BACKPORT: scsi: ufs: Fix device management cmd timeout flow

In the UFS error handling flow, the host will send a device management
cmd(NOP OUT) to the device for link recovery. If this cmd times out and
clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing
andreturn. hba->dev_cmd.complete struct is not set to NULL.

When this happens, if cmd has been completed by device, then we will
call complete() in __ufshcd_transfer_req_compl(). Because the complete
struct is allocated on the stack, the following crash will occur:

   ipanic_die+0x24/0x38 [mrdump]
   die+0x344/0x748
   arm64_notify_die+0x44/0x104
   do_debug_exception+0x104/0x1e0
   el1_dbg+0x38/0x54
   el1_sync_handler+0x40/0x88
   el1_sync+0x8c/0x140
   queued_spin_lock_slowpath+0x2e4/0x3c0
   __ufshcd_transfer_req_compl+0x3b0/0x1164
   ufshcd_trc_handler+0x15c/0x308
   ufshcd_host_reset_and_restore+0x54/0x260
   ufshcd_reset_and_restore+0x28c/0x57c
   ufshcd_err_handler+0xeb8/0x1b6c
   process_one_work+0x288/0x964
   worker_thread+0x4bc/0xc7c
   kthread+0x15c/0x264
   ret_from_fork+0x10/0x30

Bug:280957963
Change-Id: I1529c332847ace10bf4a6f8c1ec10ea2eb1eea6a
(cherry picked from commit 36822124f9)
Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com
Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: tanghuan <tanghuan@vivo.com>

drivers/scsi/ufs/ufshcd.c

@@ -2926,6 +2926,21 @@ retry:
 		} else {
 			dev_err(hba->dev, "%s: failed to clear tag %d\n",
 				__func__, lrbp->task_tag);
+			spin_lock_irqsave(hba->host->host_lock, flags);
+			pending = test_bit(lrbp->task_tag,
+					   &hba->outstanding_reqs);
+			if (pending)
+				hba->dev_cmd.complete = NULL;
+			spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+			if (!pending) {
+				/*
+				 * The completion handler ran while we tried to
+				 * clear the command.
+				 */
+				time_left = 1;
+				goto retry;
+			}
 		}
 	}