Re: [PATCH] fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

[Miklos Szeredi]

On Thu, 13 Aug 2026 at 05:59, Rochan Avlur <rochan.avlur@xxxxxxxxx> wrote:
>
> The abort_on_kill path in request_wait_answer() calls fuse_abort_conn()
> and returns without waiting for FR_FINISHED.  If fuse_dev_do_write() is
> concurrently processing the same request (FR_LOCKED set), the caller
> frees req->args while it is still being accessed, causing a
> use-after-free.
>
> Fix this by jumping to the existing wait_event(FR_FINISHED) instead of
> returning early.  The wait will not hang because fuse_abort_conn()
> ensures all requests are ended.
>
> Reported-by: syzbot+d6540a3fa1626e11360d@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 204aa22a686b ("fuse: abort on fatal signal during sync init")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Rochan Avlur <rochan.avlur@xxxxxxxxx>

Applied, thanks.

Miklos