Re: [PATCH v2 2/2] nfc: pn533: add timeout to USB frame send completion wait

[Simon Horman <horms@kernel.org>]

On Tue, Oct 27, 2026 at 03:01:35PM +0800, Zhao Feng wrote:
> pn533_usb_send_frame() waits unboundedly for the out URB to complete.
> A device that never completes the transfer makes the task sleep
> forever in TASK_UNINTERRUPTIBLE while holding the command mutex, as
> reported by syzbot (hung task in pn533_usb_send_frame).
> 
> Use a 1 second timeout instead.  On timeout, kill the URB and return
> -ETIMEDOUT so the command in progress fails gracefully instead of
> hanging the task.
> 
> The transfer may complete between the timeout expiring and
> usb_kill_urb(); in that case urb->status is 0 after the kill and the
> send proceeds normally instead of reporting a spurious failure,
> mirroring what usb_start_wait_urb() does.
> 
> Fixes: 9dab880d675b ("nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()")
> Reported-by: syzbot+1c5368988052dc2d8201@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=1c5368988052dc2d8201
> Signed-off-by: Zhao Feng <zhaofeng2@cmss.chinamobile.com>
> Cc: <stable@vger.kernel.org>
> ---
> v2: check urb->status after killing the URB on timeout and carry on if
>     the transfer completed in the race window; add Fixes tag and Cc
>     stable; the pn533_wq_cmd() error handling fix is now patch 1/2.
>     Issues reported by the Sashiko AI review.

Reviewed-by: Simon Horman <horms@kernel.org>