drm/vmwgfx: Make sure backup_handle is always valid
authorSinclair Yeh <syeh@vmware.com>
Fri, 2 Jun 2017 05:50:57 +0000 (07:50 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 19 Sep 2017 01:34:05 +0000 (02:34 +0100)
commit39e9deea2d9a22401adc02b6e1065f38de47cad6
tree9e7de796cd281a7e83349680005917e39044ba12
parentcbd819ced4ac6b8127d6c9fe0abb941a968b71b0
drm/vmwgfx: Make sure backup_handle is always valid

When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

Cc: <stable@vger.kernel.org>
Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Gbp-Pq: Topic bugfix/x86
Gbp-Pq: Name drm-vmwgfx-Make-sure-backup_handle-is-always-valid.patch
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c