2 files changed, 8 insertions, 7 deletions

diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 923174c54a1c..c115b39b8517 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -177,8 +177,14 @@ static int drm_addmap_core(struct drm_device * dev, unsigned int offset,
                                                      MTRR_TYPE_WRCOMB, 1);
                         }
                 }
-                if (map->type == _DRM_REGISTERS)
+                if (map->type == _DRM_REGISTERS) {
                         map->handle = ioremap(map->offset, map->size);
+                        if (!map->handle) {
+                                drm_free(map, sizeof(*map), DRM_MEM_MAPS);
+                                return -ENOMEM;
+                        }
+                }
+                                
                 break;
         case _DRM_SHM:
                 list = drm_find_matching_map(dev, map);
@@ -479,11 +485,6 @@ int drm_rmmap_ioctl(struct inode *inode, struct file *filp,
                 return -EINVAL;
         }
 
-        if (!map) {
-                mutex_unlock(&dev->struct_mutex);
-                return -EINVAL;
-        }
-
         /* Register and framebuffer maps are permanent */
         if ((map->type == _DRM_REGISTERS) || (map->type == _DRM_FRAME_BUFFER)) {
                 mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/char/drm/via_dmablit.c b/drivers/char/drm/via_dmablit.c
index 832de1d9ba7e..3dd1ed3d1bf5 100644
--- a/drivers/char/drm/via_dmablit.c
+++ b/drivers/char/drm/via_dmablit.c
@@ -560,7 +560,7 @@ via_init_dmablit(struct drm_device *dev)
                 blitq->head = 0;
                 blitq->cur = 0;
                 blitq->serviced = 0;
-                blitq->num_free = VIA_NUM_BLIT_SLOTS;
+                blitq->num_free = VIA_NUM_BLIT_SLOTS - 1;
                 blitq->num_outstanding = 0;
                 blitq->is_active = 0;
                 blitq->aborting = 0;