fuse: fix data race in fusefs Release()

fix #3956

pkg/sentry/fsimpl/fuse/connection_control.go

@@ -189,10 +189,9 @@ func (conn *connection) initProcessReply(out *linux.FUSEInitOut, hasSysAdminCap
 // Abort this FUSE connection.
 // It tries to acquire conn.fd.mu, conn.lock, conn.bgLock in order.
 // All possible requests waiting or blocking will be aborted.
+//
+// Preconditions: conn.fd.mu is locked.
 func (conn *connection) Abort(ctx context.Context) {
-	conn.fd.mu.Lock()
-	defer conn.fd.mu.Unlock()
-
 	conn.mu.Lock()
 	conn.asyncMu.Lock()
 

pkg/sentry/fsimpl/fuse/fusefs.go

@@ -225,12 +225,13 @@ func newFUSEFilesystem(ctx context.Context, devMinor uint32, opts *filesystemOpt
 
 // Release implements vfs.FilesystemImpl.Release.
 func (fs *filesystem) Release(ctx context.Context) {
+	fs.conn.fd.mu.Lock()
+
 	fs.umounted = true
 	fs.conn.Abort(ctx)
-
-	fs.conn.fd.mu.Lock()
 	// Notify all the waiters on this fd.
 	fs.conn.fd.waitQueue.Notify(waiter.EventIn)
+
 	fs.conn.fd.mu.Unlock()
 
 	fs.Filesystem.VFSFilesystem().VirtualFilesystem().PutAnonBlockDevMinor(fs.devMinor)