1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index fc54140551a7..564138714bb5 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -470,17 +470,18 @@ int drm_ioctl(struct inode *inode, struct file *filp,
         if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END) &&
             (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
                 ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
-        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE))
+        else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
                 ioctl = &drm_ioctls[nr];
-        else
+                cmd = ioctl->cmd;
+        } else
                 goto err_i1;
 
+        /* Do not trust userspace, use our own definition */
         func = ioctl->func;
         /* is there a local override? */
         if ((nr == DRM_IOCTL_NR(DRM_IOCTL_DMA)) && dev->driver->dma_ioctl)
                 func = dev->driver->dma_ioctl;
 
-
         if (!func) {
                 DRM_DEBUG("no function\n");
                 retcode = -EINVAL;