* [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data
@ 2026-10-19 8:49 Xu Yang
2026-10-19 20:38 ` Frank Li
0 siblings, 1 reply; 3+ messages in thread
From: Xu Yang @ 2026-10-19 8:49 UTC (permalink / raw)
To: peter.chen, pawell, rogerq, gregkh
Cc: Frank.Li, s.hauer, kernel, festevam, balbi, linux-usb, imx,
linux-arm-kernel, linux-kernel, jun.li
From: Xu Yang <xu.yang_2@nxp.com>
When cdns_imx_remove() calls of_platform_depopulate(), the child
platform device is destroyed. platform_device_release() then calls
kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
a static global variable as platform_data, so kfree() on it triggers
a kernel panic.
[ 56.809541] Call trace:
[ 56.811982] kfree+0x44/0x398 (P)
[ 56.815300] platform_device_release+0x24/0x4c
[ 56.819747] device_release+0x3c/0xa0
[ 56.823413] kobject_put+0xa0/0x120
[ 56.826906] klist_children_put+0x18/0x28
[ 56.830920] klist_prev+0xb4/0x1c0
[ 56.834325] device_for_each_child_reverse+0x7c/0xc8
[ 56.839294] of_platform_depopulate+0x34/0x80
[ 56.843664] cdns_imx_remove+0x34/0xcc [cdns3_imx]
Fix this by iterating over child devices and clearing platform_data
to NULL before of_platform_depopulate() is called, preventing the
invalid kfree().
Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
---
drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
index a2f041e1707c..2c86fadd2cf2 100644
--- a/drivers/usb/cdns3/cdns3-imx.c
+++ b/drivers/usb/cdns3/cdns3-imx.c
@@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
return ret;
}
+static int cdns_imx_reset_pdata(struct device *dev, void *data)
+{
+ if (device_is_compatible(dev, "cdns,usb3"))
+ dev->platform_data = NULL;
+ return 0;
+}
+
static void cdns_imx_remove(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
struct cdns_imx *data = dev_get_drvdata(dev);
pm_runtime_get_sync(dev);
+ device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
of_platform_depopulate(dev);
clk_bulk_disable_unprepare(data->num_clks, data->clks);
pm_runtime_disable(dev);
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data
2026-10-19 8:49 [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data Xu Yang
@ 2026-10-19 20:38 ` Frank Li
2026-10-20 2:02 ` Peter Chen (Qualcomm)
0 siblings, 1 reply; 3+ messages in thread
From: Frank Li @ 2026-10-19 20:38 UTC (permalink / raw)
To: Xu Yang
Cc: peter.chen, pawell, rogerq, gregkh, Frank.Li, s.hauer, kernel,
festevam, balbi, linux-usb, imx, linux-arm-kernel, linux-kernel,
jun.li
On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> From: Xu Yang <xu.yang_2@nxp.com>
>
> When cdns_imx_remove() calls of_platform_depopulate(), the child
> platform device is destroyed. platform_device_release() then calls
> kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> a static global variable as platform_data, so kfree() on it triggers
> a kernel panic.
>
> [ 56.809541] Call trace:
> [ 56.811982] kfree+0x44/0x398 (P)
> [ 56.815300] platform_device_release+0x24/0x4c
> [ 56.819747] device_release+0x3c/0xa0
> [ 56.823413] kobject_put+0xa0/0x120
> [ 56.826906] klist_children_put+0x18/0x28
> [ 56.830920] klist_prev+0xb4/0x1c0
> [ 56.834325] device_for_each_child_reverse+0x7c/0xc8
> [ 56.839294] of_platform_depopulate+0x34/0x80
> [ 56.843664] cdns_imx_remove+0x34/0xcc [cdns3_imx]
>
> Fix this by iterating over child devices and clearing platform_data
> to NULL before of_platform_depopulate() is called, preventing the
> invalid kfree().
>
> Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> index a2f041e1707c..2c86fadd2cf2 100644
> --- a/drivers/usb/cdns3/cdns3-imx.c
> +++ b/drivers/usb/cdns3/cdns3-imx.c
> @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
> return ret;
> }
>
> +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> +{
> + if (device_is_compatible(dev, "cdns,usb3"))
> + dev->platform_data = NULL;
> + return 0;
> +}
> +
> static void cdns_imx_remove(struct platform_device *pdev)
> {
> struct device *dev = &pdev->dev;
> struct cdns_imx *data = dev_get_drvdata(dev);
>
> pm_runtime_get_sync(dev);
> + device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
> of_platform_depopulate(dev);
> clk_bulk_disable_unprepare(data->num_clks, data->clks);
> pm_runtime_disable(dev);
> --
> 2.34.1
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data
2026-10-19 20:38 ` Frank Li
@ 2026-10-20 2:02 ` Peter Chen (Qualcomm)
0 siblings, 0 replies; 3+ messages in thread
From: Peter Chen (Qualcomm) @ 2026-10-20 2:02 UTC (permalink / raw)
To: Frank Li
Cc: Xu Yang, pawell, rogerq, gregkh, Frank.Li, s.hauer, kernel,
festevam, balbi, linux-usb, imx, linux-arm-kernel, linux-kernel,
jun.li
On 26-10-19 15:38:27, Frank Li wrote:
> On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> > From: Xu Yang <xu.yang_2@nxp.com>
> >
> > When cdns_imx_remove() calls of_platform_depopulate(), the child
> > platform device is destroyed. platform_device_release() then calls
> > kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> > a static global variable as platform_data, so kfree() on it triggers
> > a kernel panic.
> >
> > [ 56.809541] Call trace:
> > [ 56.811982] kfree+0x44/0x398 (P)
> > [ 56.815300] platform_device_release+0x24/0x4c
> > [ 56.819747] device_release+0x3c/0xa0
> > [ 56.823413] kobject_put+0xa0/0x120
> > [ 56.826906] klist_children_put+0x18/0x28
> > [ 56.830920] klist_prev+0xb4/0x1c0
> > [ 56.834325] device_for_each_child_reverse+0x7c/0xc8
> > [ 56.839294] of_platform_depopulate+0x34/0x80
> > [ 56.843664] cdns_imx_remove+0x34/0xcc [cdns3_imx]
> >
> > Fix this by iterating over child devices and clearing platform_data
> > to NULL before of_platform_depopulate() is called, preventing the
> > invalid kfree().
> >
> > Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> > ---
>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Peter
>
> > drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> > index a2f041e1707c..2c86fadd2cf2 100644
> > --- a/drivers/usb/cdns3/cdns3-imx.c
> > +++ b/drivers/usb/cdns3/cdns3-imx.c
> > @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
> > return ret;
> > }
> >
> > +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> > +{
> > + if (device_is_compatible(dev, "cdns,usb3"))
> > + dev->platform_data = NULL;
> > + return 0;
> > +}
> > +
> > static void cdns_imx_remove(struct platform_device *pdev)
> > {
> > struct device *dev = &pdev->dev;
> > struct cdns_imx *data = dev_get_drvdata(dev);
> >
> > pm_runtime_get_sync(dev);
> > + device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
> > of_platform_depopulate(dev);
> > clk_bulk_disable_unprepare(data->num_clks, data->clks);
> > pm_runtime_disable(dev);
> > --
> > 2.34.1
> >
> >
--
Thanks,
Peter Chen
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-20 2:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-19 8:49 [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data Xu Yang
2026-10-19 20:38 ` Frank Li
2026-10-20 2:02 ` Peter Chen (Qualcomm)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®