Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

["Peter Chen (Qualcomm)" <peter.chen@kernel.org>]

On 26-10-19 15:38:27, Frank Li wrote:
> On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> > From: Xu Yang <xu.yang_2@nxp.com>
> >
> > When cdns_imx_remove() calls of_platform_depopulate(), the child
> > platform device is destroyed. platform_device_release() then calls
> > kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> > a static global variable as platform_data, so kfree() on it triggers
> > a kernel panic.
> >
> > [   56.809541] Call trace:
> > [   56.811982]  kfree+0x44/0x398 (P)
> > [   56.815300]  platform_device_release+0x24/0x4c
> > [   56.819747]  device_release+0x3c/0xa0
> > [   56.823413]  kobject_put+0xa0/0x120
> > [   56.826906]  klist_children_put+0x18/0x28
> > [   56.830920]  klist_prev+0xb4/0x1c0
> > [   56.834325]  device_for_each_child_reverse+0x7c/0xc8
> > [   56.839294]  of_platform_depopulate+0x34/0x80
> > [   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]
> >
> > Fix this by iterating over child devices and clearing platform_data
> > to NULL before of_platform_depopulate() is called, preventing the
> > invalid kfree().
> >
> > Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> > ---
> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>

Acked-by: Peter Chen <peter.chen@kernel.org>

Peter
> 
> >  drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> >
> > diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> > index a2f041e1707c..2c86fadd2cf2 100644
> > --- a/drivers/usb/cdns3/cdns3-imx.c
> > +++ b/drivers/usb/cdns3/cdns3-imx.c
> > @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
> >  	return ret;
> >  }
> >
> > +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> > +{
> > +	if (device_is_compatible(dev, "cdns,usb3"))
> > +		dev->platform_data = NULL;
> > +	return 0;
> > +}
> > +
> >  static void cdns_imx_remove(struct platform_device *pdev)
> >  {
> >  	struct device *dev = &pdev->dev;
> >  	struct cdns_imx *data = dev_get_drvdata(dev);
> >
> >  	pm_runtime_get_sync(dev);
> > +	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
> >  	of_platform_depopulate(dev);
> >  	clk_bulk_disable_unprepare(data->num_clks, data->clks);
> >  	pm_runtime_disable(dev);
> > --
> > 2.34.1
> >
> >

-- 

Thanks,
Peter Chen