4 files changed, 13 insertions, 17 deletions

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index cc1d6056ab70..a416645bcd23 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1806,6 +1806,8 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
 struct dma_buf *i915_gem_prime_export(struct drm_device *dev,
                                 struct drm_gem_object *gem_obj, int flags);
 
+void i915_gem_restore_fences(struct drm_device *dev);
+
 /* i915_gem_context.c */
 void i915_gem_context_init(struct drm_device *dev);
 void i915_gem_context_fini(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 06d66e09da17..97afd2639fb6 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2251,25 +2251,15 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
         }
 }
 
-static void i915_gem_reset_fences(struct drm_device *dev)
+void i915_gem_restore_fences(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         int i;
 
         for (i = 0; i < dev_priv->num_fence_regs; i++) {
                 struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
-
-                if (reg->obj)
-                        i915_gem_object_fence_lost(reg->obj);
-
-                i915_gem_write_fence(dev, i, NULL);
-
-                reg->pin_count = 0;
-                reg->obj = NULL;
-                INIT_LIST_HEAD(&reg->lru_list);
+                i915_gem_write_fence(dev, i, reg->obj);
         }
-
-        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
 }
 
 void i915_gem_reset(struct drm_device *dev)
@@ -2292,8 +2282,7 @@ void i915_gem_reset(struct drm_device *dev)
                 obj->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
         }
 
-        /* The fence registers are invalidated so clear them out */
-        i915_gem_reset_fences(dev);
+        i915_gem_restore_fences(dev);
 }
 
 /**
@@ -4003,8 +3992,6 @@ i915_gem_idle(struct drm_device *dev)
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 i915_gem_evict_everything(dev);
 
-        i915_gem_reset_fences(dev);
-
         /* Hack!  Don't let anybody do execbuf while we don't control the chip.
          * We need to replace this with a semaphore, or something.
          * And not confound mm.suspended!
@@ -4340,7 +4327,8 @@ i915_gem_load(struct drm_device *dev)
                 dev_priv->num_fence_regs = 8;
 
         /* Initialize fence registers to zero */
-        i915_gem_reset_fences(dev);
+        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
+        i915_gem_restore_fences(dev);
 
         i915_gem_detect_bit_6_swizzle(dev);
         init_waitqueue_head(&dev_priv->pending_flip_queue);
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 88b9a663944f..70db618989c4 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -394,6 +394,7 @@ int i915_restore_state(struct drm_device *dev)
 
         mutex_lock(&dev->struct_mutex);
 
+        i915_gem_restore_fences(dev);
         i915_restore_display(dev);
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index a4b71b25fa53..a30f29425c21 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
                 if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
                         return -EINVAL;
 
+                if (!access_ok(VERIFY_READ,
+                               (void *)(unsigned long)user_cmd.command,
+                               user_cmd.command_size))
+                        return -EFAULT;
+
                 ret = qxl_alloc_release_reserved(qdev,
                                                  sizeof(union qxl_release_info) +
                                                  user_cmd.command_size,