CVE-2026-53204

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe<br /> <br /> rsu_send_msg() can return -ETIMEDOUT when<br /> wait_for_completion_interruptible_timeout() fires while the SMC call is still<br /> pending. In stratix10_rsu_probe(), the error paths for COMMAND_RSU_DCMF_VERSION,<br /> COMMAND_RSU_DCMF_STATUS, COMMAND_RSU_MAX_RETRY and COMMAND_RSU_GET_SPT_TABLE<br /> call stratix10_svc_free_channel() - which sets chan-&gt;scl to NULL - but then<br /> fall through and queue the next request on the same channel. The next svc<br /> kthread that runs will dereference pdata-&gt;chan-&gt;scl in its receive callback<br /> path, triggering a NULL pointer dereference identical to the one fixed by<br /> commit c45f7263100c ("firmware: stratix10-rsu: Fix NULL pointer dereference<br /> when RSU is disabled") for the COMMAND_RSU_STATUS path.<br /> <br /> Apply the same cleanup pattern to the remaining failure paths: remove the<br /> async client, free the channel, and return early so no further messages are<br /> queued on a channel whose scl has been cleared.<br /> <br /> While at it, clean up stratix10_rsu_probe() in two ways without changing<br /> behavior:<br /> <br /> - Drop redundant zero-initialization of fields already cleared by<br /> devm_kzalloc(): client.receive_cb, status.* and spt0/1_address<br /> (INVALID_SPT_ADDRESS is 0x0).<br /> <br /> - Replace five identical 3-line error-cleanup blocks<br /> (stratix10_svc_remove_async_client() + stratix10_svc_free_channel() +<br /> return ret) with goto labels (remove_async_client, free_channel),<br /> matching the standard kernel resource-unwinding pattern and making it<br /> easier to extend the probe sequence without forgetting matching<br /> cleanup.<br /> <br /> Also move init_completion() next to mutex_init() so sync-primitive<br /> initialization is grouped before anything that could trigger a<br /> callback.<br /> <br /> ---<br /> v2: Add a minor clean-up of the function stratix10_rsu_probe() to have a<br /> centralize exit for all the rsu_send_async_msg() and rsu_send_msg().