This is the start of the stable review cycle for the 4.9.118 release.
There are 32 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon Aug 6 08:26:35 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.118-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.118-rc1
Tony Battersby <tonyb(a)cybernetics.com>
scsi: sg: fix minor memory leak in error path
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: padlock-aes - Fix Nano workaround data corruption
Roman Kagan <rkagan(a)virtuozzo.com>
kvm: x86: vmx: fix vpid leak
Jiang Biao <jiang.biao2(a)zte.com.cn>
virtio_balloon: fix another race between migration and ballooning
Jeremy Cline <jcline(a)redhat.com>
net: socket: fix potential spectre v1 gadget in socketcall
Anton Vasilyev <vasilyev(a)ispras.ru>
can: ems_usb: Fix memory leak on ems_usb_disconnect()
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardenings
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardening
Jose Abreu <Jose.Abreu(a)synopsys.com>
net: stmmac: Fix WoL for PCI-based setups
Jeremy Cline <jcline(a)redhat.com>
netlink: Fix spectre v1 gadget in netlink_create()
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: Do not suspend/resume closed slave_dev
Eric Dumazet <edumazet(a)google.com>
ipv4: frags: handle possible skb truesize change
Eric Dumazet <edumazet(a)google.com>
inet: frag: enforce memory limits earlier
Eric Dumazet <edumazet(a)google.com>
bonding: avoid lockdep confusion in bond_get_stats()
Boqun Feng <boqun.feng(a)gmail.com>
sched/wait: Remove the lockless swait_active() check in swake_up*()
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
pinctrl: intel: Read back TX buffer state
Eric Dumazet <edumazet(a)google.com>
tcp: add one more quick ack after after ECN events
Yousuk Seung <ysseung(a)google.com>
tcp: refactor tcp_ecn_check_ce to remove sk type cast
Eric Dumazet <edumazet(a)google.com>
tcp: do not aggressively quick ack after ECN events
Eric Dumazet <edumazet(a)google.com>
tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode
Eric Dumazet <edumazet(a)google.com>
tcp: do not force quickack when receiving out-of-order packets
Dmitry Safonov <dima(a)arista.com>
netlink: Don't shift with UB on nlk->ngroups
Dmitry Safonov <dima(a)arista.com>
netlink: Do not subscribe to non-existent groups
Xiao Liang <xiliang(a)redhat.com>
xen-netfront: wait xenbus state change when load module manually
Neal Cardwell <ncardwell(a)google.com>
tcp_bbr: fix bw probing to raise in-flight data for very small BDPs
Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com>
NET: stmmac: align DMA stuff to largest cache line length
Anton Vasilyev <vasilyev(a)ispras.ru>
net: mdio-mux: bcm-iproc: fix wrong getter and setter pair
Stefan Wahren <stefan.wahren(a)i2se.com>
net: lan78xx: fix rx handling before first packet is send
tangpengpeng <tangpengpeng(a)higon.com>
net: fix amd-xgbe flow-control issue
Gal Pressman <pressmangal(a)gmail.com>
net: ena: Fix use of uninitialized DMA address bits field
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
ipv4: remove BUG_ON() from fib_compute_spec_dst
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/vmx.c | 7 ++--
drivers/crypto/padlock-aes.c | 8 +++-
drivers/gpu/drm/vc4/vc4_plane.c | 3 ++
drivers/net/bonding/bond_main.c | 14 ++++++-
drivers/net/can/usb/ems_usb.c | 1 +
drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 40 ++++++++++++++++++-
drivers/net/phy/mdio-mux-bcm-iproc.c | 2 +-
drivers/net/usb/lan78xx.c | 2 +
drivers/net/xen-netfront.c | 6 +++
drivers/pinctrl/intel/pinctrl-intel.c | 7 +++-
drivers/scsi/sg.c | 1 +
drivers/virtio/virtio_balloon.c | 2 +
fs/squashfs/block.c | 2 +
fs/squashfs/fragment.c | 13 ++++--
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 5 ++-
include/net/tcp.h | 2 +-
kernel/sched/swait.c | 6 ---
net/dsa/slave.c | 6 +++
net/ipv4/fib_frontend.c | 4 +-
net/ipv4/inet_fragment.c | 10 ++---
net/ipv4/ip_fragment.c | 5 +++
net/ipv4/tcp_bbr.c | 4 ++
net/ipv4/tcp_dctcp.c | 4 +-
net/ipv4/tcp_input.c | 48 ++++++++++++-----------
net/netlink/af_netlink.c | 7 ++++
net/socket.c | 2 +
31 files changed, 161 insertions(+), 62 deletions(-)
This is the start of the stable review cycle for the 4.14.61 release.
