fuse.DeviceFD needs to hold a reference on the associated filesystem.

This fixes a use-after-free in fuse.DeviceFD.Release.

PiperOrigin-RevId: 332394146

pkg/sentry/fsimpl/fuse/dev.go

@@ -95,9 +95,14 @@ type DeviceFD struct {
 }
 
 // Release implements vfs.FileDescriptionImpl.Release.
-func (fd *DeviceFD) Release(context.Context) {
+func (fd *DeviceFD) Release(ctx context.Context) {
 	if fd.fs != nil {
+		fd.fs.conn.mu.Lock()
 		fd.fs.conn.connected = false
+		fd.fs.conn.mu.Unlock()
+
+		fd.fs.VFSFilesystem().DecRef(ctx)
+		fd.fs = nil
 	}
 }
 

pkg/sentry/fsimpl/fuse/fusefs.go

@@ -218,6 +218,7 @@ func newFUSEFilesystem(ctx context.Context, devMinor uint32, opts *filesystemOpt
 		conn:     conn,
 	}
 
+	fs.VFSFilesystem().IncRef()
 	fuseFD.fs = fs
 
 	return fs, nil