As reported by smatch:
	drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/platform/vivid/vivid-radio-rx.c:198 vivid_radio_rx_s_hw_freq_seek() error: buffer overflow 'vivid_radio_bands' 3 <= 3
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/usb/gspca/zc3xx.c:5994 transfer_update() info: ignoring unreachable code.

That happens because there's a return that it is never called,
as the work queue runs an infinite loop, except when the device is
put to sleep or an error happens.

When an error happens, a break statement is enough to go out of
the loop. So, let's remove the goto, as break is the typical
instruction used to end a loop.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/usb/gspca/zc3xx.c:6363 zcxx_s_ctrl() error: buffer overflow 'jpeg_qual' 3 <= 3
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

If userspace sends an invalid bandwidth, it should either return
EINVAL or switch to auto mode.

This driver will go past an array and program the hardware on a
wrong way if this happens.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
	drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
	drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/dvb-frontends/stv0288.c:137 stv0288_set_symbolrate() warn: inconsistent indenting
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/dvb-frontends/lgdt3306a.c:2104 lgdt3306a_DumpRegs() warn: inconsistent indenting
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/dvb-frontends/dib3000mc.c:134 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:144 dib3000mc_setup_pwm_state() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:420 dib3000mc_sleep() warn: inconsistent indenting
drivers/media/dvb-frontends/dib3000mc.c:453 dib3000mc_set_channel_cfg() warn: inconsistent indenting

The last one is actually due to a commented code. Let's rework
it, in order to remove the sparse warning without removing the
dead code, as it may be useful in the future.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/dvb-frontends/bcm3510.c:688 bcm3510_reset() warn: inconsistent indenting
drivers/media/dvb-frontends/bcm3510.c:711 bcm3510_clear_reset() warn: inconsistent indenting
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/usb/gspca/benq.c:239 sd_isoc_irq() warn: inconsistent indenting
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/usb/go7007/go7007-driver.c:452 frame_boundary() warn: variable dereferenced before check 'vb' (see line 449)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Using static const allows the compiler to optimize the code.

Before static const:
   text	   data	    bss	    dec	    hex	filename
   4982	    524	   1568	   7074	   1ba2	drivers/media/tuners/qt1010.o

After static const:
   text	   data	    bss	    dec	    hex	filename
   4714	    524	   1568	   6806	   1a96	drivers/media/tuners/qt1010.o
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

The streg_cbdata can have a negative error value. So, it should be
an integer, and not u8, as reported by smatch:
	drivers/media/radio/wl128x/fmdrv_common.c:1517 fmc_prepare() warn: assigning (-115) to unsigned variable 'fmdev->streg_cbdata'
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

There are some false-positive warnings produced by smatch:
	drivers/media/rc/ir-sony-decoder.c:129 ir_sony_decode() warn: missing break? reassigning 'data->state'
	drivers/media/rc/ir-sony-decoder.c:137 ir_sony_decode() warn: missing break? reassigning 'data->state'
	drivers/media/rc/ir-sony-decoder.c:165 ir_sony_decode() warn: missing break? reassigning 'data->state'

This is due to the logic used there to detect the need of a break.

While those are false positives, it is easy to get rid of them without
any drawbacks. The side effect is a cleaner function, with is good.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/platform/s5p-mfc/s5p_mfc.c:1340 s5p_mfc_runtime_resume() warn: this array is probably non-NULL. 'm_dev->alloc_ctx'

alloc_ctx can never be NULL, as it is embeeded inside the struct
s5p_mfc_dev.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/platform/s3c-camif/camif-capture.c:463 queue_setup() warn: variable dereferenced before check 'fmt' (see line 460)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/zoran/zoran_device.c:1594 zoran_init_hardware() warn: inconsistent indenting

Fix indent. While here, fix CodingStyle and remove dead code, as it
can always be recovered from git logs.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6

That happens because nof_inputs and nof_audio_inputs can be initialized
as IVTV_CARD_MAX_VIDEO_INPUTS, instead of IVTV_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/radio/radio-si476x.c:571 si476x_radio_do_post_powerup_init() warn: inconsistent indenting
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero
	drivers/media/i2c/saa717x.c:155 saa717x_read() warn: mask and shift to zero

This is done right at saa717x_write(), but the read function is
broken. Thankfully, there's just one place at saa717x driver that
uses multibyte read (for status report, via printk).

Yet, let's fix it. From saa717x_write(), it is clear that the
bytes are in little endian:
		mm1[4] = (value >> 16) & 0xff;
		mm1[3] = (value >> 8) & 0xff;
		mm1[2] = value & 0xff;

So, the same order should be valid for read too.