There are 23 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon Aug 6 08:26:30 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.61-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.61-rc1
Tony Battersby <tonyb(a)cybernetics.com>
scsi: sg: fix minor memory leak in error path
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: padlock-aes - Fix Nano workaround data corruption
Jack Morgenstein <jackm(a)dev.mellanox.co.il>
RDMA/uverbs: Expand primary and alt AV port checks
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: add more card IDs for 9000 series
Mike Rapoport <rppt(a)linux.vnet.ibm.com>
userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails
Yi Wang <wang.yi59(a)zte.com.cn>
audit: fix potential null dereference 'context->module.name'
Roman Kagan <rkagan(a)virtuozzo.com>
kvm: x86: vmx: fix vpid leak
Andy Lutomirski <luto(a)kernel.org>
x86/entry/64: Remove %ebx handling from error_entry/exit
Len Brown <len.brown(a)intel.com>
x86/apic: Future-proof the TSC_DEADLINE quirk for SKX
Jiang Biao <jiang.biao2(a)zte.com.cn>
virtio_balloon: fix another race between migration and ballooning
Jeremy Cline <jcline(a)redhat.com>
net: socket: fix potential spectre v1 gadget in socketcall
Anton Vasilyev <vasilyev(a)ispras.ru>
can: ems_usb: Fix memory leak on ems_usb_disconnect()
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardenings
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardening
Eli Cohen <eli(a)mellanox.com>
net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager
YueHaibing <yuehaibing(a)huawei.com>
rxrpc: Fix user call ID check in rxrpc_service_prealloc_one
Jose Abreu <Jose.Abreu(a)synopsys.com>
net: stmmac: Fix WoL for PCI-based setups
Jeremy Cline <jcline(a)redhat.com>
netlink: Fix spectre v1 gadget in netlink_create()
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: Do not suspend/resume closed slave_dev
Eric Dumazet <edumazet(a)google.com>
ipv4: frags: handle possible skb truesize change
Eric Dumazet <edumazet(a)google.com>
inet: frag: enforce memory limits earlier
Eric Dumazet <edumazet(a)google.com>
bonding: avoid lockdep confusion in bond_get_stats()
-------------
Diffstat:
Makefile | 4 +-
arch/x86/entry/entry_64.S | 18 ++----
arch/x86/kernel/apic/apic.c | 3 +
arch/x86/kvm/vmx.c | 7 +--
drivers/crypto/padlock-aes.c | 8 ++-
drivers/gpu/drm/vc4/vc4_plane.c | 3 +
drivers/infiniband/core/uverbs_cmd.c | 59 +++++++++++++++++--
drivers/net/bonding/bond_main.c | 14 ++++-
drivers/net/can/usb/ems_usb.c | 1 +
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 40 ++++++++++++-
drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 69 +++++++++++++++++++++++
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 5 ++
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 22 ++++++++
drivers/scsi/sg.c | 1 +
drivers/virtio/virtio_balloon.c | 2 +
fs/squashfs/block.c | 2 +
fs/squashfs/fragment.c | 13 +++--
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 5 +-
fs/userfaultfd.c | 4 +-
kernel/auditsc.c | 13 +++--
net/dsa/slave.c | 6 ++
net/ipv4/inet_fragment.c | 10 ++--
net/ipv4/ip_fragment.c | 5 ++
net/netlink/af_netlink.c | 2 +
net/rxrpc/call_accept.c | 4 +-
net/socket.c | 2 +
28 files changed, 276 insertions(+), 51 deletions(-)
This is the start of the stable review cycle for the 4.17.13 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon Aug 6 08:26:21 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.17.13-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.17.13-rc1
Tony Battersby <tonyb(a)cybernetics.com>
scsi: sg: fix minor memory leak in error path
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/atomic: Initialize variables in drm_atomic_helper_async_check() to make gcc happy
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check()
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: padlock-aes - Fix Nano workaround data corruption
Jack Morgenstein <jackm(a)dev.mellanox.co.il>
RDMA/uverbs: Expand primary and alt AV port checks
Rafał Miłecki <rafal(a)milecki.pl>
brcmfmac: fix regression in parsing NVRAM for multiple devices
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: add more card IDs for 9000 series
Mike Rapoport <rppt(a)linux.vnet.ibm.com>
userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails
Jane Chu <jane.chu(a)oracle.com>
ipc/shm.c add ->pagesize function to shm_vm_ops
Yi Wang <wang.yi59(a)zte.com.cn>
audit: fix potential null dereference 'context->module.name'
