Re: [PATCH v2 net] nfc: llcp: use disable_work_sync and timer_shutdown_sync in local_cleanup

[Tristan Madani]

The issue was found by manual code inspection of the NFC LLCP teardown
path in local_cleanup(). cancel_work_sync() does not prevent the work
from being re-queued, and timer_delete_sync() does not prevent the timer
from being re-armed -- both can race with an incoming LLCP frame that
schedules them again after cancellation.

The issue is theoretical (found by code review, not triggered), but the
race window is real: any LLCP frame arriving between the cancel/delete
calls and kfree(local) can re-queue the work or re-arm the timer,
leading to the callback running after the local structure is freed.