Very confused ioctl in tea575x - it is called via video_usercopy(), but
assumes that it still has userland pointers.  Fixed.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>