Re: Possible use after free in scsi_put_command()?

[Bart Van Assche <bvanassche@acm.org>]

On 06/24/14 17:07, Maurizio Lombardi wrote:
> I've a question regarding the asynchronous scsi abort handler,
> look at the scsi_put_command() function:
> 
> void scsi_put_command(struct scsi_cmnd *cmd)
> {
>         unsigned long flags;
> 	[...]
>         cancel_delayed_work(&cmd->abort_work);
>         __scsi_put_command(cmd->device->host, cmd);
> }
> 
> cancel_delayed_work() may return while the abort handler is still running,
> the problem is that __scsi_put_command() frees the cmd pointer that
> is still used by the abort handler.
> 
> Is it correct? Isn't safer to use cancel_delayed_work_sync() here?

Hello Maurizio,

I agree that that cancel_delayed_work() call is confusing. Hence
"[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
(http://thread.gmane.org/gmane.linux.scsi/91027). Had you already
noticed that patch ?

Best regards,

Bart.