Kernel panic during ubifs recovery on AM335x

Hi everybody,

I have run into some problems with a kernel panic when mounting a ubifs volume.
Have tried most tips and tricks suggested on related issues but so far nothing
has made any difference. 

The first mount after ubiformat and ubimkvol is always fine. Clean mounts
without recovery also works fine. The panic occurs when the mounted file system
performs recovery, after making a sudden system reset. 

It does not matter if I use mkfs.ubifs and ubinize to make an image and flashing
it using ubiformat or U-boot. In fact, all the valid configurations I have tried
have resulted in the same crash, at the same function in the code
(ubifs_tnc_remove_nm). Have searched lists and internet but not found anything.
Would be very grateful for any hints to what might be wrong.

Here is what I do:

$ ubiformat /dev/mtd8 -s 2048 -O 2048
$ ubiattach /dev/ubi_ctrl -m 8 -O 2048
$ ubimkvol /dev/ubi0 -N testfs -s 51MiB
$ mount -t ubifs ubi0:testfs /media/testfs
- write file to volume
- Reset board (power cut)
- after reboot:
$ ubiattach /dev/ubi_ctrl -m 8 -O 2048
$ mount -t ubifs ubi0:testfs /media/testfs
---->crash----> See dump below

I have also tried the same sequence with all params set to default,
but same panic.

I have run mtd tests on the NAND. All tests look good except for the OOB test
that fails. Read a post saying this should not affect ubifs.

I have also enabled self-checks but got no extra info.

System:
TI am335x CPU
Linux kernel 3.12.0
UBI/UBIFS version is two week old snapshot from public git
mdt-utils compiled from latest snapshot
Flash is 4 Gb Micron NAND MT29F4G08ABADAH4

mtdinfo on NAND partition:

Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          512 (67108864 bytes, 64.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  512 bytes
OOB size:                       64 bytes
Character device major/minor:   90:16
Bad blocks are allowed:         true
Device is writable:             true

Dumps from attach and mount after power loss (removed time stamps):

root <at> wgp:~$ ubiattach /dev/ubi_ctrl -m 8 -O 2048
UBI: default fastmap pool size: 25
UBI: default fastmap WL pool size: 25
UBI: attaching mtd8 to ubi0
UBI: scanning is finished
UBI: attached mtd8 (name "Firmware Upgrade", size 64 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 512
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 512, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 11/7, WL threshold: 4096, image sequence number: 185658281
UBI: available PEBs: 4, total reserved PEBs: 508, PEBs reserved for bad PEB handling: 80
UBI: background thread "ubi_bgt0d" started, PID 219
UBI device number 0, total 512 LEBs (65011712 bytes, 62.0 MiB), available 4 LEBs (507904 bytes, 496.0 KiB),
LEB size 126976 bytes (124.0 KiB)

root <at> wgp:~$ mount -t ubifs ubi0:testfs /media/testfs
UBI: background thread "ubi_bgt0d" started, PID 219
UBIFS: background thread "ubifs_bgt0_0" started, PID 222
UBIFS: recovery needed
Unable to handle kernel NULL pointer dereference at virtual address 00000005
pgd = cf588000
[00000005] *pgd=8f55f831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
Modules linked in:
CPU: 0 PID: 220 Comm: mount Not tainted 3.12.0 #26
task: cf5082c0 ti: cf5ec000 task.ti: cf5ec000
PC is at ubifs_tnc_remove_nm+0x13c/0x1b4
LR is at fallible_resolve_collision+0x234/0x3b0
pc : [<c02035c8>]    lr : [<c0200990>]    psr: 20000013
sp : cf5edcd0  ip : 00000000  fp : cf59ab3c
r10: 0000000b  r9 : 00000000  r8 : cf59a320
r7 : cf5edd58  r6 : cf59baa0  r5 : 00000001  r4 : cf59a000
r3 : 00000000  r2 : cf59a000  r1 : 00000001  r0 : c0774f30
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: 8f588019  DAC: 00000015
Process mount (pid: 220, stack limit = 0xcf5ec248)
Stack: (0xcf5edcd0 to 0xcf5ee000)
dcc0:                                     cf5edd58 00000000 cf59a000 00000001
dce0: 3e06a71e 00000007 00000004 cf4ef49c 00000800 cf53a800 00000002 c020588c
dd00: cf59a320 cf59baa0 cf5edd28 cf5ec000 cf59a320 cf59a000 cf59baa0 00000000

------ cut some of the stack dump here --------

dfc0: 00000000 beabcba8 b6fa74d0 00000015 00000000 00000000 00000000 00000000
dfe0: b6f179f0 beabcaa8 00045348 b6f17a00 60000010 beabcea5 00000992 00000aaa
[<c02035c8>] (ubifs_tnc_remove_nm+0x13c/0x1b4) from [<c02038c4>] (ubifs_tnc_add_nm+0x284/0x2d4)
[<c02038c4>] (ubifs_tnc_add_nm+0x284/0x2d4) from [<c0206938>] (ubifs_replay_journal+0xe08/0x1458)
[<c0206938>] (ubifs_replay_journal+0xe08/0x1458) from [<c01faf00>] (ubifs_mount+0x1130/0x1da0)
[<c01faf00>] (ubifs_mount+0x1130/0x1da0) from [<c00f3bb4>] (mount_fs+0x70/0x164)
[<c00f3bb4>] (mount_fs+0x70/0x164) from [<c010a058>] (vfs_kern_mount+0x4c/0xc0)
[<c010a058>] (vfs_kern_mount+0x4c/0xc0) from [<c010c290>] (do_mount+0x74c/0x894)
[<c010c290>] (do_mount+0x74c/0x894) from [<c010c45c>] (SyS_mount+0x84/0xb8)
[<c010c45c>] (SyS_mount+0x84/0xb8) from [<c000e860>] (ret_fast_syscall+0x0/0x30)
Code: e3550000 ba000017 0a000012 e59d100c (e5913004) 
---[ end trace 1be26c899cefce6a ]---

Regards,
Jonas