Possible use after free in scsi_put_command()?

From: Maurizio Lombardi <mlombard@redhat.com>
To: hare@suse.de
Cc: linux-scsi@vger.kernel.org
Subject: Possible use after free in scsi_put_command()?
Date: Tue, 24 Jun 2014 17:07:12 +0200	[thread overview]
Message-ID: <53A99420.3080503@redhat.com> (raw)

Hi Hannes,

I've a question regarding the asynchronous scsi abort handler,
look at the scsi_put_command() function:

void scsi_put_command(struct scsi_cmnd *cmd)
{
        unsigned long flags;
	[...]
        cancel_delayed_work(&cmd->abort_work);
        __scsi_put_command(cmd->device->host, cmd);
}

cancel_delayed_work() may return while the abort handler is still running,
the problem is that __scsi_put_command() frees the cmd pointer that
is still used by the abort handler.

Is it correct? Isn't safer to use cancel_delayed_work_sync() here?

Thanks,
Maurizio Lombardi