This patch fixes the crash, but is IMHO incomplete: The flush_work() in .ndo_stop() should also be removed, since its existence implies unexpected behaviour.
In other words, my moving it there in can327 was a double mistake, and slcan just happened to copy my mistake over.
I'm preparing a patch for can327, and it will remove the flush from .ndo_stop(). What shall we do about slcan?
Max