CVE-2026-63910: dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: fix UAF in dmabuffd() tracepoint

Once FDADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMABUFTRACE() runs. The close drops the last reference, fput() frees the dmabuf, and the tracepoint then dereferences dmabuf to take dmabuf->namelock -- slab-use-after-free.

Split FDADD() back into getunusedfdflags() + fdinstall() and emit the tracepoint between them. While the fdtable slot is reserved with a NULL file pointer, a racing close() returns -EBADF without entering fput(), so the dmabuf stays alive across the trace. Same approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dmabufput() tracepoint").

This undoes the FDADD() conversion done in commit 34dfce523c90 ("dma: convert dmabuffd() to FDADD()"); FDADD() has no place to hook the tracepoint safely.