rt5682_i2c_shutdown(), which is also the remove path, cancels jack_detect_work before jd_check_work. With a headset button held, jd_check_work can observe jack removal and queue jack_detect_work after the first cancel. That work can then run after the codec is reset or, on remove, after the driver data is freed. Use disable_delayed_work_sync() for both works, which can queue each other, to drain them and prevent requeueing. Probe initializes fresh work on rebind. Found by a static analysis tool under development. Fixes: 45a2702ce109 ("ASoC: rt5682: Fix panic in rt5682_jack_detect_handler happening during system shutdown") Cc: stable@vger.kernel.org # v6.10+ Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- sound/soc/codecs/rt5682-i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c index 43132943f6a7..db820cd9acba 100644 --- a/sound/soc/codecs/rt5682-i2c.c +++ b/sound/soc/codecs/rt5682-i2c.c @@ -299,8 +299,8 @@ static void rt5682_i2c_shutdown(struct i2c_client *client) struct rt5682_priv *rt5682 = i2c_get_clientdata(client); disable_irq(client->irq); - cancel_delayed_work_sync(&rt5682->jack_detect_work); - cancel_delayed_work_sync(&rt5682->jd_check_work); + disable_delayed_work_sync(&rt5682->jack_detect_work); + disable_delayed_work_sync(&rt5682->jd_check_work); rt5682_reset(rt5682); } base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47 -- 2.43.0