[PATCH v2 0/2] nfc: pn533: fix hung task on stalled USB send

The out URB wait in pn533_usb_send_frame() is unbounded, so a device
that never completes the transfer hangs the task holding the command
lock (syzbot report).  Simply adding a timeout is not enough, because
the error path of pn533_wq_cmd() cannot deal with a send failure: it
drops the queued command without completing it, leaving synchronous
callers asleep forever and the command queue frozen.

Patch 1 fixes that pre-existing error path; patch 2 then adds the
actual send timeout, handling the race where the transfer completes
right between the timeout expiring and the URB being killed.

Issues pointed out by the Sashiko AI review of v1.

Link to v1: https://lore.kernel.org/netdev/20261023025602.1746-1-zhaofeng2@cmss.chinamobile.com/ (local)

Zhao Feng (2):
  nfc: pn533: complete failed queued commands and keep queue moving
  nfc: pn533: add timeout to USB frame send completion wait

 drivers/nfc/pn533/pn533.c |  8 +++++++-
 drivers/nfc/pn533/usb.c   | 20 ++++++++++++++++----
 2 files changed, 23 insertions(+), 5 deletions(-)

-- 
2.39.2