Roman Kagan <rkagan(a)virtuozzo.com>
kvm: x86: vmx: fix vpid leak
Andy Lutomirski <luto(a)kernel.org>
x86/entry/64: Remove %ebx handling from error_entry/exit
Len Brown <len.brown(a)intel.com>
x86/apic: Future-proof the TSC_DEADLINE quirk for SKX
Brijesh Singh <brijesh.singh(a)amd.com>
x86/efi: Access EFI MMIO data as unencrypted when SEV is active
Jiang Biao <jiang.biao2(a)zte.com.cn>
virtio_balloon: fix another race between migration and ballooning
Jeremy Cline <jcline(a)redhat.com>
net: socket: Fix potential spectre v1 gadget in sock_is_registered
Jeremy Cline <jcline(a)redhat.com>
net: socket: fix potential spectre v1 gadget in socketcall
Anton Vasilyev <vasilyev(a)ispras.ru>
can: ems_usb: Fix memory leak on ems_usb_disconnect()
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardenings
Linus Torvalds <torvalds(a)linux-foundation.org>
squashfs: more metadata hardening
Feras Daoud <ferasda(a)mellanox.com>
net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow
Or Gerlitz <ogerlitz(a)mellanox.com>
net/mlx5e: Set port trust mode to PCP as default
Eli Cohen <eli(a)mellanox.com>
net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager
YueHaibing <yuehaibing(a)huawei.com>
rxrpc: Fix user call ID check in rxrpc_service_prealloc_one
Jose Abreu <Jose.Abreu(a)synopsys.com>
net: stmmac: Fix WoL for PCI-based setups
Jeremy Cline <jcline(a)redhat.com>
netlink: Fix spectre v1 gadget in netlink_create()
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: Do not suspend/resume closed slave_dev
Eric Dumazet <edumazet(a)google.com>
ipv4: frags: handle possible skb truesize change
Eric Dumazet <edumazet(a)google.com>
inet: frag: enforce memory limits earlier
Eric Dumazet <edumazet(a)google.com>
bonding: avoid lockdep confusion in bond_get_stats()
-------------
Diffstat:
Makefile | 4 +-
arch/x86/entry/entry_64.S | 18 ++----
arch/x86/kernel/apic/apic.c | 3 +
arch/x86/kvm/vmx.c | 7 +--
arch/x86/platform/efi/efi_64.c | 2 +-
drivers/crypto/padlock-aes.c | 8 ++-
drivers/gpu/drm/drm_atomic_helper.c | 8 ++-
drivers/gpu/drm/vc4/vc4_plane.c | 3 +
drivers/infiniband/core/uverbs_cmd.c | 59 ++++++++++++++++--
drivers/net/bonding/bond_main.c | 14 ++++-
drivers/net/can/usb/ems_usb.c | 1 +
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 +-
.../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 4 ++
drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 40 ++++++++++++-
.../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 3 +-
drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 69 ++++++++++++++++++++++
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 5 ++
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 22 +++++++
drivers/scsi/sg.c | 1 +
drivers/virtio/virtio_balloon.c | 2 +
fs/squashfs/block.c | 2 +
fs/squashfs/fragment.c | 13 ++--
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 5 +-
fs/userfaultfd.c | 4 +-
ipc/shm.c | 12 ++++
kernel/auditsc.c | 13 ++--
mm/hugetlb.c | 7 +++
net/dsa/slave.c | 6 ++
net/ipv4/inet_fragment.c | 6 +-
net/ipv4/ip_fragment.c | 5 ++
net/netlink/af_netlink.c | 2 +
net/rxrpc/call_accept.c | 4 +-
net/socket.c | 5 +-
35 files changed, 309 insertions(+), 55 deletions(-)
It's legal to have 64 groups for netlink_sock.
As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe
only to first 32 groups.
The check for correctness of .bind() userspace supplied parameter
is done by applying mask made from ngroups shift. Which broke Android
as they have 64 groups and the shift for mask resulted in an overflow.
Fixes: 61f4b23769f0 ("netlink: Don't shift with UB on nlk->ngroups")
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Herbert Xu <herbert(a)gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert(a)secunet.com>
Cc: netdev(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Reported-and-Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Signed-off-by: Dmitry Safonov <dima(a)arista.com>
---
v2:
sizeof() is in bytes
net/netlink/af_netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7d860a22e5fb..d6ff4d409437 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1011,8 +1011,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
if (nlk->ngroups == 0)
groups = 0;
- else
- groups &= (1ULL << nlk->ngroups) - 1;
+ else if (nlk->ngroups < 8*sizeof(groups))
+ groups &= (1UL << nlk->ngroups) - 1;
bound = nlk->bound;
if (bound) {
--
2.13.6
It's legal to have 64 groups for netlink_sock.
