sched/wqueue: restore -ENOENT from work_cancel() for unqueued work

work_cancel() used to return -ENOENT when the work structure was not
in the queue, and callers depend on that: aio_cancel() tears down the
AIO container (file_put() + aioc_free()) only when work_cancel()
reports success, because a work item that is not queued may already be
executing on a worker thread (see the comment in fs/aio/aio_cancel.c).

Since commit 6f72f54 ("sched/wqueue: Refactor delayed and periodical
workqueue") work_cancel() returns OK unconditionally, and commit
d2e01b9 ("sched/wqueue: harden custom queue lifecycle") kept that
behaviour and dropped -ENOENT from the function documentation.  Under
SMP the LTP aio_cancel tests then free the aio container and its file
while the lpwork thread is still executing aio_write_worker() on it,
which ends in a page fault in file_write() (f_inode == NULL) and a
panic.

Return -ENOENT again from the asynchronous cancel when the work is not
queued, and document it.  The synchronous variant keeps returning OK:
it waits for any running callback, so the work is guaranteed to be
finished when it returns.

Assisted-by: Claude Code
Signed-off-by: raiden00pl <raiden00@railab.me>

Author: raiden00pl

sched/wqueue/kwork_cancel.c

@@ -48,6 +48,7 @@ static int work_qcancel(FAR struct kwork_wqueue_s *wqueue, bool sync,
 {
   irqstate_t flags;
   pid_t self = sync ? nxsched_gettid() : INVALID_PROCESS_ID;
+  int ret = OK;
 
   if (wqueue == NULL || work == NULL)
     {
@@ -84,6 +85,17 @@ static int work_qcancel(FAR struct kwork_wqueue_s *wqueue, bool sync,
               work_timer_reset(wqueue);
             }
         }
+      else if (!sync)
+        {
+          /* The work is not queued: either it was never queued or a worker
+           * has already dequeued it and may be executing its callback right
+           * now.  Report -ENOENT so that callers (e.g. aio_cancel()) do not
+           * free resources that the callback is still using.  The sync
+           * variant waits for such a callback below and returns OK.
+           */
+
+          ret = -ENOENT;
+        }
 
       if (sync)
         {
@@ -102,7 +114,7 @@ static int work_qcancel(FAR struct kwork_wqueue_s *wqueue, bool sync,
 
       if (sync_wait == NULL)
         {
-          return OK;
+          return ret;
         }
 
       nxsem_wait_uninterruptible(sync_wait);
@@ -130,6 +142,7 @@ static int work_qcancel(FAR struct kwork_wqueue_s *wqueue, bool sync,
  *   Zero on success, a negated errno on failure
  *
  *   -EINVAL - An invalid work queue was specified
+ *   -ENOENT - There is no such work queued (it may be executing right now)
  *
  ****************************************************************************/