Merge branch 'drm-patches' of master.kernel.org:/pub/scm/linux/kernel/git/airlied/drm-2.6

* 'drm-patches' of master.kernel.org:/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/i915: Add 965GM pci id update
  drm: just use io_remap_pfn_range on all archs..
  drm: fix DRM_CONSISTENT mapping
  drm: fix up mmap locking in preparation for ttm changes
  drm: fix driver deadlock with AIGLX and reclaim_buffers_locked
  drm: fix warning in drm_fops.c
  drm: allow for more generic drm ioctls
  drm: fix alpha domain handling
  via: fix CX700 pci id
  drm: make drm_io_prot static.
  drm: remove via_mm.h
  drm: add missing NULL assignment
  drm/radeon: Fix u32 overflows when determining AGP base address in card space.
  drm: port over use_vmalloc code from git hashtab
  drm: fix crash with fops lock and fixup sarea/page size locking
  drm: bring bufs code from git tree.
  drm: move protection stuff into separate function
  drm: Use ARRAY_SIZE macro when appropriate
  drm: update README.drm (bugzilla #7933)
  drm: remove unused exports

1 files changed, 6 insertions, 3 deletions

diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index f5b9b2480c14..26bec30ee86e 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -496,11 +496,14 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                   (long)old_encode_dev(priv->head->device),
                   priv->authenticated);
 
-        if (nr < DRIVER_IOCTL_COUNT)
-                ioctl = &drm_ioctls[nr];
-        else if ((nr >= DRM_COMMAND_BASE)
+        if ((nr >= DRIVER_IOCTL_COUNT) &&
+            ((nr < DRM_COMMAND_BASE) || (nr >= DRM_COMMAND_END)))
+                goto err_i1;
+        if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END)
                  && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
                 ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
+        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE))
+                ioctl = &drm_ioctls[nr];
         else
                 goto err_i1;