Re: [PATCH] fuse: wait for sync init request after abort

On Fri, 31 Jul 2026 at 14:03, David Lee <[email protected]> wrote:
>
> After a fatal signal interrupts synchronous FUSE_INIT,
> request_wait_answer() aborts the channel and returns immediately.  If the
> request is in an FR_LOCKED reply-copy interval, fuse_chan_abort() leaves
> it for the writer to finish.  The synchronous caller can then free the
> fuse_init_args that owns the reply destination while the writer is still
> copying into it.
>
> Wait for fuse_request_end() after aborting the channel.  This keeps the
> synchronous caller's reply storage alive until any locked copy has
> finished, while preserving the fatal-signal abort behavior.
>
> Fixes: 204aa22a686b ("fuse: abort on fatal signal during sync init")
> Cc: [email protected]
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
>
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <[email protected]>

Thanks for the report and patch.

I've committed an equivalent fix to fuse.git #for-next:

64b0b5cacbd2 ("fuse: wait for FR_FINISHED on abort_on_kill to prevent
use-after-free")

Thanks,
Miklos