Re: [PATCH v2] ata: libahci: delete the SW activity blink timer on port stop

[Niklas Cassel <cassel@kernel.org>]

Hello Hyunjung,

On Mon, Nov 09, 2026 at 03:07:09PM +0900, hyunjungg wrote:
> From: Hyunjung Ko <hj351016@gmail.com>
> 
> The software activity LED support arms a per-EM-port timer (emp->timer,
> ahci_sw_activity_blink) from ahci_sw_activity() on I/O, and the timer
> callback re-arms itself while the LED is blinking. emp->timer lives in
> struct ahci_em_priv inside the port's ahci_port_priv, which is allocated
> with devm_kzalloc() and freed when the port is torn down.
> 
> ahci_port_stop() never deletes this timer, so when the SW activity LED is
> in use and the port is stopped (driver unbind / module unload) while the
> blink timer is pending, ahci_sw_activity_blink() runs after
> ahci_port_priv has been freed and dereferences the freed ahci_em_priv
> (use-after-free).
> 
> Shut the timer down in ahci_port_stop() before the port private data is
> released; timer_shutdown_sync() also stops the self re-arm. The timers are
> only set up (ahci_init_sw_activity()) when ATA_FLAG_SW_ACTIVITY is set, so
> gate on that flag and skip slots whose timer was never initialised --
> timer_shutdown_sync() on an uninitialised timer trips the debug-object and
> lockdep checks. Sweep all EM_MAX_SLOTS em_priv slots rather than the
> current links, so a detached Port Multiplier's fan-out timer is not missed.
> 
> Not tested on real hardware (needs an AHCI controller with SGPIO
> enclosure management and the software activity LED enabled).
> 
> Fixes: 18f7ba4c2f4b ("libata/ahci: enclosure management support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
> ---

Where is the changelog?


Kind regards,
Niklas