RE: ubifs: read bad node type in ubifs_tnc_read_wbuf

[李傲傲 (Carson Li1/9542) <Carson.Li1@xxxxxxxxxx>]

On Monday, January 13, 2020 7:49 AM Richard <richard@xxxxxx> wrote:
>
>Do you have a test/reproducer for this issue?
>
I find out this issue from cases left over which used to happen frequently.
But when it comes to me, an one month's stress testing doesn't reproduce it.
it is only occasionally found on products that returned by costumer，but
with no logs added before to analysis it.


The kernel log I pasted before is one of the previous spot, including some
logs added to analysis it.
There are two more cases with the same appearance:
----------------------------------kernel log----------------------------------
[   30.293468] c0 UBIFS error (ubi0:23 pid 943): ubifs_read_node_wbuf: expected node type 0
[   30.304036] c1 UBIFS error (ubi0:23 pid 943): ubifs_read_node_wbuf: wbuf=c901b140,
buf=d5167000, wbuf->buf=c90ed000,offs=210744, len=160, rlen=0
[   30.354902] c1 UBIFS error (ubi0:23 pid 943): ubifs_read_node_wbuf: wxf bad node at LEB 54:210744
[   30.367063] c0 Not a node, first 24 bytes:
[   30.371204] c1 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   30.387611] c1 Kernel panic - not syncing: ch address is d5167000
[   30.398825] c1 CPU: 1 PID: 943 Comm: http-thread Tainted: G           O    4.4.83 #1
[   30.398836] c1 Hardware name: Generic DT based system
[   30.398869] c1 [<c001624c>] (unwind_backtrace) from [<c0012f8c>] (show_stack+0x10/0x14)
[   30.398885] c1 [<c0012f8c>] (show_stack) from [<c0287188>] (dump_stack+0x80/0xa0)
[   30.398900] c1 [<c0287188>] (dump_stack) from [<c00acff0>] (panic+0x70/0x1e4)
[   30.398919] c1 [<c00acff0>] (panic) from [<c01e3274>] (ubifs_dump_node+0x6c/0x9a0)
[   30.398938] c1 [<c01e3274>] (ubifs_dump_node) from [<c01c3200>] (ubifs_read_node_wbuf+0x350/0x384)
[   30.398951] c1 [<c01c3200>] (ubifs_read_node_wbuf) from [<c01e0d28>] (ubifs_tnc_read_node+0x54/0x214)
[   30.398965] c1 [<c01e0d28>] (ubifs_tnc_read_node) from [<c01c65ac>] (ubifs_tnc_locate+0x118/0x1b4)
[   30.398979] c1 [<c01c65ac>] (ubifs_tnc_locate) from [<c01bd2c8>] (ubifs_iget+0xb8/0x68c)
[   30.398990] c1 [<c01bd2c8>] (ubifs_iget) from [<c01b9b90>] (ubifs_lookup+0x1b4/0x258)
[   30.399005] c1 [<c01b9b90>] (ubifs_lookup) from [<c00f8134>] (lookup_real+0x30/0x4c)
[   30.399018] c1 [<c00f8134>] (lookup_real) from [<c00f8e68>] (__lookup_hash+0x34/0x3c)
[   30.399029] c1 [<c00f8e68>] (__lookup_hash) from [<c00f8f5c>] (walk_component+0xec/0x2a0)
[   30.399041] c1 [<c00f8f5c>] (walk_component) from [<c00fa600>] (path_lookupat+0x80/0xfc)
[   30.399053] c1 [<c00fa600>] (path_lookupat) from [<c00fd358>] (filename_lookup+0x5c/0xfc)
[   30.399068] c1 [<c00fd358>] (filename_lookup) from [<c00f4140>] (vfs_fstatat+0x4c/0x9c)
[   30.399082] c1 [<c00f4140>] (vfs_fstatat) from [<c00f4724>] (SyS_stat64+0x14/0x30)
[   30.399099] c1 [<c00f4724>] (SyS_stat64) from [<c000f8c0>] (ret_fast_syscall+0x0/0x34)
----------------------------------kernel log----------------------------------

---------------------zbranch passed to ubifs_tnc_read_node----------------
crash_arm> ubifs_zbranch c68cfd48
struct ubifs_zbranch {
  key = {
    u8 = "\203\003\000\000\000\000\000",
    u32 = {899, 0},
    u64 = {899},
    j32 = {899, 0}
  },
  {
    znode = 0x0,
    leaf = 0x0
  },
  lnum = 54, //DATAHD
  offs = 210744,
  len = 160
}
----------------------------zbranch found in TNC--------------------------
crash_arm> ubifs_zbranch  0xc8ef9230
struct ubifs_zbranch {
  key = {
    u8 = "\203\003\000\000\000\000\000",
    u32 = {899, 0},
    u64 = {899},
    j32 = {899, 0}
  },
  {
    znode = 0x0,
    leaf = 0x0
  },
  lnum = 224, //GCHD
  offs = 226240,
  len = 160
}

crash_arm> ubifs_jhead.wbuf.lnum 0xc901b000
  wbuf.lnum = 224, //GCHD
crash_arm> ubifs_jhead.wbuf.lnum 0xc901b0a0
  wbuf.lnum = 53,//BASEHD
crash_arm> ubifs_jhead.wbuf.lnum 0xc901b140
  wbuf.lnum = 54, //DATAHD

---------------------------------gced_lnum---------------------------------
crash_arm> ubifs_info.gced_lnum 0xc90ea000
  gced_lnum = 54

