linux-kernel - [BUG] Recursive locking deadlock in hfsplus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <40aee9ba.3b455.19ad98a3245.Coremail.xujiakai2025@iscas.ac.cn>
Date: Mon, 1 Dec 2025 18:51:44 +0800 (GMT+08:00)
From: "Jiakai Xu" <xujiakai2025@...as.ac.cn>
To: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: "Yangtao Li" <frank.li@...o.com>, 
	"John Paul Adrian Glaubitz" <glaubitz@...sik.fu-berlin.de>, 
	"Viacheslav Dubeyko" <slava@...eyko.com>, 2200013188@....pku.edu.cn
Subject: [BUG] Recursive locking deadlock in hfsplus

Hi,

I discovered a recursive locking bug in the hfsplus filesystem through fuzzing 
and successfully reproduced it on Linux mainline (v6.18).

The issue occurs when hfsplus_file_extend() holds extents_lock while calling
hfsplus_block_allocate(), which may trigger I/O that recursively calls
hfsplus_get_block(), which then tries to acquire the same extents_lock again.

Call chain:
  hfsplus_file_extend()
    └─ mutex_lock(&amp;hip-&gt;extents_lock)
       hfsplus_block_allocate()
          └─ ...
             └─ hfsplus_get_block()
                └─ mutex_lock(&amp;hip-&gt;extents_lock) ← recursive locking

Details: https://github.com/j1akai/temp/tree/main/20251201

Best regards,
Jiakai Xu