r_list->map->handle == request.handle && 
r_list->user_token == (unsigned long) request.handle && 
int drm_rmmap_ioctl(struct inode *inode, struct file *filp,		    unsigned int cmd, unsigned long arg){	drm_file_t *priv = filp->private_data;	drm_device_t *dev = priv->head->dev;	drm_map_t request;	drm_local_map_t *map = NULL;	struct list_head *list;	int ret;	if (copy_from_user(&request, (drm_map_t __user *)arg, sizeof(request))) {		return -EFAULT;	}	down(&dev->struct_sem);	list_for_each(list, &dev->maplist->head) {		drm_map_list_t *r_list = list_entry(list, drm_map_list_t, head);		if (r_list->map &&		    r_list->map->handle == request.handle &&		    r_list->map->flags & _DRM_REMOVABLE) {			map = r_list->map;			break;		}	}	/* List has wrapped around to the head pointer, or its empty we didn't	 * find anything.	 */	if (list == (&dev->maplist->head)) {		up(&dev->struct_sem);		return -EINVAL;	}	if (!map)		return -EINVAL;	/* Register and framebuffer maps are permanent */	if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {		up(&dev->struct_sem);		return 0;	}	ret = drm_rmmap_locked(dev, map);	up(&dev->struct_sem);	return ret;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/d1f2b55ad2c11f46e30547a9f7754e99b478348e/drm_bufs.c/buggy/drivers/char/drm/drm_bufs.c