diff --git a/0002-libfuse-Assign-NULL-to-old-to-avoid-free-it-twice-52.patch b/0002-libfuse-Assign-NULL-to-old-to-avoid-free-it-twice-52.patch
new file mode 100644
index 0000000..bd6a0e5
--- /dev/null
+++ b/0002-libfuse-Assign-NULL-to-old-to-avoid-free-it-twice-52.patch
@@ -0,0 +1,29 @@
+From d632df7ef5ede4d5a818a1bedbea8659113470b8 Mon Sep 17 00:00:00 2001
+From: winndows <winndows@163.com>
+Date: Wed, 1 Jul 2020 13:20:01 +0800
+Subject: [PATCH 1/2] libfuse: Assign NULL to "old" to avoid free it twice
+ (#522)
+
+Assign NULL to "old" at the first free(), to avoid the possible 2nd free() for it.
+
+Signed-off-by: Liao Pingfang <liao.pingfang@zte.com.cn>
+Co-authored-by: Liao Pingfang <liao.pingfang@zte.com.cn>
+---
+ lib/modules/iconv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/modules/iconv.c b/lib/modules/iconv.c
+index eb5edd8..3a4db7c 100644
+--- a/lib/modules/iconv.c
++++ b/lib/modules/iconv.c
+@@ -705,6 +705,7 @@ static struct fuse_fs *iconv_new(struct fuse_args *args,
+ 	if (old) {
+ 		setlocale(LC_CTYPE, old);
+ 		free(old);
++		old = NULL;
+ 	}
+ 
+ 	ic->next = next[0];
+-- 
+1.8.3.1
+
diff --git a/0003-fuse_lowlevel-Move-assert-for-se-before-dereferencin.patch b/0003-fuse_lowlevel-Move-assert-for-se-before-dereferencin.patch
new file mode 100644
index 0000000..5040a33
--- /dev/null
+++ b/0003-fuse_lowlevel-Move-assert-for-se-before-dereferencin.patch
@@ -0,0 +1,39 @@
+From bcb7659504c0b0ba6ab0fe0db930b686381da9ab Mon Sep 17 00:00:00 2001
+From: winndows <winndows@163.com>
+Date: Sat, 11 Jul 2020 02:58:07 +0800
+Subject: [PATCH 2/2] fuse_lowlevel: Move assert for se before dereferencing it
+ with se->debug (#530)
+
+Move assert for se before dereferencing it with se->debug.
+
+Signed-off-by: Liao Pingfang <liao.pingfang@zte.com.cn>
+
+Co-authored-by: Liao Pingfang <liao.pingfang@zte.com.cn>
+---
+ lib/fuse_lowlevel.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/lib/fuse_lowlevel.c b/lib/fuse_lowlevel.c
+index 3dabbd5..7b72ee0 100644
+--- a/lib/fuse_lowlevel.c
++++ b/lib/fuse_lowlevel.c
+@@ -167,6 +167,7 @@ static int fuse_send_msg(struct fuse_session *se, struct fuse_chan *ch,
+ {
+ 	struct fuse_out_header *out = iov[0].iov_base;
+ 
++	assert(se != NULL);
+ 	out->len = iov_length(iov, count);
+ 	if (se->debug) {
+ 		if (out->unique == 0) {
+@@ -189,8 +190,6 @@ static int fuse_send_msg(struct fuse_session *se, struct fuse_chan *ch,
+ 	int err = errno;
+ 
+ 	if (res == -1) {
+-		assert(se != NULL);
+-
+ 		/* ENOENT means the operation was interrupted */
+ 		if (!fuse_session_exited(se) && err != ENOENT)
+ 			perror("fuse: writing device");
+-- 
+1.8.3.1
+
diff --git a/fuse.spec b/fuse.spec
index eda27b9..0e5cc57 100644
--- a/fuse.spec
+++ b/fuse.spec
@@ -3,7 +3,7 @@
 
 Name:    fuse
 Version: %{fuse2ver}
-Release: 1
+Release: 2
 Summary: User space File System of fuse2
 License: GPL+ and LGPLv2+
 URL:     http://fuse.sf.net
@@ -15,6 +15,8 @@ Source2: %{name}.conf
 
 Patch0:        0000-fix-compile-error-because-of-ns-colliding.patch
 Patch1:        0001-fix-chown-and-mknod-failed.patch
+Patch2:        0002-libfuse-Assign-NULL-to-old-to-avoid-free-it-twice-52.patch
+Patch3:        0003-fuse_lowlevel-Move-assert-for-se-before-dereferencin.patch
 
 BuildRequires: libselinux-devel, pkgconfig, systemd-udev, meson, fdupes
 BuildRequires: autoconf, automake, libtool, gettext-devel, ninja-build
@@ -83,11 +85,15 @@ This contains man files for the using of fuse
 # fuse 2
 pushd %{name}-%{fuse2ver}
 %patch0 -p1
+%patch2    -p1
 popd
 
 # fuse 3
 pushd %{name}-%{fuse3ver}
 %patch1    -p1
+%patch2    -p1
+%patch3    -p1
+
 popd
 
 %build
@@ -172,6 +178,9 @@ install -p -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}
 
 
 %changelog
+* Mon Jul 13 2020 Zhiqiang Liu <liuzhiqiang26@huawei.com> -3.9.2-2
+- backport upstream bugfix patches
+
 * Mon Jul 06 2020 Youming Zhang <zhangyouming4@huawei.com> -3.9.2-1
 - Type:enhancement
 - ID:NA