Possible use after free in scsi_put_command()?

I've a question regarding the asynchronous scsi abort handler, look at the scsi_put_command() function:

void scsi_put_command(struct scsi_cmnd *cmd)

{
        unsigned long flags;
	[...]
        cancel_delayed_work(&cmd->abort_work);
        __scsi_put_command(cmd->device->host, cmd);
}

cancel_delayed_work() may return while the abort handler is still running, the problem is that __scsi_put_command() frees the cmd pointer that is still used by the abort handler.

Is it correct? Isn't safer to use cancel_delayed_work_sync() here?

Hello Maurizio,

I agree that that cancel_delayed_work() call is confusing. Hence "[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
(http://thread.gmane.org/gmane.linux.scsi/91027). Had you already noticed that patch ?

Quoted 4 lines · Bart Van Assche

I agree that that cancel_delayed_work() call is confusing. Hence "[PATCH] Remove two cancel_delayed_work() calls from the mid-layer"
(http://thread.gmane.org/gmane.linux.scsi/91027). Had you already noticed that patch ?

No, I missed it, thanks for pointing it out to me.

Hello James and Christoph,

Is it correct that the patch mentioned above has not yet been queued up ? Has it already been decided in which kernel version that patch should be included ?