CVE-2026-90284: firmware_loader: do not queue completed sysfs fallback requests

In the Linux kernel, the following vulnerability has been resolved:

firmwareloader: do not queue completed sysfs fallback requests

fwloadsysfsfallback() calls deviceadd() before adding the fwpriv to pendingfwhead. deviceadd() publishes the fallback loading interface, so a userspace helper which discovers the device by scanning sysfs can write 0 to the loading attribute and complete the request before it is queued as pending.

In that interleaving firmwareloadingstore() calls fwstatedone() while pendinglist still points to itself, so it cannot remove an entry from pendingfwhead. The subsequent unconditional listadd() then queues an already-completed fwpriv. Once the request is released, pendingfwhead can retain a pointer to freed memory and the next fallback request can fault while validating the list.

Only in-flight fallback requests need suspend or reboot abort handling. If the request is already DONE after deviceadd(), return success from the fallback path without sending another uevent, waiting again, or queueing it as pending. This preserves the invariant that pendingfwhead contains only active fallback requests.