[BUG] Recursive locking deadlock in hfsplus
From: Jiakai Xu
Date: Mon Dec 01 2025 - 05:59:19 EST
Hi,
I discovered a recursive locking bug in the hfsplus filesystem through fuzzing
and successfully reproduced it on Linux mainline (v6.18).
The issue occurs when hfsplus_file_extend() holds extents_lock while calling
hfsplus_block_allocate(), which may trigger I/O that recursively calls
hfsplus_get_block(), which then tries to acquire the same extents_lock again.
Call chain:
hfsplus_file_extend()
└─ mutex_lock(&hip->extents_lock)
hfsplus_block_allocate()
└─ ...
└─ hfsplus_get_block()
└─ mutex_lock(&hip->extents_lock) ← recursive locking
Details: https://github.com/j1akai/temp/tree/main/20251201
Best regards,
Jiakai Xu