1 files changed, 14 insertions, 3 deletions

diff --git a/drivers/char/drm/drm_context.c b/drivers/char/drm/drm_context.c
index a7cfabd1ca2e..f515567e5b6f 100644
--- a/drivers/char/drm/drm_context.c
+++ b/drivers/char/drm/drm_context.c
@@ -212,6 +212,7 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
         drm_ctx_priv_map_t __user *argp = (void __user *)arg;
         drm_ctx_priv_map_t request;
         drm_map_t *map;
+        drm_map_list_t *_entry;
 
         if (copy_from_user(&request, argp, sizeof(request)))
                 return -EFAULT;
@@ -225,7 +226,17 @@ int drm_getsareactx(struct inode *inode, struct file *filp,
         map = dev->context_sareas[request.ctx_id];
         up(&dev->struct_sem);
 
-        request.handle = (void *) map->offset;
+        request.handle = 0;
+        list_for_each_entry(_entry, &dev->maplist->head,head) {
+                if (_entry->map == map) {
+                        request.handle = (void *)(unsigned long)_entry->user_token;
+                        break;
+                }
+        }
+        if (request.handle == 0)
+                return -EINVAL;
+
+
         if (copy_to_user(argp, &request, sizeof(request)))
                 return -EFAULT;
         return 0;
@@ -262,7 +273,7 @@ int drm_setsareactx(struct inode *inode, struct file *filp,
         list_for_each(list, &dev->maplist->head) {
                 r_list = list_entry(list, drm_map_list_t, head);
                 if (r_list->map
-                    && r_list->map->offset == (unsigned long) request.handle)
+                    && r_list->user_token == (unsigned long) request.handle)
                         goto found;
         }
 bad:
@@ -369,7 +380,7 @@ int drm_resctx( struct inode *inode, struct file *filp,
                 for ( i = 0 ; i < DRM_RESERVED_CONTEXTS ; i++ ) {
                         ctx.handle = i;
                         if ( copy_to_user( &res.contexts[i],
-                                           &i, sizeof(i) ) )
+                                           &ctx, sizeof(ctx) ) )
                                 return -EFAULT;
                 }
         }