bug:
user thread: hpwork:
timer_create() with SIGEV_THREAD
timer_settime()
irq -> work_queue() add nxsig_notification_worker to Q
timer_delete()
nxsig_cancel_notification()
call nxsig_notification_worker()
work_cancel()
timer_free()
nxsig_notification_worker() used after free
root cause:
work_cancel() can't cancel work completely, the worker may alreay be running.
resolve:
use work_cancel_sync() API to cancel the work completely
Signed-off-by: ligd <liguiding1@xiaomi.com>