Compile-tested only.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/saa7164/saa7164-core.c:631 saa7164_irq() warn: variable dereferenced before check 'dev' (see line 621)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/ngene/ngene-core.c:1529 init_channel() error: we previously assumed 'chan->fe' could be null (see line 1521)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/saa7134/saa7134-cards.c:7197 saa7134_xc2028_callback() warn: inconsistent indenting
	drivers/media/pci/saa7134/saa7134-cards.c:7846 saa7134_board_init2() warn: inconsistent indenting
	drivers/media/pci/saa7134/saa7134-cards.c:7913 saa7134_board_init2() warn: inconsistent indenting

While here, fix a few CodingStyle issues on the affected code
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

As reported by smatch:
	drivers/media/pci/cx18/cx18-driver.c:807 cx18_init_struct2() error: buffer overflow 'cx->card->video_inputs' 6 <= 6

That happens because nof_inputs and nof_audio_inputs can be initialized
as CX18_CARD_MAX_VIDEO_INPUTS, instead of CX18_CARD_MAX_VIDEO_INPUTS - 1.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/rc/rc-main.c:749 rc_close() warn: inconsistent indenting

There's an extra space there.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/platform/am437x/am437x-vpfe.c: In function 'vpfe_get_subdev_input_index':
drivers/media/platform/am437x/am437x-vpfe.c:1679:27: warning: variable 'sdinfo' set but not used [-Wunused-but-set-variable]
  struct vpfe_subdev_info *sdinfo;
                           ^

Cc: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/platform/am437x/am437x-vpfe.c:513 vpfe_ccdc_set_params() warn: inconsistent indenting

Cc: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/platform/am437x/am437x-vpfe.c: In function 'vpfe_ccdc_update_raw_params':
drivers/media/platform/am437x/am437x-vpfe.c:430:38: warning: variable 'config_params' set but not used [-Wunused-but-set-variable]
  struct vpfe_ccdc_config_params_raw *config_params =
                                      ^

vpfe_ccdc_update_raw_params() is supposed to update the raw
params at ccdc. However, it is just creating a local var and changing
it.

Compile-tested only.

Cc: Benoit Parrot <bparrot@ti.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

radio-bcm2048.c: In function 'bcm2048_i2c_driver_probe':
radio-bcm2048.c:2597:11: warning: variable 'skip_release' set but not used [-Wunused-but-set-variable]
  int err, skip_release = 0;
             ^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

In file included from include/uapi/linux/posix_types.h:4:0,
                 from include/uapi/linux/types.h:13,
                 from include/linux/types.h:5,
                 from include/uapi/linux/sysinfo.h:4,
                 from include/uapi/linux/kernel.h:4,
                 from include/linux/cache.h:4,
                 from include/linux/time.h:4,
                 from include/linux/input.h:11,
                 from drivers/media/usb/dvb-usb/dvb-usb.h:13,
                 from drivers/media/usb/dvb-usb/dib0700.h:13,
                 from drivers/media/usb/dvb-usb/dib0700_devices.c:9:
drivers/media/dvb-frontends/dib8000.h: In function 'dib8000_attach':
include/linux/stddef.h:8:14: warning: return makes integer from pointer without a cast [-Wint-conversion]
 #define NULL ((void *)0)
              ^
drivers/media/dvb-frontends/dib8000.h:72:9: note: in expansion of macro 'NULL'
  return NULL;
         ^
Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

In file included from drivers/media/common/b2c2/flexcop-fe-tuner.c:13:0:
drivers/media/dvb-frontends/cx24123.h:54:2: warning: 'cx24123_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
  cx24123_get_tuner_i2c_adapter(struct dvb_frontend *fe)
  ^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:46:0:
drivers/media/dvb-frontends/s921.h:40:2: warning: 's921_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
  s921_get_tuner_i2c_adapter(struct dvb_frontend *fe)
  ^
In file included from drivers/media/usb/em28xx/em28xx-dvb.c:55:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
  mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
  ^
In file included from drivers/media/usb/cx231xx/cx231xx-dvb.c:35:0:
drivers/media/dvb-frontends/mb86a20s.h:49:2: warning: 'mb86a20s_get_tuner_i2c_adapter' defined but not used [-Wunused-function]
  mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
  ^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Fix these compiler warnings that appeared after switching to gcc-5.1.0:

drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_power':
drivers/media/platform/s3c-camif/camif-capture.c:118:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.power_count)
          ^
drivers/media/platform/s3c-camif/camif-capture.c: In function 'sensor_set_streaming':
drivers/media/platform/s3c-camif/camif-capture.c:134:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == camif->sensor.stream_count)
          ^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Fix these compiler warnings that appeared after switching to gcc-5.1.0:

drivers/media/i2c/s5k5baf.c: In function 's5k5baf_set_power':
drivers/media/i2c/s5k5baf.c:1057:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on != state->power)
          ^
drivers/media/i2c/s5k6aa.c: In function 's5k6aa_set_power':
drivers/media/i2c/s5k6aa.c:878:10: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  if (!on == s5k6aa->power) {
          ^
drivers/media/i2c/s5c73m3/s5c73m3-core.c: In function 's5c73m3_oif_set_power':
drivers/media/i2c/s5c73m3/s5c73m3-core.c:1456:17: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
  } else if (!on == state->power) {
                 ^
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

Fix typo.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

For these encodings the quantization range should be ignored, since
there is only one possible Y'CbCr encoding.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020_CONST_LUM.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

In order to be consistent with the other Y'CbCr encodings add
support for full range V4L2_YCBCR_ENC_BT2020.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>