Claude review: security: dma-heap: Add dma_heap_alloc LSM hook

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Adds `security_dma_heap_alloc()` called when `charge_pid_fd` is set.

**Issue 1 - Hook naming:** The hook is named `dma_heap_alloc` but it specifically guards the cross-cgroup charging operation, not allocation in general. A name like `dma_heap_charge_to` would be more precise and less likely to be confused with a general allocation permission.

**Issue 2 - Hook parameters:** The hook only receives `from` and `to` credentials. It might be useful to also pass the heap or allocation size so that policy can be more fine-grained (e.g., allowing cross-charging only up to certain sizes, or only for certain heaps). This is a design trade-off for the RFC discussion.

**Issue 3 - Ordering with mm access:** The LSM check happens before `get_mem_cgroup_from_mm()`:
```c
+		tcred = get_task_cred(task);
+		ret = security_dma_heap_alloc(current_cred(), tcred);
+		put_cred(tcred);
+		if (ret) {
+			put_task_struct(task);
+			return ret;
+		}
+
+		memcg = get_mem_cgroup_from_mm(task->mm);
```
This is correct — check policy first, then access mm. But the `task->mm` NULL issue from patch 2 still applies here.

---
Generated by Claude Code Patch Reviewer