--- a/net/bluetooth/hci_core.c	2022-05-14 15:50:24.949518600 +0800
+++ b/net/bluetooth/hci_core.c	2022-05-14 15:56:36.582294000 +0800
@@ -548,6 +548,7 @@ int hci_dev_do_close(struct hci_dev *hde
 
 	BT_DBG("%s %p", hdev->name, hdev);
 
+	cancel_work_sync(&hdev->power_on);
 	hci_req_sync_lock(hdev);
 
 	err = hci_dev_close_sync(hdev);
@@ -2675,6 +2676,7 @@ void hci_unregister_dev(struct hci_dev *
 	list_del(&hdev->list);
 	write_unlock(&hci_dev_list_lock);
 
+	cancel_work_sync(&hdev->power_on);
 	hci_cmd_sync_clear(hdev);
 
 	if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks))
--- a/net/bluetooth/hci_sync.c	2022-05-14 15:50:22.392948600 +0800
+++ b/net/bluetooth/hci_sync.c	2022-05-14 18:49:47.178204500 +0800
@@ -4050,6 +4050,7 @@ setup_failed:
 			hdev->flush(hdev);
 
 		if (hdev->sent_cmd) {
+			cancel_delayed_work_sync(&hdev->cmd_timer);
 			kfree_skb(hdev->sent_cmd);
 			hdev->sent_cmd = NULL;
 		}
@@ -4089,7 +4090,6 @@ int hci_dev_close_sync(struct hci_dev *h
 
 	bt_dev_dbg(hdev, "");
 
-	cancel_work_sync(&hdev->power_on);
 	cancel_delayed_work(&hdev->power_off);
 	cancel_delayed_work(&hdev->ncmd_timer);