GL.iNet B1300 infinite reboot loop

I compiled the OpenWrt 22.03.0-rc4 version and installed it on my GL.iNet B1300 router.

As I mentioned in a previous post, it worked fine at the beginning, but after several hours of use, when I tried to reboot it, the router fell into a reboot loop. But everything worked fine just before the moment I reboot it.

And here's the boot log.

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00117
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000020
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      1679 - bootable_media_detect_success, Start
B -      1693 - elf_loader_entry, Start
B -      5076 - auth_hash_seg_entry, Start
B -      7223 - auth_hash_seg_exit, Start
B -    580157 - elf_segs_hash_verify_entry, Start
B -    698613 - PBL, End
B -    698637 - SBL1, Start
B -    789408 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    790935 - boot_flash_init, Start
D -     54256 - boot_flash_init, Delta
B -    849339 - boot_config_data_table_init, Start
D -      3842 - boot_config_data_table_init, Delta - (419 Bytes)
B -    856555 - clock_init, Start
D -      7553 - clock_init, Delta
B -    868607 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    872020 - sbl1_ddr_set_params, Start
B -    877118 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    881500 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13178 - sbl1_ddr_set_params, Delta
B -    895239 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    965671 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    981146 - Image Load, Start
D -    140884 - QSEE Image Loaded, Delta - (274048 Bytes)
B -   1122458 - Image Load, Start
D -      1442 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1132887 - Image Load, Start
D -    213498 - APPSBL Image Loaded, Delta - (436535 Bytes)
B -   1346783 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1353003 - SBL1, End
D -    656444 - SBL1, Delta
S - Flash Throughput, 2004 KB/s  (713050 Bytes,  355637 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Apr 13 2018 - 13:54:46)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
NAND:  SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x2000000
32 MiB
MMC:   
In:    serial
Out:   serial
Err:   serial
machid: 8010000
flash_type: 0

Net:   MAC0 addr:e4:95:6e:45:14:98
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit "gl" key to stop booting:  1 0


SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB
Checking calibration status...
Device have calibrated,checking test status...
Device haven tested, checking MAC info...
Device have MAC info, starting firmware...

eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
ping failed; host 192.168.1.2 is not alive

eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
ping failed; host 192.168.1.2 is not alive

eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
ping failed; host 192.168.1.2 is not alive

