jffs2 unmount with delayed work queued

[Scott Wood]

With slub debugging on, I was seeing a crash in timer code after
unmounting a jffs2 filesystem, with a reference to poisoned memory.  I
traced this back to jffs2_kill_sb() freeing the superblock with
c->wbuf_dwork.timer still active, and c->wbuf_queued = 1.  I've seen
this in Linus's current tree as well as 3.5.

I would have just sent a patch, but I wasn't sure exactly how to
gracefully shut things down -- cancel or flush, and at what point?
Don't want to do it too late for the work to happen safely, but don't
want to do it too early so that it could get queued again.

-Scott