Re: [syzbot] [fuse?] general protection fault in fuse_dev_release

[Miklos Szeredi]

On Mon, 1 Jun 2026 at 12:27, syzbot
<syzbot+5bfc774fd6dffbbc4b70@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

> RIP: 0010:list_empty include/linux/list.h:404 [inline]
> RIP: 0010:list_splice_init include/linux/list.h:602 [inline]
> RIP: 0010:fuse_dev_release+0x19c/0x670 fs/fuse/dev.c:2221

Found a race between fuse_dev_install_with_pq() and
fuse_dev_release().  One uses fch->lock the other fpq->lock, so there
can be a short window where fud->pq.processing is NULL after fud->chan
was set.  This would explain the Oops.

Fixed in #for-next, let's see if this still reproduces.

Thanks,
Miklos