There are several issues that lead to problems when cryptohome is performing some lengthy or delayed operation while the session is closed and umounts are happening. Here is the current state of things:

1) All known mounts are stored in a map (username -> mount) in mounts_ field of Service.

2) mounts_ is accessed from Service methods called from at least 3 threads: main (dbus) thread, mount_thread_, tpm_init_->work_thread_.

3) Occasionally, access to mounts_ is protected by mounts_lock_. But reads are typically unprotected.

4) InitializeTpmComplete called from tpm_init_->work_thread_ waits for mount_thread_'s tasks while holding mounts_lock_.

As a result:
(2) + (3) => Methods that read the mounts_ can iterate through the map, while some other thread deletes elements (during unmount) - unsafe.
(2) + (3) + (5) => Potential deadlock: It is possible that a task placed earlier on mount_thread_ is waiting on mounts_lock_ preventing other tasks from running, while InitializeTpmComplete waits on a later task while holding mounts_lock_.

On a plus side, it looks like all the tasks placed on mount_thread_ that have a pointer to mount as a parameter, have it AddRef'd, but that needs to be double-checked.

Examples of how these issues manifest themselves can be found in issue 618392,  issue 616854 , possibly issue 631640, etc.