Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  serial: add support for various Titan PCI cards
  vt_ioctl: return -EFAULT on copy_from_user errors
  serial: altera_uart: Proper section for altera_uart_remove
  tty: fix a little bug in scrup, vt.c
  altera_uart: Simplify altera_uart_console_putc
  altera_uart: Don't take spinlock in already protected functions
  TTY/n_gsm: potential double lock
  serial: bfin_5xx: fix typo in IER check
  serial: bfin_5xx: IRDA is not affected by anomaly 05000230
  serial_cs: add and sort IDs for serial and modem cards
  msm_serial: fix serial on trout

3 files changed, 9 insertions, 6 deletions

diff --git a/drivers/char/n_gsm.c b/drivers/char/n_gsm.c
index c4161d5e053d..e4089c432f15 100644
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -904,9 +904,7 @@ static void gsm_dlci_data_sweep(struct gsm_mux *gsm)
         int len;
         /* Priority ordering: We should do priority with RR of the groups */
         int i = 1;
-        unsigned long flags;
 
-        spin_lock_irqsave(&gsm->tx_lock, flags);
         while (i < NUM_DLCI) {
                 struct gsm_dlci *dlci;
 
@@ -927,7 +925,6 @@ static void gsm_dlci_data_sweep(struct gsm_mux *gsm)
                 if (len == 0)
                         i++;
         }
-        spin_unlock_irqrestore(&gsm->tx_lock, flags);
 }
 
 /**
@@ -2230,12 +2227,16 @@ static int gsmld_open(struct tty_struct *tty)
 static void gsmld_write_wakeup(struct tty_struct *tty)
 {
         struct gsm_mux *gsm = tty->disc_data;
+        unsigned long flags;
 
         /* Queue poll */
         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         gsm_data_kick(gsm);
-        if (gsm->tx_bytes < TX_THRESH_LO)
+        if (gsm->tx_bytes < TX_THRESH_LO) {
+                spin_lock_irqsave(&gsm->tx_lock, flags);
                 gsm_dlci_data_sweep(gsm);
+                spin_unlock_irqrestore(&gsm->tx_lock, flags);
+        }
 }
 
 /**
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 7cdb6ee569cd..1296c42ed5c6 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -304,7 +304,7 @@ static void scrup(struct vc_data *vc, unsigned int t, unsigned int b, int nr)
         d = (unsigned short *)(vc->vc_origin + vc->vc_size_row * t);
         s = (unsigned short *)(vc->vc_origin + vc->vc_size_row * (t + nr));
         scr_memmovew(d, s, (b - t - nr) * vc->vc_size_row);
-        scr_memsetw(d + (b - t - nr) * vc->vc_cols, vc->vc_video_erase_char,
+        scr_memsetw(d + (b - t - nr) * vc->vc_size_row, vc->vc_video_erase_char,
                     vc->vc_size_row * nr);
 }
 
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 6aa10284104a..cb19dbc52136 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -1303,7 +1303,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 if (!perm)
                         goto eperm;
                 ret = copy_from_user(&ui, up, sizeof(struct unimapinit));
-                if (!ret)
+                if (ret)
+                        ret = -EFAULT;
+                else
                         con_clear_unimap(vc, &ui);
                 break;
               }