[BUG] Recursive locking deadlock in hfsplus

From: Jiakai Xu
Date: Mon Dec 01 2025 - 05:59:19 EST


Hi,

I discovered a recursive locking bug in the hfsplus filesystem through fuzzing
and successfully reproduced it on Linux mainline (v6.18).

The issue occurs when hfsplus_file_extend() holds extents_lock while calling
hfsplus_block_allocate(), which may trigger I/O that recursively calls
hfsplus_get_block(), which then tries to acquire the same extents_lock again.

Call chain:
hfsplus_file_extend()
└─ mutex_lock(&hip->extents_lock)
hfsplus_block_allocate()
└─ ...
└─ hfsplus_get_block()
└─ mutex_lock(&hip->extents_lock) ← recursive locking

Details: https://github.com/j1akai/temp/tree/main/20251201

Best regards,
Jiakai Xu