diff --git a/[refs] b/[refs]
index 60c4d23f15b4..303fe3da29e9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 636fa5c78c73901022ed6c20c50543af8811e050
+refs/heads/master: cb048d558690ba1468e6bb26b82594b4330fb21c
diff --git a/trunk/drivers/staging/gma500/psb_2d.c b/trunk/drivers/staging/gma500/psb_2d.c
index 94bce5c0648e..29959ded78fc 100644
--- a/trunk/drivers/staging/gma500/psb_2d.c
+++ b/trunk/drivers/staging/gma500/psb_2d.c
@@ -343,7 +343,7 @@ void psbfb_copyarea(struct fb_info *info,
 	if (unlikely(info->state != FBINFO_STATE_RUNNING))
 		return;
 
-	if (1 || (info->flags & FBINFO_HWACCEL_DISABLED))
+	if (info->flags & FBINFO_HWACCEL_DISABLED)
 		return cfb_copyarea(info, region);
 
 	/* psb_check_power_state(dev, PSB_DEVICE_SGX); */
diff --git a/trunk/drivers/staging/gma500/psb_fb.c b/trunk/drivers/staging/gma500/psb_fb.c
index 6499f28cb2af..665096f6a843 100644
--- a/trunk/drivers/staging/gma500/psb_fb.c
+++ b/trunk/drivers/staging/gma500/psb_fb.c
@@ -287,7 +287,7 @@ static int psbfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg
 			return -EFAULT;
 		if (l > 32)
 			return -EMSGSIZE;
-		if (copy_from_user(buf, p + 1, l))
+		if (copy_from_user(buf, p + 1, l * sizeof(u32)))
 			return -EFAULT;
 		psbfb_2d_submit(dev_priv, buf, l);
 		return 0;