fuse: fix use-after-free in fuse_direct_IO()