Re: ubifs: read bad node type in ubifs_tnc_read_wbuf

From: Richard Weinberger <richard@nod.at>
To: "李傲傲 (Carson Li1/9542)" <Carson.Li1@unisoc.com>
Cc: linux-mtd <linux-mtd@lists.infradead.org>
Subject: Re: ubifs: read bad node type in ubifs_tnc_read_wbuf
Date: Mon, 13 Jan 2020 00:48:55 +0100 (CET)	[thread overview]
Message-ID: <733427970.19532.1578872935782.JavaMail.zimbra@nod.at> (raw)
In-Reply-To: <46e2f6ca11a442f38d476d4346e8034c@shmbx04.spreadtrum.com>

----- Ursprüngliche Mail -----
> Von: "李傲傲 (Carson Li1/9542)" <Carson.Li1@unisoc.com>
> An: "linux-mtd" <linux-mtd@lists.infradead.org>, "richard" <richard@nod.at>
> Gesendet: Freitag, 10. Januar 2020 08:46:38
> Betreff: FW: ubifs: read bad node type in ubifs_tnc_read_wbuf

> Hi mtd-list:

> I have a problem recently on ubifs: kernel reports to read a bad node type in

> ubifs_tnc_read_wbuf.

> I guess th e problem occurs because of tnc_mutex is freed in ubifs_tnc_locate.

> Though it marks the journal heads will not be GCed. But if there is a commit
> just

> finished, LEBs in journal heads will not be in bud rbtree anymore. And it might

> be GCed. Here is the kernel log:

> ------------------------------------------------kernel log
> ----------------------------------------------

> [ 30.072901] c0 UBIFS error (ubi0:23 pid 944): ubifs_read_node_wbuf: bad node
> type (232 but expected 0)

> [ 30.085890] c1 UBIFS error (ubi0:23 pid 944): ubifs_read_node_wbuf:
> wbuf=cd008f40,buf=d4cd9000,

> wbuf->buf=c90ec000,offs=164320, len=160, rlen=0

Do you have a test/reproducer for this issue?

Also see:
commit 601c0bc46753007be011b513ba4fc50ed8e30aef
Author: Adrian Hunter <ext-adrian.hunter@nokia.com>
Date:   Fri Aug 22 14:23:35 2008 +0300

    UBIFS: allow for racing between GC and TNC

    The TNC mutex is unlocked prematurely when reading leaf nodes
    with non-hashed keys.  This is unsafe because the node may be
    moved by garbage collection and the eraseblock unmapped, although
    that has never actually happened during stress testing.

    This patch fixes the flaw by detecting the race and retrying with
    the TNC mutex locked.

    Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>

It really looks like a journal is being garbage collected. Hmm.

Thanks,
//richard

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/