The multipath destructor must flush its workqueue.
Otherwise items that reference the destroyed object could remain.

[submitted to -mm]

--- diff/drivers/md/dm-mpath.c	2005-07-06 17:19:21.000000000 +0100
+++ source/drivers/md/dm-mpath.c	2005-07-06 17:19:59.000000000 +0100
@@ -761,6 +761,8 @@
 static void multipath_dtr(struct dm_target *ti)
 {
 	struct multipath *m = (struct multipath *) ti->private;
+
+	flush_workqueue(kmultipathd);
 	free_multipath(m);
 }