[PATCH] ata: libahci: Do not use an EM slot for the PMP control port

[Niklas Cassel <cassel@kernel.org>]

When a Port Multiplier is attached, sata_pmp_attach() sets the pmp
number of the host link to SATA_PMP_CTRL_PORT (15), and every PMP
register access then goes through ahci_qc_issue() -> ahci_sw_activity()
on the host link. ahci_sw_activity() uses link->pmp as an index into
pp->em_priv[], which only has EM_MAX_SLOTS (15) entries, so for the
control port it ends up one past the end of the array.

Commit 1e41e693f458 ("ata: ahci: Match EM_MAX_SLOTS with
SATA_PMP_MAX_PORTS") grew em_priv[] from 8 to 15 entries for a UBSAN
report about this very index, but index 15 is still out of bounds.
UBSAN stopped complaining because &pp->em_priv[15] is now a
one-past-the-end address, which its bounds check accepts, while the
accesses through it are still out of bounds.

These accesses happen when the host link has ATA_LFLAG_SW_ACTIVITY set.
Enabling SW activity via sysfs for a disk attached directly to the port
sets the flag on the host link, and it stays set when the disk is
unplugged. If a PMP is then connected, each PMP register access makes
ahci_sw_activity() increment a counter past the end of em_priv[] and
pass the address of a nonexistent timer_list to timer_pending() and
mod_timer().

The flag cannot simply be cleared when the disk is unplugged: enclosure
LEDs belong to the bay, which is why em_priv[] is indexed by slot and
the blink policy outlives the disk, so a replacement disk in the same
bay should keep blinking.

Fixes: 18f7ba4c2f4b ("libata/ahci: enclosure management support")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
---
 drivers/ata/libahci.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 9e970408916d..ef760d81d1d1 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1033,11 +1033,16 @@ static void ahci_sw_activity(struct ata_link *link)
 {
 	struct ata_port *ap = link->ap;
 	struct ahci_port_priv *pp = ap->private_data;
-	struct ahci_em_priv *emp = &pp->em_priv[link->pmp];
+	struct ahci_em_priv *emp;
 
 	if (!(link->flags & ATA_LFLAG_SW_ACTIVITY))
 		return;
 
+	/* The PMP control port (SATA_PMP_CTRL_PORT) has no EM slot */
+	if (link->pmp >= EM_MAX_SLOTS)
+		return;
+
+	emp = &pp->em_priv[link->pmp];
 	emp->activity++;
 	if (!timer_pending(&emp->timer))
 		mod_timer(&emp->timer, jiffies + msecs_to_jiffies(10));
-- 
2.56.0