[PATCH v2 1/2] nfc: pn533: complete failed queued commands and keep queue moving

[Zhao Feng]

When pn533_wq_cmd() fails to send a queued command it silently drops
it: the completion callback is never called, cmd_pending stays set and
cmd_work is never rescheduled.  As a result:

- a synchronous caller sleeps forever in pn533_send_cmd_sync()'s
  wait_for_completion();
- an asynchronous caller is never completed, leaking its callback
  context (e.g. struct pn533_data_exchange_arg, and the sock_hold()
  reference for rawsock);
- cmd_pending stuck at 1 makes every later command queue up without
  ever being sent, freezing the device until unbind.

The broken error path is as old as the command queue, but it used to
require an URB submission error to trigger; a device that stalls the
OUT endpoint reaches it via the send timeout added by the next patch.

Call the command's completion callback with the error and reschedule
cmd_work (unless the callback chained a direct command by returning
-EINPROGRESS) so that every queued command completes with an error and
the queue drains instead of freezing.

Signed-off-by: Zhao Feng <zhaofeng2@xxxxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
---
 drivers/nfc/pn533/pn533.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index e2bc67300a..3087f4f347 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -572,9 +572,15 @@ static void pn533_wq_cmd(struct work_struct *work)
 	dev->cmd = cmd;
 	rc = dev->phy_ops->send_frame(dev, cmd->req);
 	if (rc < 0) {
+		int cb_rc;
+
 		dev->cmd = NULL;
 		dev_kfree_skb(cmd->req);
+		cb_rc = cmd->complete_cb(dev, cmd->complete_cb_context,
+					 ERR_PTR(rc));
 		kfree(cmd);
+		if (cb_rc != -EINPROGRESS)
+			queue_work(dev->wq, &dev->cmd_work);
 		return;
 	}
 
-- 
2.39.2