Re: [PATCH v4] ata: libahci: delete the SW activity blink timer on port stop

[Niklas Cassel]

On Tue, 10 Nov 2026 19:50:40 +0900, Hyunjung Ko wrote:
> The software activity LED support arms a per-EM-port timer (emp->timer,
> ahci_sw_activity_blink) from ahci_sw_activity() on I/O, and the timer
> callback re-arms itself while the LED is blinking. The timer lives in
> struct ahci_em_priv inside the port's ahci_port_priv, which is allocated
> with devm_kzalloc() and freed when the port is torn down.
> 
> ahci_port_stop() never deletes this timer - nothing in libahci does - so
> when the SW activity LED is in use and the AHCI port is stopped (driver
> unbind / module unload) while the blink timer is still pending,
> ahci_sw_activity_blink() runs after ahci_port_priv has been freed and
> dereferences the freed ahci_em_priv (use-after-free).
> 
> [...]

Applied to libata/linux.git (for-7.5), thanks!

[1/1] ata: libahci: delete the SW activity blink timer on port stop
      https://git.kernel.org/libata/linux/c/0c5f6cd1

Kind regards,
Niklas