scsi: aic94xx: fix use-after-free in device removal path

The asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.

Reported-by: Yuhao Jiang <[e-mail]>
Reported-by: Junrui Luo <[e-mail]>
Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
Cc: [e-mail]
Signed-off-by: Junrui Luo <[e-mail]>
Link: https://patch.msgid.link/[e-mail]
Signed-off-by: Martin K. Petersen <[e-mail]>

drivers/scsi/aic94xx/aic94xx_init.c

···
 
 	asd_disable_ints(asd_ha);
 
+	/* Ensure all scheduled tasklets complete before freeing resources */
+	tasklet_kill(&asd_ha->seq.dl_tasklet);
+
 	asd_remove_dev_attrs(asd_ha);
 
 	/* XXX more here as needed */