SF: Detected MX25L25635E with page size 4 KiB, total 32 MiB
## Booting kernel from FIT Image at 84000000 ...
   Using 'config@1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM OpenWrt Linux-5.10.120
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x840000e4
     Data Size:    2899952 Bytes = 2.8 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   c1b07724
     Hash algo:    sha1
     Hash value:   f1bd2176ba08196be614116f7b968acd5e7bf71d
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 84000000
   Using 'config@1' configuration
   Trying 'fdt-1' FDT blob subimage
     Description:  ARM OpenWrt glinet_gl-b1300 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x842c4210
     Data Size:    16662 Bytes = 16.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   b287b960
     Hash algo:    sha1
     Hash value:   00768dfa901be3bbef763692dee806e10bf575ea
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x842c4210
   Loading Kernel Image ... OK
OK
   Loading Device Tree to 86ff8000, end 86fff115 ... OK
ipq: fdt fixup unable to find compatible node
Using machid 0x8010000 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.10.120 (user@a047f778f500) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r19426-2b1941e47d) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Jun 10 07:20:21 2022
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: GL.iNet GL-B1300
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000080000000-0x000000008fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000080000000-0x0000000087dfffff]
[    0.000000]   node   0: [mem 0x0000000087e00000-0x0000000087ffffff]
[    0.000000]   node   0: [mem 0x0000000088000000-0x000000008fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x000000008fffffff]
[    0.000000] percpu: Embedded 15 pages/cpu s30860 r8192 d22388 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: rootfsname=rootfs rootwait
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 247188K/262144K available (6210K kernel code, 603K rwdata, 1556K rodata, 1024K init, 236K bss, 14956K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000010] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000026] Switching to timer-based delay loop, resolution 20ns
[    0.000313] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000341] pid_max: default: 32768 minimum: 301
[    0.000529] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000548] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001593] CPU: Testing write buffer coherency: ok
[    0.001984] qcom_scm: convention: smc legacy
[    0.002936] Setting up static identity map for 0x80300000 - 0x8030003c
[    0.003095] rcu: Hierarchical SRCU implementation.
[    0.003360] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.003725] smp: Bringing up secondary CPUs ...
[    0.007263] smp: Brought up 1 node, 4 CPUs
[    0.007289] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.007299] CPU: All CPU(s) started in SVC mode.
[    0.012172] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.012342] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.012369] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.012629] pinctrl core: initialized pinctrl subsystem
[    0.014454] NET: Registered protocol family 16
[    0.014806] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.015941] thermal_sys: Registered thermal governor 'step_wise'
[    0.016374] cpuidle: using governor ladder
[    0.016432] cpuidle: using governor menu
[    0.041641] cryptd: max_cpu_qlen set to 1000
[    0.045878] usbcore: registered new interface driver usbfs
[    0.045967] usbcore: registered new interface driver hub
[    0.046028] usbcore: registered new device driver usb
[    0.046082] pps_core: LinuxPPS API ver. 1 registered
[    0.046095] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.046123] PTP clock support registered
[    0.047870] clocksource: Switched to clocksource arch_sys_counter
[    0.048853] NET: Registered protocol family 2
[    0.049108] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.049795] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.049853] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.049894] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.049944] TCP: Hash tables configured (established 2048 bind 2048)
[    0.050163] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.050209] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.050502] NET: Registered protocol family 1
[    0.050550] PCI: CLS 0 bytes, default 64
[    0.052858] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.057316] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.057344] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.198937] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.198963] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.199663] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.199761] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.199852] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.199943] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.200268] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.200865] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.200909] msm_serial 78af000.serial: uartclk = 1843200
[    0.200961] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 33, base_baud = 115200) is a MSM
[    0.200989] msm_serial: console setup on port #0
[    0.736682] printk: console [ttyMSM0] enabled
[    0.741854] msm_serial: driver initialized
[    0.751208] loop: module loaded
[    0.752304] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.754835] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[    0.760575] 9 fixed-partitions partitions found on MTD device spi0.0
[    0.765405] Creating 9 MTD partitions on "spi0.0":
[    0.771940] 0x000000000000-0x000000040000 : "SBL1"
[    0.777107] 0x000000040000-0x000000060000 : "MIBIB"
[    0.781856] 0x000000060000-0x0000000c0000 : "QSEE"
[    0.786555] 0x0000000c0000-0x0000000d0000 : "CDT"
[    0.791479] 0x0000000d0000-0x0000000e0000 : "DDRPARAMS"
[    0.796298] 0x0000000e0000-0x0000000f0000 : "APPSBLENV"
[    0.801278] 0x0000000f0000-0x000000170000 : "APPSBL"
[    0.806433] 0x000000170000-0x000000180000 : "ART"
[    0.811740] 0x000000180000-0x000002000000 : "firmware"
[    0.816553] 2 fit-fw partitions found on MTD device firmware
[    0.820840] Creating 2 MTD partitions on "firmware":
[    0.826607] 0x000000000000-0x0000002d0000 : "kernel"
[    0.832067] 0x0000002c8868-0x000001e80000 : "rootfs"
[    0.836497] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.841920] mtd: device 10 (rootfs) set to be root filesystem
[    0.850807] 1 squashfs-split partitions found on MTD device rootfs
[    0.856306] 0x0000015d0000-0x000001e80000 : "rootfs_data"
