From: Hyunjung Ko The software activity LED support arms a per-EM-port timer (emp->timer, ahci_sw_activity_blink) from ahci_sw_activity() on I/O, and the timer callback re-arms itself while the LED is blinking. The timer lives in struct ahci_em_priv inside the port's ahci_port_priv, which is allocated with devm_kzalloc() and freed when the port is torn down. ahci_port_stop() never deletes this timer - nothing in libahci does - so when the SW activity LED is in use and the AHCI port is stopped (driver unbind / module unload) while the blink timer is still pending, ahci_sw_activity_blink() runs after ahci_port_priv has been freed and dereferences the freed ahci_em_priv (use-after-free). Shut the timer down in ahci_port_stop() for every link's em_priv before the port private data is released. Because the callback re-arms itself, use timer_shutdown_sync() so a concurrent re-arm cannot resurrect it. em_priv entries without an armed timer are zero-initialised, for which timer_shutdown_sync() is a no-op. Not tested on real hardware (needs an AHCI controller with SGPIO enclosure management and the software activity LED enabled). Fixes: 365cfa1ed5a3 ("ahci: Move generic code into libahci") Cc: stable@vger.kernel.org Signed-off-by: Hyunjung Ko --- drivers/ata/libahci.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c index 001a6f5..873645c 100644 --- a/drivers/ata/libahci.c +++ b/drivers/ata/libahci.c @@ -2605,9 +2605,23 @@ static void ahci_port_stop(struct ata_port *ap) { const char *emsg = NULL; struct ahci_host_priv *hpriv = ap->host->private_data; + struct ahci_port_priv *pp = ap->private_data; void __iomem *host_mmio = hpriv->mmio; + struct ata_link *link; + struct ahci_em_priv *emp; int rc; + /* + * The SW activity LED blink timer (emp->timer) is armed from the I/O + * path and re-arms itself; shut it down before the devm-allocated + * ahci_port_priv it lives in is freed, or it can fire against freed + * memory. timer_shutdown_sync() also stops the self re-arm. + */ + ata_for_each_link(link, ap, EDGE) { + emp = &pp->em_priv[link->pmp]; + timer_shutdown_sync(&emp->timer); + } + /* de-initialize port */ rc = ahci_deinit_port(ap, &emsg); if (rc) -- 2.43.0