[BUG] UBIFS corruption on powerpc 32-bit targets
Tomas Alvarez Vanoli
tomas.alvarez-vanoli at hitachienergy.com
Thu Jan 29 02:30:26 PST 2026
Hello,
I am writing beacuse we are experiencing ubifs corruption on our powerpc boards
after updating from 6.1 to 6.12.57.
I haven't pulled the latest UBIFS or UBI code, I looked around the changes some
weeks ago and did not find something that seemed relevant.
We have a variety of architectures running practically the same application
(w.r.t. file/db writing), and have only experienced this in the powerpc boards,
namely one using the layerscape t1040 in 32-bit mode and another one using
MPC8360.
Corruption appears only with the newer kernel, same compiler and libraries as
older one.
We've ran integck and fsstress for long periods of time in various boards but we
have not been able to reproduce it, it happens with some automated tests on our
test lab, after some hours of running tests (not stress tests). The application
uses c++'s filesystem library.
We have an ubi device (nand flash) holding mostly read-only volumes with kernels
and rootfses, one rw volume for configurations (ubifs) and one for storing
coredumps (jffs2).
We don't have any patches on the mtd layer except reverting this
aeeec092e57e6e4a9f7bcc18f71d9e17e9146bce, because we do have mtdblock on top of
ubi for the read-only squashfs and no chance to change that due to
retrocompatibility.
The only way to recover it is to remove the ubi volume and create it again.
This is the output of mtdinfo -a (mtd-utils version 2.1.6) for the volumes on
the nand:
```
Count of MTD devices: 19
Present MTD devices: mtd0, mtd1, mtd2, mtd3, mtd4, mtd5, mtd6, mtd7,mtd8, mtd9, mtd10, mtd11, mtd12, mtd13, mtd14, mtd15, mtd16, mtd17, mtd18
Sysfs interface supported: yes
...
stuff on ubi0
...
mtd10
Name: ubi1
Type: nand
Eraseblock size: 131072 bytes, 128.0 KiB
Amount of eraseblocks: 4096 (536870912 bytes, 512.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
OOB size: 128 bytes
Character device major/minor: 90:20
Bad blocks are allowed: true
Device is writable: true
mtd11
Name: bootfs0
Type: ubi
Eraseblock size: 130944 bytes, 127.8 KiB
Amount of eraseblocks: 40 (5237760 bytes, 4.9 MiB)
Minimum input/output unit size: 1 byte
Sub-page size: 1 byte
Character device major/minor: 90:22
Bad blocks are allowed: false
Device is writable: true
mtd12
Name: rootfs0
Type: ubi
Eraseblock size: 130944 bytes, 127.8 KiB
Amount of eraseblocks: 47 (6154368 bytes, 5.8 MiB)
Minimum input/output unit size: 1 byte
Sub-page size: 1 byte
Character device major/minor: 90:24
Bad blocks are allowed: false
Device is writable: true
mtd13
Name: cfg
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 1058 (134340608 bytes, 128.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:26
Bad blocks are allowed: false
Device is writable: true
mtd14
Name: coredump
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 42 (5332992 bytes, 5.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:28
Bad blocks are allowed: false
Device is writable: true
mtd15
Name: bootfs1
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 84 (10665984 bytes, 10.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:30
Bad blocks are allowed: false
Device is writable: true
mtd16
Name: rootfs1
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 325 (41267200 bytes, 39.3 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:32
Bad blocks are allowed: false
Device is writable: true
mtd17
Name: bootfs2
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 84 (10665984 bytes, 10.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:34
Bad blocks are allowed: false
Device is writable: true
mtd18
Name: rootfs2
Type: ubi
Eraseblock size: 126976 bytes, 124.0 KiB
Amount of eraseblocks: 325 (41267200 bytes, 39.3 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
Character device major/minor: 90:36
Bad blocks are allowed: false
Device is writable: true
```
The error we are seeing is:
```
root at kmcent2:~# find /cfg/ -name *tar.gz
UBIFS error (ubi1:0 pid 134): ubifs_iget: failed to read inode 3917759, error -2
UBIFS error (ubi1:0 pid 134): ubifs_lookup: dead directory entry 'ne_config.xml.gz', error -2
UBIFS warning (ubi1:0 pid 134): ubifs_ro_mode: switched to read-only mode, error -2
find: /cfg/board/cfg/mob/backup/ne/ne_config.xml.gz: No such fiCPU: 1 UID: 0 PID: 134 Comm: find Not tainted 6.12.57-00435-gf9e139970f1f #0
Hardware name: keymile,kmcent2 e5500 0x80241021 CoreNet Generic
Call Trace:
[c2cabba0] [c0bbf558] dump_stack_lvl+0xfc/0x120 (unreliable)
[c2cabbc0] [c041c8e4] ubifs_lookup+0x378/0x394
[c2cabc20] [c02f100c] __lookup_slow+0xb0/0x1c0
[c2cabc60] [c02f60d4] walk_component+0x158/0x24c
[c2cabc90] [c02f7078] path_lookupat+0xa4/0x238
[c2cabcc0] [c02f77b8] filename_lookup+0xcc/0x200
[c2cabd90] [c02e7b08] vfs_statx+0xa0/0x150
[c2cabdd0] [c02e858c] do_statx+0x84/0xe4
[c2cabec0] [c02e87cc] sys_statx+0x8c/0x120
[c2cabef0] [c00127bc] system_call_exception+0x9c/0x1e0
[c2cabf10] [c00170e8] ret_from_syscall+0x0/0x28
--- interrupt: c00 at 0xfe37b04
NIP: 0fe37b04 LR: 0fe37ad0 CTR: 00000000
REGS: c2cabf20 TRAP: 0c00 Not tainted (6.12.57-00435-gf9e139970f1f)
MSR: 0002d002 <CE,EE,PR,ME> CR: 24008483 XER: 20000000
GPR00: 0000017f bfe51f30 b7e51800 ffffff9c 100dc360 00000900 000007ff bfe51f38
GPR08: 00000001 00000008 00008ffa c2cabf10 24004884 100c365a 00000000 10144bf0
GPR16: 10140000 00000000 1015c110 00000000 10140000 100042d0 b7e7ebe8 100c0000
GPR24: 00000000 00000000 100c0000 100dc360 b7e2e010 100dc360 0ff2afa8 bfe520c8
NIP [0fe37b04] 0xfe37b04
LR [0fe37ad0] 0xfe37ad0
--- interrupt: c00
le or directory
```
I wanted to pick the lists' brain to figure out what else to try to debug or try
to reproduce this more reliably, or if there's any relevant changes that you
recall that could be causing this issue.
I would also like to know how to go about dumping and flashing this into another
board or to investigating it in my own pc.
I tried dumping with mtd_debug and nanddump and then writing it to another board
but I get ECC errors, surely I am doing something wrong.
Thanks and best regards,
Tomas Alvarez Vanoli
More information about the linux-mtd
mailing list