Back-port of the following upstream commit...

commit 71d449b55abf5018d7c711b2b62abc0c083723c4
Author: Reinette Chatre <reinette.chatre@intel.com>
Date:   Mon Apr 20 14:37:01 2009 -0700

    iwl3945: use cancel_delayed_work_sync to cancel rfkill_poll
    
    Users reported lockup with work still trying to run
    after module has been unloaded.
    
    http://thread.gmane.org/gmane.linux.kernel.wireless.general/30594/focus=3060
    
    Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
    Reported-by: TJ <ubuntu@tjworld.net>
    Reported-by: Huaxu Wan <huaxu.wan@linux.intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff -up linux-2.6.29.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig linux-2.6.29.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c
--- linux-2.6.29.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig	2009-05-22 10:49:17.000000000 -0400
+++ linux-2.6.29.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c	2009-05-22 10:52:58.000000000 -0400
@@ -8110,7 +8110,7 @@ static void __devexit iwl3945_pci_remove
 	sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 
 	iwl3945_rfkill_unregister(priv);
-	cancel_delayed_work(&priv->rfkill_poll);
+	cancel_delayed_work_sync(&priv->rfkill_poll);
 
 	iwl3945_dealloc_ucode_pci(priv);