Claude review: dma-buf: add DMA_BUF_IOCTL_DERIVE for reduced-permission aliases

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: dma-buf: add DMA_BUF_IOCTL_DERIVE for reduced-permission aliases
Author: Albert Esteve <aesteve@redhat.com>
Patches: 7
Reviewed: 2026-05-25T20:27:32.725080

---

This series adds `DMA_BUF_IOCTL_DERIVE`, a mechanism to create a new file descriptor for an existing dma-buf with a subset of the caller's permissions. The use case (handing read-only views to less-privileged consumers) is well-motivated and the cover letter does a good job explaining why existing approaches (dup, /proc/self/fd, re-export) don't work.

The overall design — cloning the file with `alloc_file_clone`, sharing the same `struct dma_buf` / `dma_resv`, and adding a targeted mmap write check — is reasonable. The refcount management via `get_dma_buf` / `dma_buf_put` and the move of `__dma_buf_list_del` to dentry release are sound.

However, there is a **security bug** in the permission escalation check: `O_WRONLY` is not blocked when deriving from an `O_RDONLY` fd, which is a privilege escalation. There are also a few design gaps worth discussing (DMA access, sync ioctl, write-only interactions).

---

---
Generated by Claude Code Patch Reviewer