The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free. Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended. Reported-by: syzbot+d6540a3fa1626e11360d@syzkaller.appspotmail.com Fixes: 204aa22a686b ("fuse: abort on fatal signal during sync init") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Rochan Avlur --- Tested by injecting a msleep(100) between spin_unlock(&fpq->lock) and the req->args->page_replace access in fuse_dev_do_write() to widen the race window, then running a reproducer that concurrently writes the INIT reply while SIGKILL is delivered to the mount process. KASAN reliably reports the slab-use-after-free without the fix, and the report is absent with the fix applied. fs/fuse/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index c105aaf9ff5d..b946884d4d5b 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -572,7 +572,7 @@ static void request_wait_answer(struct fuse_req *req) if (req->args->abort_on_kill) { fuse_abort_conn(fc); - return; + goto wait_for_finish; } if (test_bit(FR_URING, &req->flags)) @@ -583,6 +583,7 @@ static void request_wait_answer(struct fuse_req *req) return; } +wait_for_finish: /* * Either request is already in userspace, or it was forced. * Wait it out. -- 2.45.2