[v6.6] kernel BUG in jfs_unlink

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7a137e9bfa0e Linux 6.6.127
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1458d95a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2a950bf7c0bff9f9
dashboard link: https://syzkaller.appspot.com/bug?extid=a4f985d16d75c2c5355f
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10804152580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1598fc02580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/04a02efb4a79/disk-7a137e9b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f7b848f192f0/vmlinux-7a137e9b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/77a981f90b3d/bzImage-7a137e9b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b7ea3060fe5d/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1058d95a580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a4f985...@syzkaller.appspotmail.com

BUG at fs/jfs/namei.c:513 assert(ip->i_nlink)
------------[ cut here ]------------
kernel BUG at fs/jfs/namei.c:513!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5874 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:jfs_unlink+0x9e7/0xa10 fs/jfs/namei.c:513
Code: fe e9 86 fb ff ff e8 08 7c 87 fe 48 c7 c7 60 ac 03 8b 48 c7 c6 20 aa 03 8b ba 01 02 00 00 48 c7 c1 a0 ac 03 8b e8 59 53 79 07 <0f> 0b e8 e2 7b 87 fe 48 c7 c7 60 ac 03 8b 48 c7 c6 20 aa 03 8b ba
RSP: 0018:ffffc900036c7c40 EFLAGS: 00010246
RAX: 000000000000002d RBX: ffff88805e1696b0 RCX: 64e7beea83c2df00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc900036c7d80 R08: ffffc900036c7947 R09: 1ffff920006d8f28
R10: dffffc0000000000 R11: fffff520006d8f29 R12: 0000000000000001
R13: 1ffff920006d8f94 R14: 0000000000000000 R15: dffffc0000000000
FS: 000055558028e500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555802b1a68 CR3: 0000000061f3f000 CR4: 00000000003506e0
Call Trace:
<TASK>
vfs_unlink+0x389/0x600 fs/namei.c:4333
do_unlinkat+0x339/0x590 fs/namei.c:4399
__do_sys_unlink fs/namei.c:4447 [inline]
__se_sys_unlink fs/namei.c:4445 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4445
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f594359b717
Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc349be9f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f594359b717
RDX: 00007ffc349bea20 RSI: 00007ffc349beab0 RDI: 00007ffc349beab0
RBP: 00007ffc349beab0 R08: 00007ffc349bfab0 R09: 00000000ffffffff
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc349bfba0
R13: 00007f5943631ef0 R14: 0000000000019c90 R15: 00007ffc349c0c70
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_unlink+0x9e7/0xa10 fs/jfs/namei.c:513
Code: fe e9 86 fb ff ff e8 08 7c 87 fe 48 c7 c7 60 ac 03 8b 48 c7 c6 20 aa 03 8b ba 01 02 00 00 48 c7 c1 a0 ac 03 8b e8 59 53 79 07 <0f> 0b e8 e2 7b 87 fe 48 c7 c7 60 ac 03 8b 48 c7 c6 20 aa 03 8b ba
RSP: 0018:ffffc900036c7c40 EFLAGS: 00010246
RAX: 000000000000002d RBX: ffff88805e1696b0 RCX: 64e7beea83c2df00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc900036c7d80 R08: ffffc900036c7947 R09: 1ffff920006d8f28
R10: dffffc0000000000 R11: fffff520006d8f29 R12: 0000000000000001
R13: 1ffff920006d8f94 R14: 0000000000000000 R15: dffffc0000000000
FS: 000055558028e500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f712d1f4000 CR3: 0000000061f3f000 CR4: 00000000003506f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup