Claude review: dma-buf: fix UAF in dma_buf_fd() tracepoint

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: dma-buf: fix UAF in dma_buf_fd() tracepoint
Author: David Carlier <devnexen@gmail.com>
Patches: 1
Reviewed: 2026-05-25T17:28:46.572678

---

This is a single-patch fix for a real UAF (use-after-free) bug in the dma-buf subsystem, reported by syzbot. The analysis is correct: `FD_ADD()` atomically allocates an fd and installs the file, meaning the fd is live and closeable before the `DMA_BUF_TRACE()` tracepoint runs. A racing `close()` on the fd can free the `dma_buf`, and then the tracepoint dereferences `dmabuf->name_lock` — slab-use-after-free.

The fix is sound: split `FD_ADD()` back into `get_unused_fd_flags()` + `fd_install()`, placing the tracepoint between them. While the fd slot is reserved but has a NULL file pointer, a concurrent `close()` returns `-EBADF` without entering `__fput()`, so the `dma_buf` remains alive during the trace. This is the same pattern already used for the `dma_buf_put()` tracepoint (commit 2d76319c4cbb).

The patch is clean, minimal, well-explained, and appropriate for stable backport. No concerns.

---
Generated by Claude Code Patch Reviewer