Unlike sr_open(), sr_close(), and sr_rwio(), sr_cancel() does not call the protocol specific cancel function directly. Instead, sr_cancel() calls walk_queue(), which walks the message queue for the given channel (sr_fd) for each of the queues (read, write, and ioctl) until it finds a message with the same process number.
If the message is the first message in the queue, walk_queue() calls the protocol specific cancel function (see line 15422). If a message is found but it is not the first message in the queue, walk_queue() removes the message from the queue and returns EINTR. If a message is not found, walk_queue() returns EAGAIN (which is a problem).