UPSTREAM: drm/vmwgfx: Make sure backup_handle is always valid

When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

BUG=chromium:737534
TEST=Build and run

Change-Id: I684a86b70cec46be9954dbcfb92d5996801cc91a
Cc: <stable@vger.kernel.org>
Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit 07678eca2cf9c9a1)
Reviewed-on: https://chromium-review.googlesource.com/557911
Reviewed-by: Sonny Rao <sonnyrao@chromium.org>