Why can't we just switch to flush_work instead of cancel_work_sync? fatal_err_work never requeues itself, although we might need protection against queueing more up once we enter nvmet_ctrl_free.