:

  92         strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));

where sizeof(cam->input_physname) returns length of cam->input_phisname
without length for null-symbol.  But this parameter must be - "maximum
numbers of bytes to copy", i.e.:
sizeof(cam->input_physname)-strlen(cam->input_physname)-1.

In this case, after call to usb_make_path the similar drivers use strlcat.

Like in: drivers/hid/usbhid/hid-core.c:
1152         usb_make_path(dev, hid->phys, sizeof(hid->phys));
1153         strlcat(hid->phys, "/input", sizeof(hid->phys));

Found by Linux Driver Verification Project.

Use strlcat instead of strncat.
Signed-off-by: NAlexander Strakh <strakh@ispras.ru>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

In driver ./drivers/media/video/usbvideo/konicawc.c in line 227:

227         usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));

After this line we use strncat:

228         strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));

where sizeof(cam->input_physname) returns length of cam->input_phisname
without length for null-symbol.  But this parameter must be - "maximum
numbers of bytes to copy", i.e.:
sizeof(cam->input_physname)-strlen(cam->input_physname)-1.

In this case, after call to usb_make_path the similar drivers use strlcat.

Like in drivers/hid/usbhid/hid-core.c:
1152         usb_make_path(dev, hid->phys, sizeof(hid->phys));
1153         strlcat(hid->phys, "/input", sizeof(hid->phys));

Found by Linux Driver Verification Project.

Use strlcat instead of strncat.
Signed-off-by: NAlexander Strakh <strakh@ispras.ru>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

The videobuf_queue_ops function vector is not declared constant, but
there's no need for the videobuf layer to ever change it.  Make it const
so that videobuf users can make their operations const without warnings.
Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

X-Patchwork-Id: 55873

Add support for cxusb card Mygica D689 DBM-TH USB
Signed-off-by: NDavid T. L. Wong <davidtlwong@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Adds support for cx23885 card Mygica X8558 Pro DMB-TH
Signed-off-by: NDavid T. L. Wong <davidtlwong@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Adds support for Maxim MAX2165 silicon tuner.

It was tested on Mygica X8558Pro, which has MAX2165, ATBM8830 and CX23885.
Signed-off-by: NDavid T. L. Wong <davidtlwong@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Adds support for Maxim MAX2165 silicon tuner.

It is tested on Mygica X8558Pro, which has MAX2165, ATBM8830 and CX23885
Signed-off-by: NDavid T. L. Wong <davidtlwong@gmail.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Add USB ID 1b80:e39d for Sveon STV20 Tuner USB DVB-T HDTV.
Signed-off-by: NIgnacio de Miguel Diaz <imigueldiaz@gmail.com>
Signed-off-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

E3C EC168 DVB USB driver
Signed-off-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

E3C EC100 DVB-T demodulator driver
Signed-off-by: NAntti Palosaari <crope@iki.fi>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

With a lower bandwidth setup, the Transport Stream gets corrupted due to
TSFIFO overrun. The patch fixes the issue.

The issue is seen with Transport Streams having a Symbol Rate of 22MSPS
and/or greater.
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

It had always the value 3 no matter what frequency was given.
Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

While here, also do some blind scan related fixes.
Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

V4L/DVB (13358): stv090x: add an additional check for packet delineator lock in stv090x_read_status in case of a tuned DVB-S2 signal
Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

This patch contains several fixes for the stv090x driver:
- added missing else
- use calculated timeout instead of fixed one
- use correct frequency when doing zigzag scan
- added missing read of GENCFG register
Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

V4L/DVB (13355): stv090x: fixes calculation of AGC2 and uses a different AGC2 threshold for cut 3 chips
Signed-off-by: NAndreas Regel <andreas.regel@gmx.de>
Signed-off-by: NManu Abraham <manu@linuxtv.org>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>