Bug 218934

Reproducer:
CONFIG_MTD_NAND_NANDSIM=m
CONFIG_MTD_UBI=m
CONFIG_UBIFS_FS=m

1. Apply diff and compile kernel
2. ./b.sh 1
[   41.879932] UBIFS (ubi0:0): default file-system created
[   41.880024] UBIFS (ubi0:0): Mounting in unauthenticated mode
[   41.880923] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 1668
[   41.881531] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "vol_a"
[   41.881555] UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   41.881563] UBIFS (ubi0:0): FS size: 125325312 bytes (119 MiB, 987 LEBs), max 998 LEBs, journal size 6221824 bytes (5 MiB, 49 LEBs)
[   41.881571] UBIFS (ubi0:0): reserved for root: 4952683 bytes (4836 KiB)
[   41.881578] UBIFS (ubi0:0): media format: w5/r0 (latest is w5/r0), UUID 91D708E0-6484-489A-AAE4-7A3B8D0BF5F2, small LPT model
[   41.881634] UBIFS (ubi0:0): full atime support is enabled.
[   41.895244] commit done
[   41.895689] UBIFS (ubi0:0): un-mount UBI device 0
[   41.895726] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" stops
[   41.900357] UBIFS (ubi0:0): Mounting in unauthenticated mode
[   41.900535] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 1674
[   41.901696] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "vol_a"
[   41.901704] UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   41.901709] UBIFS (ubi0:0): FS size: 125325312 bytes (119 MiB, 987 LEBs), max 998 LEBs, journal size 6221824 bytes (5 MiB, 49 LEBs)
[   41.901714] UBIFS (ubi0:0): reserved for root: 4952683 bytes (4836 KiB)
[   41.901717] UBIFS (ubi0:0): media format: w5/r0 (latest is w5/r0), UUID 91D708E0-6484-489A-AAE4-7A3B8D0BF5F2, small LPT model
[   41.901744] UBIFS (ubi0:0): full atime support is enabled.
[   41.911144] commit wait writepage
[   43.914701] 4096 0 3
[   43.915459] Please dump image
[   43.995378] commit done
[   44.923132] Please dump image
[   45.947093] Please dump image
[   46.971095] Please dump image
[   47.995107] Please dump image

3. dd if=/dev/mtd0 bs=1M of=disk
   sync disk
4. restart qemu  // simulate powercut
5. ./b.sh

[   21.234150] UBIFS (ubi0:0): recovery completed
[   21.234185] UBIFS error (ubi0:0 pid 1573): check_leaf [ubifs]: data node at LEB 14:2048 is not within inode size 3
[   21.236105] UBIFS (ubi0:0): dump of node at LEB 14:2048
[   21.236111]  magic          0x6101831
[   21.236823]  crc            0xa6278c6b
[   21.237517]  node_type      1 (data node)
[   21.238277]  group_type     0 (no node group)
[   21.239097]  sqnum          25
[   21.239699]  len            67
[   21.240275]  key            (65, data, 0)
[   21.240958]  size           4096
[   21.241388]  compr_typ      3
[   21.241806]  data size      19
[   21.242219]  data (length = 19):
[   21.242663]  00000000: 28 b5 2f fd 60 00 0f 4d 00 00 10 00 00 01 00 fb f7 01 16
[   21.243585] UBIFS error (ubi0:0 pid 1573): dbg_walk_index [ubifs]: leaf checking function returned error -22, for leaf at LEB 14:2048
[   21.245160] UBIFS (ubi0:0): dump of znode at LEB 11:4096
[   21.245163] znode 0000000036620ab9, LEB 11:4096 len 108 parent 0000000000000000 iip 0 level 0 child_cnt 4 flags 0
[   21.246466] zbranches:
[   21.246811]  0: LNC 0000000000000000 LEB 12:2272 len 160 key (1, inode)
[   21.247706]  1: LNC 0000000000000000 LEB 12:2048 len 61 key (1, direntry, 0x193a6b0)
[   21.248706]  2: LNC 0000000000000000 LEB 12:2432 len 160 key (65, inode)
[   21.249553]  3: LNC 0000000000000000 LEB 14:2048 len 67 key (65, data, 0)
[   21.250438] UBIFS error (ubi0:0 pid 1573): dbg_check_filesystem [ubifs]: file-system check failed with error -22