[PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[Frank Li]

On Mon, Oct 19, 2026 at 04:49:44PM +0800, Xu Yang wrote:
> From: Xu Yang <xu.yang_2 at nxp.com>
>
> When cdns_imx_remove() calls of_platform_depopulate(), the child
> platform device is destroyed. platform_device_release() then calls
> kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
> a static global variable as platform_data, so kfree() on it triggers
> a kernel panic.
>
> [   56.809541] Call trace:
> [   56.811982]  kfree+0x44/0x398 (P)
> [   56.815300]  platform_device_release+0x24/0x4c
> [   56.819747]  device_release+0x3c/0xa0
> [   56.823413]  kobject_put+0xa0/0x120
> [   56.826906]  klist_children_put+0x18/0x28
> [   56.830920]  klist_prev+0xb4/0x1c0
> [   56.834325]  device_for_each_child_reverse+0x7c/0xc8
> [   56.839294]  of_platform_depopulate+0x34/0x80
> [   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]
>
> Fix this by iterating over child devices and clearing platform_data
> to NULL before of_platform_depopulate() is called, preventing the
> invalid kfree().
>
> Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
> Cc: stable at vger.kernel.org
> Signed-off-by: Xu Yang <xu.yang_2 at nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li at nxp.com>

>  drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
> index a2f041e1707c..2c86fadd2cf2 100644
> --- a/drivers/usb/cdns3/cdns3-imx.c
> +++ b/drivers/usb/cdns3/cdns3-imx.c
> @@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
>  	return ret;
>  }
>
> +static int cdns_imx_reset_pdata(struct device *dev, void *data)
> +{
> +	if (device_is_compatible(dev, "cdns,usb3"))
> +		dev->platform_data = NULL;
> +	return 0;
> +}
> +
>  static void cdns_imx_remove(struct platform_device *pdev)
>  {
>  	struct device *dev = &pdev->dev;
>  	struct cdns_imx *data = dev_get_drvdata(dev);
>
>  	pm_runtime_get_sync(dev);
> +	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
>  	of_platform_depopulate(dev);
>  	clk_bulk_disable_unprepare(data->num_clks, data->clks);
>  	pm_runtime_disable(dev);
> --
> 2.34.1
>
>