Re: [PATCH] fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

Miklos Szeredi <[email protected]> Mon, 17 Aug 2026 17:58:39 +0200

Newsgroups	gmane.linux.kernel,gmane.linux.file-systems,gmane.linux.kernel.stable
Message-ID	<CAJfpeguLnQ3rps_zz5sQmb4BZSG+C8+d5cCJdW2+VxCdtajhxA@mail.gmail.com>

On Thu, 13 Aug 2026 at 05:59, Rochan Avlur <[email protected]> wrote:
>
> The abort_on_kill path in request_wait_answer() calls fuse_abort_conn()
> and returns without waiting for FR_FINISHED.  If fuse_dev_do_write() is
> concurrently processing the same request (FR_LOCKED set), the caller
> frees req->args while it is still being accessed, causing a
> use-after-free.
>
> Fix this by jumping to the existing wait_event(FR_FINISHED) instead of
> returning early.  The wait will not hang because fuse_abort_conn()
> ensures all requests are ended.
>
> Reported-by: [email protected]
> Fixes: 204aa22a686b ("fuse: abort on fatal signal during sync init")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Rochan Avlur <[email protected]>

Applied, thanks.

Miklos