CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Hold device ref until queue teardown completes

GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock.

Hold a drmdevice reference for the queue lifetime and drop it after queue teardown completes. This keeps drmm cleanup from running while async destroy work is still pending.

Move GuC destroy work to a module-lifetime Xe workqueue and flush it on PCI remove so hot-unbind/rebind still waits for pending destroy work.

With queue-held device refs, gucsubmitswfini() cannot run with live GuC IDs. Replace the fini wait with an assertion and remove the unused finiwq.

v2: - Rebase

v3: - Switch to queue-lifetime drmdevget()/drmdevput() model. (Matt) - Queue async teardown on systemdflwq instead of xe->destroywq. (Matt) - Drop separate deferred drmdevput worker. - Remove stale drainworkqueue(xe->destroywq) from gucsubmitswfini().

v4: - Replace the gucsubmitswfini() wait with an assertion and remove the now-unused finiwq. (sashiko)

v5: - Move destroy work to a module-lifetime Xe workqueue instead of systemdflwq. (Matt) - Flush the module-lifetime destroy workqueue during PCI remove to preserve the old device-remove wait semantics.

v6: - Keep SVM pagemap destroy work on the per-device destroywq to avoid letting it outlive the xedevice/drmdevice. (Sashiko) - Use WQMEMRECLAIM for xe->destroywq because SVM pagemap destroy work can be queued from the reclaim path.

v7: - Drop the per-device xe->destroywq and use the module-level destroy WQ for SVM pagemap destroy as well. (Matt) - Rename xeexecqueuedestroywq() helpers to xedestroywq() helpers because the WQ is no longer exec-queue specific. (Matt)

v8: - Rebase.

v9: - Keep SVM pagemap destroy work on the per-device WQMEMRECLAIM destroywq because it can be queued from reclaim and embeds the devpagemap used by devres teardown. (Sashiko) - Keep the module-level destroy WQ GuC-only and drop WQMEMRECLAIM from it. - Update the module-WQ kdoc to document the GuC/SVM split.

v10: - Keep xe->destroywq per-cpu while adding WQMEMRECLAIM to fix the workqueue allocation warning.

v11: - Drop the SVM pagemap destroy comment as it was revision-specific. (Thomas)

v12: - Rebase.

(cherry picked from commit da1124abac689cc2b1d8995e5f0a816f8a122edb)