[PATCH] uml: don't trash return value

From: Doug Dumitru <doug@easyco.com>

I have been fighting a buffering error when sending large amounts of data out
pty devices from UML.  I have tried a couple of patches that did not really
fix the problem (and were rightly rejected by the group), but have finally
found the real bug.

In /arch/um/drivers/line.c there is a function "buffer_data" that is
responsible for storing data into the lines ring buffer.  The function is
"supposed" to return the number of characters actually buffered.
Unfortunately, in the case where the buffer wraps, the "len" variable is
decremented by "end" before it is used as the return parameter.
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade_spam@yahoo.it>
Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

arch/um/drivers/line.c

@@ -73,9 +73,8 @@ static int buffer_data(struct line *line, const char *buf, int len)
 	else {
 		memcpy(line->tail, buf, end);
 		buf += end;
-		len -= end;
-		memcpy(line->buffer, buf, len);
-		line->tail = line->buffer + len;
+		memcpy(line->buffer, buf, len - end);
+		line->tail = line->buffer + len - end;
 	}
 
 	return(len);