[PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data

[Yunshui Jiang]

The bug was found through static code inspection of the vme_fake driver.
By reviewing the error paths in fake_init() and fake_exit(), it is evident
that tasklet_kill() is missing before kfree().

Unfortunately, I don't have a setup to trigger this specific VME
interrupt scenario dynamically. While, I think that to avoid UAF risk,
a tasklet must be explicitly killed before its associated data structure
is freed.

Changes in v2:
- Added the Assisted-by tag
- Fixed the Signed-off-by tag 
In-Reply-To: 2026081116-flounder-facing-6ef7@gregkh