Comment 72 for bug 1470250

I suspect the race condition may be in vss_on_msg() with the non-thread-safe variable vss_transaction.state.

And I guess the below patch may have fixed the issue (the patch hasn't be in the upstream yet):
http://lkml.iu.edu/hypermail/linux/kernel/1510.3/04218.html

I can only test the patch tomorrow. So it would be great if somebody can help to test the patch today, at your conveniement. Or, just wait my result. :-)