bbf4e9cd00
During cnss unload or error quit, cnss_dms_deinit() is called to perform dms client deinit. When dms sever quit, modem also send event to cnss to schedule dms client restart with dms_del_server(). The two processes are asynchronous so qmi_handle_release() may be entered twice and cause qmi->sock to be used after free. To avoid this race condition, call cnss_cancel_dms_work() before cnss_dms_deinit() to guarantee the two processes not run concurrently. Change-Id: I291c1d0bdead190549dcbbb2c4b7aa65a68196d7 CRs-Fixed: 3875961