[PATCH] imx: power-domain: Fix crash due to uninitialized 'id' field

[PATCH] imx: power-domain: Fix crash due to uninitialized 'id' field

[Frieder Schrempf]

From: Frieder Schrempf <frieder.schrempf@kontron.de>

In case of the i.MX8M power-domains (i.MX8MQ, MM, MN) there is only
one power-domain for each device. Therefore the 'id' field in struct
power_domain should always be zero.

Currently if a power-domain is accessed after the initial bind, the
'id' field is left uninitialized. This didn't cause any problems
until the following commits were introduced:

9086b64ca071 ("power-domain: Add support for refcounting (again)")
a785ef24487b ("imx: power-domain: Enable refcounting on imx8mp")

Now the 'id' field gets accessed in the power_domain_off() sequence
and the invalid value causes "Synchronous Abort" failures.

This was observed on a i.MX8MM board when running "usb start" and
then "usb stop".

Fix this issue by setting power_domain->id to '0' in
imx8m_power_domain_of_xlate().

Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Fixes: d08a194871fd ("imx: add support for i.MX8MQ power domain controller")
Fixes: 9086b64ca071 ("power-domain: Add support for refcounting (again)")
---
 drivers/power/domain/imx8m-power-domain.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/power/domain/imx8m-power-domain.c b/drivers/power/domain/imx8m-power-domain.c
index b44aae78e6d..a7e64971a2a 100644
--- a/drivers/power/domain/imx8m-power-domain.c
+++ b/drivers/power/domain/imx8m-power-domain.c
@@ -468,6 +468,8 @@ out_clk_disable:
 static int imx8m_power_domain_of_xlate(struct power_domain *power_domain,
 				      struct ofnode_phandle_args *args)
 {
+	power_domain->id = 0;
+
 	return 0;
 }
 
-- 
2.50.1

Re: [PATCH] imx: power-domain: Fix crash due to uninitialized 'id' field

[Miquel Raynal]

Hi Frieder,

On 22/07/2025 at 10:31:18 +02, Frieder Schrempf <frieder@fris.de> wrote:

> From: Frieder Schrempf <frieder.schrempf@kontron.de>
>
> In case of the i.MX8M power-domains (i.MX8MQ, MM, MN) there is only
> one power-domain for each device. Therefore the 'id' field in struct
> power_domain should always be zero.
>
> Currently if a power-domain is accessed after the initial bind, the
> 'id' field is left uninitialized. This didn't cause any problems
> until the following commits were introduced:
>
> 9086b64ca071 ("power-domain: Add support for refcounting (again)")
> a785ef24487b ("imx: power-domain: Enable refcounting on imx8mp")
>
> Now the 'id' field gets accessed in the power_domain_off() sequence
> and the invalid value causes "Synchronous Abort" failures.
>
> This was observed on a i.MX8MM board when running "usb start" and
> then "usb stop".
>
> Fix this issue by setting power_domain->id to '0' in
> imx8m_power_domain_of_xlate().
>
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> Fixes: d08a194871fd ("imx: add support for i.MX8MQ power domain controller")
> Fixes: 9086b64ca071 ("power-domain: Add support for refcounting (again)")
> ---
>  drivers/power/domain/imx8m-power-domain.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/power/domain/imx8m-power-domain.c b/drivers/power/domain/imx8m-power-domain.c
> index b44aae78e6d..a7e64971a2a 100644
> --- a/drivers/power/domain/imx8m-power-domain.c
> +++ b/drivers/power/domain/imx8m-power-domain.c
> @@ -468,6 +468,8 @@ out_clk_disable:
>  static int imx8m_power_domain_of_xlate(struct power_domain *power_domain,
>  				      struct ofnode_phandle_args *args)
>  {
> +	power_domain->id = 0;
> +
>  	return 0;
>  }

Looks like a correct fix. I wonder how many drivers do not properly set
an id though. Thanks a lot!

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Thanks,
Miquèl

Re: [PATCH] imx: power-domain: Fix crash due to uninitialized 'id' field

[Fabio Estevam]

On Tue, Jul 22, 2025 at 7:24 AM Frieder Schrempf <frieder@fris.de> wrote:
>
> From: Frieder Schrempf <frieder.schrempf@kontron.de>
>
> In case of the i.MX8M power-domains (i.MX8MQ, MM, MN) there is only
> one power-domain for each device. Therefore the 'id' field in struct
> power_domain should always be zero.
>
> Currently if a power-domain is accessed after the initial bind, the
> 'id' field is left uninitialized. This didn't cause any problems
> until the following commits were introduced:
>
> 9086b64ca071 ("power-domain: Add support for refcounting (again)")
> a785ef24487b ("imx: power-domain: Enable refcounting on imx8mp")
>
> Now the 'id' field gets accessed in the power_domain_off() sequence
> and the invalid value causes "Synchronous Abort" failures.
>
> This was observed on a i.MX8MM board when running "usb start" and
> then "usb stop".
>
> Fix this issue by setting power_domain->id to '0' in
> imx8m_power_domain_of_xlate().
>
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> Fixes: d08a194871fd ("imx: add support for i.MX8MQ power domain controller")
> Fixes: 9086b64ca071 ("power-domain: Add support for refcounting (again)")

Applied, thanks.