----------------------------------kernel log----------------------------------
[   29.979799] c1 UBIFS error (ubi0:23 pid 887): ubifs_read_node_wbuf: bad node type (3 but expected 1)
[   29.991550] c0 UBIFS error (ubi0:23 pid 887): ubifs_read_node_wbuf: wxf read times error:
wbuf=cd00b140,buf=d4a69000, wbuf->buf=c9198000,offs=250888, len=103, rlen=0
[   30.022582] c0 UBIFS error (ubi0:23 pid 887): ubifs_read_node_wbuf: wxf bad node at LEB 272:250888
[   30.033056] c0 Not a node, first 24 bytes:
[   30.036644] c0 00000000: 40 19 2a 00 00 81 20 01 02 00 60 23 50 1c 70 09 01 00 00 14 03 b9 00 14
[   30.052581] c0 Kernel panic - not syncing: ch address is d4a69000
[   30.063283] c0 CPU: 0 PID: 887 Comm: Binder_2 Tainted: G           O    4.4.83 #1
[   30.063295] c0 Hardware name: Generic DT based system
[   30.063330] c0 [<c001624c>] (unwind_backtrace) from [<c0012f8c>] (show_stack+0x10/0x14)
[   30.063347] c0 [<c0012f8c>] (show_stack) from [<c0287188>] (dump_stack+0x80/0xa0)
[   30.063363] c0 [<c0287188>] (dump_stack) from [<c00acff0>] (panic+0x70/0x1e4)
[   30.063382] c0 [<c00acff0>] (panic) from [<c01e3274>] (ubifs_dump_node+0x6c/0x9a0)
[   30.063399] c0 [<c01e3274>] (ubifs_dump_node) from [<c01c3200>] (ubifs_read_node_wbuf+0x350/0x384)
[   30.063412] c0 [<c01c3200>] (ubifs_read_node_wbuf) from [<c01e0d28>] (ubifs_tnc_read_node+0x54/0x214)
[   30.063426] c0 [<c01e0d28>] (ubifs_tnc_read_node) from [<c01c65ac>] (ubifs_tnc_locate+0x118/0x1b4)
[   30.063440] c0 [<c01c65ac>] (ubifs_tnc_locate) from [<c01b8170>] (do_readpage+0x1e0/0x494)
[   30.063452] c0 [<c01b8170>] (do_readpage) from [<c01b9838>] (ubifs_readpage+0x414/0x464)
[   30.063466] c0 [<c01b9838>] (ubifs_readpage) from [<c00afe74>] (generic_file_read_iter+0x33c/0x604)
[   30.063483] c0 [<c00afe74>] (generic_file_read_iter) from [<c00eff88>] (__vfs_read+0xa4/0xcc)
[   30.063496] c0 [<c00eff88>] (__vfs_read) from [<c00f05cc>] (vfs_read+0x84/0x134)
[   30.063507] c0 [<c00f05cc>] (vfs_read) from [<c00f0ed4>] (SyS_pread64+0x54/0x88)
[   30.063522] c0 [<c00f0ed4>] (SyS_pread64) from [<c000f8c0>] (ret_fast_syscall+0x0/0x34
----------------------------------kernel log----------------------------------

---------------------zbranch passed to ubifs_tnc_read_node----------------
struct ubifs_zbranch {
  key = {
    u8 = "-\002\000\000\004\000\000 ",
    u32 = {557, 536870916},
    u64 = {2305843026393563693},
    j32 = {557, 536870916}
  },
  {
    znode = 0x0,
    leaf = 0x0
  },
  lnum = 272, //2 DATAHD
  offs = 250888,
  len = 103
}
----------------------------zbranch found in TNC--------------------------
crash_arm> ubifs_zbranch 0xc646a1A8
struct ubifs_zbranch {
  key = {
    u8 = "-\002\000\000\004\000\000 ",
    u32 = {557, 536870916},
    u64 = {2305843026393563693},
    j32 = {557, 536870916}
  },
  {
    znode = 0x0,
    leaf = 0x0
  },
  lnum = 265,  //0 GCHD
  offs = 164872,
  len = 103
}

crash_arm> ubifs_jhead.wbuf.lnum 0xcd00b000
  wbuf.lnum = 265, //0 GCHD
crash_arm> ubifs_jhead.wbuf.lnum 0xcd00b0a0
  wbuf.lnum = 686,//1 BASEHD
crash_arm> ubifs_jhead.wbuf.lnum 0xcd00b140
  wbuf.lnum = 272, //2 DATAHD

---------------------------------gced_lnum---------------------------------
crash_arm> ubifs_info.gced_lnum 0xc90ea000
  gced_lnum = 272,

Thanks,
Carson
________________________________
 This email (including its attachments) is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. Unauthorized use, dissemination, distribution or copying of this email or the information herein or taking any action in reliance on the contents of this email or the information herein, by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is strictly prohibited. If you are not the intended recipient, please do not read, copy, use or disclose any part of this e-mail to others. Please notify the sender immediately and permanently delete this e-mail and any attachments if you received it in error. Internet communications cannot be guaranteed to be timely, secure, error-free or virus-free. The sender does not accept liability for any errors or omissions.
本邮件及其附件具有保密性质，受法律保护不得泄露，仅发送给本邮件所指特定收件人。严禁非经授权使用、宣传、发布或复制本邮件或其内容。若非该特定收件人，请勿阅读、复制、 使用或披露本邮件的任何内容。若误收本邮件，请从系统中永久性删除本邮件及所有附件，并以回复邮件的方式即刻告知发件人。无法保证互联网通信及时、安全、无误或防毒。发件人对任何错漏均不承担责任。
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/