BACKPORT: scsi: ufs: Fix device management cmd timeout flow

In the UFS error handling flow, the host will send a device management
cmd(NOP OUT) to the device for link recovery. If this cmd times out and
clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing
andreturn. hba->dev_cmd.complete struct is not set to NULL.

When this happens, if cmd has been completed by device, then we will
call complete() in __ufshcd_transfer_req_compl(). Because the complete
struct is allocated on the stack, the following crash will occur:

   ipanic_die+0x24/0x38 [mrdump]
   die+0x344/0x748
   arm64_notify_die+0x44/0x104
   do_debug_exception+0x104/0x1e0
   el1_dbg+0x38/0x54
   el1_sync_handler+0x40/0x88
   el1_sync+0x8c/0x140
   queued_spin_lock_slowpath+0x2e4/0x3c0
   __ufshcd_transfer_req_compl+0x3b0/0x1164
   ufshcd_trc_handler+0x15c/0x308
   ufshcd_host_reset_and_restore+0x54/0x260
   ufshcd_reset_and_restore+0x28c/0x57c
   ufshcd_err_handler+0xeb8/0x1b6c
   process_one_work+0x288/0x964
   worker_thread+0x4bc/0xc7c
   kthread+0x15c/0x264
   ret_from_fork+0x10/0x30

Bug: 283165837
Bug: 283020302
Bug: 280957963
Change-Id: I1529c332847ace10bf4a6f8c1ec10ea2eb1eea6a
(cherry picked from commit 36822124)
Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com


Signed-off-by: Mason Zhang <Mason.Zhang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: tanghuan <tanghuan@vivo.com>
(cherry picked from commit c28be8ff)