DF-4844 — drm_sched_entity_fini dependency TOCTOU vs the fence-signaled clear_dep callback

sys/dev/drm/scheduler/sched_entity.c:279-284 (fini, dependency cleanup):

    if (entity->dependency) {
        dma_fence_remove_callback(entity->dependency, &entity->cb);
        dma_fence_put(entity->dependency);
        entity->dependency = NULL;
    }

entity->dependency is written unsynchronized by the fence callback drm_sched_entity_clear_dep() (sched_entity.c:312-320) from fence-signaling context — on amdgpu that is the IRQ ithread (or any thread completing the dependency fence) running entity->dependency = NULL; dma_fence_put(f); under fence->lock, not under anything the fini path holds.

If the dependency fence signals exactly between fini's NULL-check and the dma_fence_remove_callback() call, the argument is either:

• NULL (cb won) → dma_fence_remove_callback(NULL, ...) → lockmgr(fence->lock, ...) NULL deref → fatal panic (sys/dev/drm/linux_fence.c:322-327); or
• a stale pointer whose reference the cb just dropped — if that put was the last, the fence is freed → lockmgr on freed memory (UAF).

Status: UNTESTED (speculative — single-window TOCTOU)

Reachability sketch (unprivileged, amdgpu render node): submit a CS job depending on a long-running fence (entity sits with dependency armed via drm_sched_entity_pop_job), then SIGKILL/close the fd so amdgpu_ctx_fini runs drm_sched_entity_flush (interruptible wait bails on the signal, job still queued, entity->dependency still set) and drm_sched_entity_fini enters the cleanup — while the GPU completes the dependency fence at just the wrong moment. The window is a few instructions wide; the race is real (two unsynchronized writers to entity->dependency) but was not reproduced on the audit guest (needs a GPU-driven fence-completion timing source; the module harness would need a second thread signaling the dep fence inside the check→use window — trivially racy, only probabilistically hittable).

Identical shape exists in upstream Linux 5.4-era code; the port inherits it.

Suggested fix

Take a local reference before the check, e.g.:

-       if (entity->dependency) {
-           dma_fence_remove_callback(entity->dependency, &entity->cb);
-           dma_fence_put(entity->dependency);
-           entity->dependency = NULL;
-       }
+       struct dma_fence *dep = xchg(&entity->dependency, NULL);
+
+       if (dep) {
+           dma_fence_remove_callback(dep, &entity->cb);
+           dma_fence_put(dep);
+       }

(the callback's own entity->dependency = NULL write becomes the loser of the xchg; dep cannot be NULL/stale inside the block). The same pattern should guard drm_sched_entity_add_dependency_cb()'s field swaps.