[PATCH] usb: cdns3: imx: fix kernel panic on remove due to kfree of static platform_data

[Xu Yang]

From: Xu Yang <xu.yang_2@xxxxxxx>

When cdns_imx_remove() calls of_platform_depopulate(), the child
platform device is destroyed. platform_device_release() then calls
kfree(pdev->dev.platform_data), but cdns3-imx assigns a pointer to
a static global variable as platform_data, so kfree() on it triggers
a kernel panic.

[   56.809541] Call trace:
[   56.811982]  kfree+0x44/0x398 (P)
[   56.815300]  platform_device_release+0x24/0x4c
[   56.819747]  device_release+0x3c/0xa0
[   56.823413]  kobject_put+0xa0/0x120
[   56.826906]  klist_children_put+0x18/0x28
[   56.830920]  klist_prev+0xb4/0x1c0
[   56.834325]  device_for_each_child_reverse+0x7c/0xc8
[   56.839294]  of_platform_depopulate+0x34/0x80
[   56.843664]  cdns_imx_remove+0x34/0xcc [cdns3_imx]

Fix this by iterating over child devices and clearing platform_data
to NULL before of_platform_depopulate() is called, preventing the
invalid kfree().

Fixes: ff6d6e6c6778 ("usb: cdns3: imx: add glue layer runtime pm implementation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xu Yang <xu.yang_2@xxxxxxx>
---
 drivers/usb/cdns3/cdns3-imx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-imx.c b/drivers/usb/cdns3/cdns3-imx.c
index a2f041e1707c..2c86fadd2cf2 100644
--- a/drivers/usb/cdns3/cdns3-imx.c
+++ b/drivers/usb/cdns3/cdns3-imx.c
@@ -218,12 +218,20 @@ static int cdns_imx_probe(struct platform_device *pdev)
 	return ret;
 }
 
+static int cdns_imx_reset_pdata(struct device *dev, void *data)
+{
+	if (device_is_compatible(dev, "cdns,usb3"))
+		dev->platform_data = NULL;
+	return 0;
+}
+
 static void cdns_imx_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct cdns_imx *data = dev_get_drvdata(dev);
 
 	pm_runtime_get_sync(dev);
+	device_for_each_child(dev, NULL, cdns_imx_reset_pdata);
 	of_platform_depopulate(dev);
 	clk_bulk_disable_unprepare(data->num_clks, data->clks);
 	pm_runtime_disable(dev);
-- 
2.34.1