As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe
only to first 32 groups.
The check for correctness of .bind() userspace supplied parameter
is done by applying mask made from ngroups shift. Which broke Android
as they have 64 groups and the shift for mask resulted in an overflow.
Fixes: 61f4b23769f0 ("netlink: Don't shift with UB on nlk->ngroups")
Cc: "David S. Miller" <davem(a)davemloft.net>
Cc: Herbert Xu <herbert(a)gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert(a)secunet.com>
Cc: netdev(a)vger.kernel.org
Cc: stable(a)vger.kernel.org
Reported-and-Tested-by: Nathan Chancellor <natechancellor(a)gmail.com>
Signed-off-by: Dmitry Safonov <dima(a)arista.com>
---
net/netlink/af_netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7d860a22e5fb..e44edadfad20 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1011,8 +1011,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
if (nlk->ngroups == 0)
groups = 0;
- else
- groups &= (1ULL << nlk->ngroups) - 1;
+ else if (nlk->ngroups < sizeof(long unsigned int))
+ groups &= (1UL << nlk->ngroups) - 1;
bound = nlk->bound;
if (bound) {
--
2.13.6
Dear Prospective Client,
We provide funding for up to 500 Million USD. Loans are available
at 3% interest
rate with re-payment period of 1 year to 30 years. We provide:-
*Business Loans
*Project Loans
*Personal Loans
*Home Loans e.t.c
If interested, please provide the information below:-
Name:
Amount Needed:
Duration:
Loan Type(e.g Business, Project or Personal):
Country of residence:
The above information would help us determine the best way to
assist you.
Regards
Sanwomi Brad
Hi,
Please pull this usercopy fix for v4.18-rc8. Bart Massey discovered that
the usercopy whitelist for JFS was incomplete: the inline inode data may
intentionally "overflow" into the neighboring "extended area", so the
size of the whitelist needed to be raised to include the neighboring
field.
Thanks!
-Kees
The following changes since commit 7daf201d7fe8334e2d2364d4e8ed3394ec9af819:
Linux 4.18-rc2 (2018-06-24 20:54:29 +0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/usercopy-fix-v4.18-rc8
for you to fetch changes up to 961b33c244e5ba1543ae26270a1ba29f29c2db83:
jfs: Fix usercopy whitelist for inline inode data (2018-08-04 07:53:46 -0700)
----------------------------------------------------------------
- Fix JFS usercopy whitelist (it needed to cover neighboring field too) for
"overflow" inline inode data.
----------------------------------------------------------------
Kees Cook (1):
jfs: Fix usercopy whitelist for inline inode data
fs/jfs/jfs_dinode.h | 7 +++++++
fs/jfs/jfs_incore.h | 1 +
fs/jfs/super.c | 3 +--
3 files changed, 9 insertions(+), 2 deletions(-)
--
Kees Cook
Pixel Security
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From de2d8db395c32d121d02871819444b631f73e0b6 Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon(a)bootlin.com>
Date: Tue, 24 Jul 2018 15:33:00 +0200
Subject: [PATCH] drm/atomic: Initialize variables in
drm_atomic_helper_async_check() to make gcc happy
drm_atomic_helper_async_check() declares the plane, old_plane_state and
new_plane_state variables to iterate over all planes of the atomic
state and make sure only one plane is enabled.
Unfortunately gcc is not smart enough to figure out that the check on
n_planes is enough to guarantee that plane, new_plane_state and
old_plane_state are initialized.
Explicitly initialize those variables to NULL to make gcc happy.
Fixes: fef9df8b5945 ("drm/atomic: initial support for asynchronous plane update")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon(a)bootlin.com>
Reviewed-by: Sean Paul <seanpaul(a)chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20180724133300.32023-1-boris.…
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index ff858b890045..81e32199d3ef 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1510,8 +1510,9 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
{
struct drm_crtc *crtc;
struct drm_crtc_state *crtc_state;
- struct drm_plane *plane;
- struct drm_plane_state *old_plane_state, *new_plane_state;
+ struct drm_plane *plane = NULL;
+ struct drm_plane_state *old_plane_state = NULL;
+ struct drm_plane_state *new_plane_state = NULL;
const struct drm_plane_helper_funcs *funcs;
int i, n_planes = 0;