ecrement "rest" variable twice,
   and forget to advance "buf" pointer by "nlen" bytes.
This bug was not hit previously because the output handler in
drivers/char/hvc_console.c splits given output into 16 bytes
at maximum.

Reported-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>
@5