CVE-2026-98342: dmaengine: wait for RCU readers before releasing dma_device

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: wait for RCU readers before releasing dmadevice

dmaissuependingall() walks the dmadevicelist with listforeachentryrcu() under rcureadlock(). dmadevicerelease() unlinks the device with listdelrcu() and then calls device->devicerelease() (which in many drivers, such as plxdma.c, directly calls kfree()).

Because there is no grace period between unlinking the device and freeing it, concurrent RCU readers in dmaissuependingall() can access the device after it has been freed.

The lockless walk originally relied on clients holding a dmaengine reference to pin the provider module, and therefore the device, for as long as they might traverse the list. Commit 8ad342a86359 ("dmaengine: Add reference counting to dmadevice struct") decoupled the dmadevice lifetime from the module reference, so the device can now be released while a reader is still walking the list.

Add synchronizercu() before the device is freed, so RCU readers are guaranteed to have finished. Keep it unconditional: providers that do not implement devicerelease() free the device themselves once dmaasyncdeviceunregister() returns. This call will delay for a grace period with dmalistmutex held, which is safe and only teardown path is delayed.