[PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[Xu Yang]

From: Xu Yang <xu.yang_2@nxp.com>

When cdns_imx_remove() calls of_platform_depopulate(), the child
platform device is destroyed. platform_device_release() then calls
kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
a static global variable as platform_data, so kfree() on it triggers
a kernel panic.

[   56.809541] Call trace:
[   56.811982]  kfree+0x44/0x398 (P)
[   56.815300]  platform_device_release+0x24/0x4c
[   56.819747]  device_release+0x3c/0xa0
[   56.823413]  kobject_put+0xa0/0x120
[   56.826906]  klist_children_put+0x18/0x28
[   56.830920]  klist_prev+0xb4/0x1c0
[   56.834325]  device_for_each_child_reverse+0x7c/0xc8
[   56.839294]  of_platform_depopulate+0x34/0x80
[   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]

Fix this by iterating over child devices and clearing platform_data
to NULL before of_platform_depopulate() is called, preventing the
invalid kfree().

Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
---
 drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
index a2f041e1707c..2c86fadd2cf2 100644
--- a/drivers/usb/cdns3/cdns3-imx.c
+++ b/drivers/usb/cdns3/cdns3-imx.c
@@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
 	return ret;
 }
 
+static int cdns_imx_reset_pdata(struct device *dev, void *data)
+{
+	if (device_is_compatible(dev, "cdns,usb3"))
+		dev->platform_data = NULL;
+	return 0;
+}
+
 static void cdns_imx_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct cdns_imx *data = dev_get_drvdata(dev);
 
 	pm_runtime_get_sync(dev);
+	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
 	of_platform_depopulate(dev);
 	clk_bulk_disable_unprepare(data->num_clks, data->clks);
 	pm_runtime_disable(dev);
-- 
2.34.1

Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[sashiko-bot]

> From: Xu Yang <xu.yang_2@nxp.com>
> 
> When cdns_imx_remove() calls of_platform_depopulate(), the child
> platform device is destroyed. platform_device_release() then calls
> kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> a static global variable as platform_data, so kfree() on it triggers
> a kernel panic.
> 
> [   56.809541] Call trace:
> [   56.811982]  kfree+0x44/0x398 (P)
> [   56.815300]  platform_device_release+0x24/0x4c
> [   56.819747]  device_release+0x3c/0xa0
> [   56.823413]  kobject_put+0xa0/0x120
> [   56.826906]  klist_children_put+0x18/0x28
> [   56.830920]  klist_prev+0xb4/0x1c0
> [   56.834325]  device_for_each_child_reverse+0x7c/0xc8
> [   56.839294]  of_platform_depopulate+0x34/0x80
> [   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]
> 
> Fix this by iterating over child devices and clearing platform_data
> to NULL before of_platform_depopulate() is called, preventing the
> invalid kfree().
> 
> Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019084944.2051097-1-xu.yang_2@oss.nxp.com?part=1

Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[Frank Li]

On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> From: Xu Yang <xu.yang_2@nxp.com>
>
> When cdns_imx_remove() calls of_platform_depopulate(), the child
> platform device is destroyed. platform_device_release() then calls
> kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> a static global variable as platform_data, so kfree() on it triggers
> a kernel panic.
>
> [   56.809541] Call trace:
> [   56.811982]  kfree+0x44/0x398 (P)
> [   56.815300]  platform_device_release+0x24/0x4c
> [   56.819747]  device_release+0x3c/0xa0
> [   56.823413]  kobject_put+0xa0/0x120
> [   56.826906]  klist_children_put+0x18/0x28
> [   56.830920]  klist_prev+0xb4/0x1c0
> [   56.834325]  device_for_each_child_reverse+0x7c/0xc8
> [   56.839294]  of_platform_depopulate+0x34/0x80
> [   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]
>
> Fix this by iterating over child devices and clearing platform_data
> to NULL before of_platform_depopulate() is called, preventing the
> invalid kfree().
>
> Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> index a2f041e1707c..2c86fadd2cf2 100644
> --- a/drivers/usb/cdns3/cdns3-imx.c
> +++ b/drivers/usb/cdns3/cdns3-imx.c
> @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
>  	return ret;
>  }
>
> +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> +{
> +	if (device_is_compatible(dev, "cdns,usb3"))
> +		dev->platform_data = NULL;
> +	return 0;
> +}
> +
>  static void cdns_imx_remove(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  	struct cdns_imx *data = dev_get_drvdata(dev);
>
>  	pm_runtime_get_sync(dev);
> +	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
>  	of_platform_depopulate(dev);
>  	clk_bulk_disable_unprepare(data->num_clks, data->clks);
>  	pm_runtime_disable(dev);
> --
> 2.34.1
>
>

Re: [PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[Peter Chen (Qualcomm)]

On 26-10-19 15:38:27, Frank Li wrote:
> On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> > From: Xu Yang <xu.yang_2@nxp.com>
> >
> > When cdns_imx_remove() calls of_platform_depopulate(), the child
> > platform device is destroyed. platform_device_release() then calls
> > kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> > a static global variable as platform_data, so kfree() on it triggers
> > a kernel panic.
> >
> > [   56.809541] Call trace:
> > [   56.811982]  kfree+0x44/0x398 (P)
> > [   56.815300]  platform_device_release+0x24/0x4c
> > [   56.819747]  device_release+0x3c/0xa0
> > [   56.823413]  kobject_put+0xa0/0x120
> > [   56.826906]  klist_children_put+0x18/0x28
> > [   56.830920]  klist_prev+0xb4/0x1c0
> > [   56.834325]  device_for_each_child_reverse+0x7c/0xc8
> > [   56.839294]  of_platform_depopulate+0x34/0x80
> > [   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]
> >
> > Fix this by iterating over child devices and clearing platform_data
> > to NULL before of_platform_depopulate() is called, preventing the
> > invalid kfree().
> >
> > Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
> > ---
> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>

Acked-by: Peter Chen <peter.chen@kernel.org>

Peter
> 
> >  drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> >
> > diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> > index a2f041e1707c..2c86fadd2cf2 100644
> > --- a/drivers/usb/cdns3/cdns3-imx.c
> > +++ b/drivers/usb/cdns3/cdns3-imx.c
> > @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
> >  	return ret;
> >  }
> >
> > +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> > +{
> > +	if (device_is_compatible(dev, "cdns,usb3"))
> > +		dev->platform_data = NULL;
> > +	return 0;
> > +}
> > +
> >  static void cdns_imx_remove(struct platform_device *pdev)
> >  {
> >  	struct device *dev = &pdev->dev;
> >  	struct cdns_imx *data = dev_get_drvdata(dev);
> >
> >  	pm_runtime_get_sync(dev);
> > +	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
> >  	of_platform_depopulate(dev);
> >  	clk_bulk_disable_unprepare(data->num_clks, data->clks);
> >  	pm_runtime_disable(dev);
> > --
> > 2.34.1
> >
> >

-- 

Thanks,
Peter Chen