Invalid bound check of driver defined ioctls in drm_ioctl

Bug fd.o 2489
Reporter: Aapo Tahkola <aet@rasterburn.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

drivers/char/drm/drm_drv.c

@@ -516,7 +516,7 @@ int drm_ioctl( struct inode *inode, struct file *filp,
 	
 	if (nr < DRIVER_IOCTL_COUNT)
 		ioctl = &drm_ioctls[nr];
-	else if ((nr >= DRM_COMMAND_BASE) || (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
+	else if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
 		ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
 	else
 		goto err_i1;