[BUG] jffs2: kernel BUG in jffs2_del_ino_cache

[BUG] jffs2: kernel BUG in jffs2_del_ino_cache

[CJ]

Hi,

I am reporting a kernel BUG in the jffs2 inode cache handling, triggered by a
syzkaller reproducer.  The issue is reproducible with HEAD commit
cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).

The reproducer mounts devtmpfs, mounts the jffs2 filesystem found on
/dev/mtdblock0, and then sets a trusted.overlay.redirect extended attribute on
the mount point.  No crafted image is uploaded by the reproducer; the trigger is
the attribute operation on the jffs2 mount.

The console shows "kernel BUG at fs/jffs2/nodelist.c:462!" with an
invalid-opcode Oops and RIP in jffs2_del_ino_cache.  The path reaches it from
jffs2_do_clear_inode during inode eviction, when the inode cache entry is being
removed while the filesystem is still holding references related to the
attribute operation.

One possible cause is that the extended-attribute operation leaves an inode with
an unexpected cache state, so the removal path takes a branch that asserts the
inode is present in the cache list when it is not (or is present twice).  This
looks like a state-management problem in the jffs2 inode cache rather than a
bounds error.  I am reporting the assertion and the path as observed.

This appears to be a recurrence of the syzbot issue whose external id is
93f6bfed6a4a702b48cc.  It remains reproducible on v7.3-rc1.

Reproducer:

syz reproducer:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0)
lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./mnt\x00', &(0x7f0000000080), 0x0, 0x0, 0x0)

console output: https://pastebin.com/raw/wfCKUiUY
kernel config: https://pastebin.com/raw/1TiKKS9a

Kernel:

HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)

Let me know if you need more details or testing.

Best regards,
Changjian