2 files changed, 9 insertions, 4 deletions

diff --git a/drivers/char/drm/drm.h b/drivers/char/drm/drm.h
index 8db9041e306c..089198491f16 100644
--- a/drivers/char/drm/drm.h
+++ b/drivers/char/drm/drm.h
@@ -654,11 +654,13 @@ typedef struct drm_set_version {
 
 /**
  * Device specific ioctls should only be in their respective headers
- * The device specific ioctl range is from 0x40 to 0x79.
+ * The device specific ioctl range is from 0x40 to 0x99.
+ * Generic IOCTLS restart at 0xA0.
  *
  * \sa drmCommandNone(), drmCommandRead(), drmCommandWrite(), and
  * drmCommandReadWrite().
  */
 #define DRM_COMMAND_BASE                0x40
+#define DRM_COMMAND_END                 0xA0
 
 #endif
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index f5b9b2480c14..26bec30ee86e 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -496,11 +496,14 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                   (long)old_encode_dev(priv->head->device),
                   priv->authenticated);
 
-        if (nr < DRIVER_IOCTL_COUNT)
-                ioctl = &drm_ioctls[nr];
-        else if ((nr >= DRM_COMMAND_BASE)
+        if ((nr >= DRIVER_IOCTL_COUNT) &&
+            ((nr < DRM_COMMAND_BASE) || (nr >= DRM_COMMAND_END)))
+                goto err_i1;
+        if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END)
                  && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
                 ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
+        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE))
+                ioctl = &drm_ioctls[nr];
         else
                 goto err_i1;