[    0.901896] ESS reset ok!
[    0.976124] ESS reset ok!
[    1.733124] i2c /dev entries driver
[    1.734960] sdhci: Secure Digital Host Controller Interface driver
[    1.735428] sdhci: Copyright(c) Pierre Ossman
[    1.741765] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.750180] NET: Registered protocol family 10
[    1.753441] Segment Routing with IPv6
[    1.756176] NET: Registered protocol family 17
[    1.759933] 8021q: 802.1Q VLAN Support v1.8
[    1.764240] Registering SWP/SWPB emulation handler
[    1.791351] VFS: Mounted root (squashfs filesystem) readonly on device 31:10.
[    1.794114] Freeing unused kernel memory: 1024K
[    1.871808] Run /sbin/init as init process
[    2.832461] init: Console is alive
[    2.832847] init: - watchdog -
[    5.563940] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.672158] genirq: irq_chip msmgpio did not update eff. affinity mask of irq 100
[    5.677365] SCSI subsystem initialized
[    5.683334] dwc3-qcom 8af8800.usb3: IRQ hs_phy_irq not found
[    5.683380] dwc3-qcom 8af8800.usb3: IRQ dp_hs_phy_irq not found
[    5.688190] dwc3-qcom 8af8800.usb3: IRQ dm_hs_phy_irq not found
[    5.693736] dwc3-qcom 8af8800.usb3: IRQ ss_phy_irq not found
[    5.703654] dwc3-qcom 60f8800.usb2: IRQ hs_phy_irq not found
[    5.705546] dwc3-qcom 60f8800.usb2: IRQ dp_hs_phy_irq not found
[    5.711237] dwc3-qcom 60f8800.usb2: IRQ dm_hs_phy_irq not found
[    5.716827] dwc3-qcom 60f8800.usb2: IRQ ss_phy_irq not found
[    5.958524] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.958694] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    5.963178] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100 quirks 0x0000000002010010
[    5.970600] xhci-hcd xhci-hcd.0.auto: irq 102, io mem 0x08a00000
[    5.980835] hub 1-0:1.0: USB hub found
[    5.986181] hub 1-0:1.0: 1 port detected
[    5.990080] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.993771] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    5.999127] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    6.008145] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.013831] hub 2-0:1.0: USB hub found
[    6.021513] hub 2-0:1.0: 1 port detected
[    6.025706] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.029175] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    6.034661] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220f665 hci version 0x100 quirks 0x0000000002010010
[    6.042090] xhci-hcd xhci-hcd.1.auto: irq 103, io mem 0x06000000
[    6.052376] hub 3-0:1.0: USB hub found
[    6.057606] hub 3-0:1.0: 1 port detected
[    6.061481] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    6.065221] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    6.070560] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    6.078205] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    6.085231] hub 4-0:1.0: USB hub found
[    6.093223] hub 4-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    6.101012] usbcore: registered new interface driver usb-storage
[    6.104045] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    6.113165] init: - preinit -
[    7.504958] random: crng init done
[    8.971507] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
4
[   10.578165] mount_root: loading kmods from internal overlay
[   10.624023] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[   10.632907] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[   12.290994] jffs2: error: (187) jffs2_link_node_ref: Adding new ref 4175c5aa at (0x00156064-0x001560a8) not immediately after previous (0x00156064-0x00156064)
[   12.291077] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM
[   12.304071] Modules linked in: usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom sd_mod scsi_mod gpio_button_hotplug f2fs ext4 mbcache jbd2 crc32c_generic crc32_generic
[   12.310954] CPU: 0 PID: 187 Comm: block Not tainted 5.10.120 #0
[   12.327333] Hardware name: Generic DT based system
[   12.333249] PC is at jffs2_link_node_ref+0x138/0x234
[   12.338101] LR is at jffs2_link_node_ref+0x1a8/0x234
[   12.343219] pc : [<c04fe9b0>]    lr : [<c04fea20>]    psr: 60000013
[   12.348166] sp : c21cfd70  ip : ffffefff  fp : c0cc7d08
[   12.354153] r10: 00000148  r9 : c200f1d8  r8 : 00010000
[   12.359363] r7 : 00156064  r6 : 001560a8  r5 : c2115800  r4 : c200f1e0
[   12.364574] r3 : c0c72a80  r2 : c0c72a80  r1 : 0f231000  r0 : 00000092
[   12.371172] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   12.377682] Control: 10c5387d  Table: 8121806a  DAC: 00000051
[   12.384885] Process block (pid: 187, stack limit = 0xf99b40f2)
[   12.390615] Stack: (0xc21cfd70 to 0xc21d0000)
[   12.396345] fd60:                                     00156064 001560a8 00156064 00156064
[   12.400782] fd80: c22a57a8 c2115800 c126a444 00000044 c2041a00 00006064 00000148 c050f444
[   12.408939] fda0: c2041a00 0015cb70 c21cfdc8 c22a4000 c1f4a195 c1f65680 00001730 00003490
[   12.417101] fdc0: 00010000 c09d7a34 00000000 20061985 00003490 00000000 00000000 00003490
[   12.425260] fde0: c126a444 00000000 00000000 c22a4000 c2115800 c2242000 00001000 c0504160
[   12.433419] fe00: c0cc7d08 c21cfe6c c22a4000 00000000 000011a7 00000015 00000444 c126a000
[   12.441580] fe20: c1fb15c0 00150000 00000000 c21cfe6c 02851885 00000000 00000000 00003488
[   12.449737] fe40: 00003490 c22a4000 c21cfe00 c21ce000 ffffc000 c09d7c54 00000000 c2242000
[   12.457899] fe60: 00000000 00001000 00000e58 00003488 00000044 a0000013 c22c0000 c2115800
[   12.466058] fe80: c2115800 00000000 c2178d00 008b0000 00000000 c115fe80 00000000 c05072b4
[   12.474218] fea0: 00000000 c0455d5c c21cfeb4 c0607a48 c14010a0 00000000 c2115800 c2115c00
[   12.482377] fec0: 00010000 c2178d00 008b0000 00000000 c115fe80 c0509714 c2178d00 c2178d00
[   12.490536] fee0: c2115c00 c2178d00 c1850000 c0509a24 c115fb80 c06b9158 c2178d00 00000000
[   12.498697] ff00: c21cff78 c2178d00 c115fb80 c046a818 c115fb80 00000008 00000000 c21cff78
[   12.506857] ff20: c2178d00 00000008 00000000 c048f080 00000000 c1272000 00000000 00000002
[   12.515016] ff40: ffffff9c 00000000 c115fe80 c115fb80 00000000 c03002a4 00000000 bea35df4
[   12.523177] ff60: 00000000 c048f8ec 00000000 bea35df4 ffffff9c 00000400 c10d63d0 c1447220
[   12.531335] ff80: c10d63d0 00000000 bea35df4 00000002 00000015 c03002a4 c21ce000 00000015
[   12.539495] ffa0: 00000000 c0300040 00000000 bea35df4 bea35e04 bea35df4 00017e2e 00000400
[   12.547655] ffc0: 00000000 bea35df4 00000002 00000015 00000001 00000000 bea35eb4 00000000
[   12.555814] ffe0: 00028f18 bea35d40 0001214c b6ec9b00 60000010 bea35e04 00000000 00000000
[   12.563989] [<c04fe9b0>] (jffs2_link_node_ref) from [<c050f444>] (jffs2_sum_scan_sumnode+0x314/0x7f8)
[   12.572140] [<c050f444>] (jffs2_sum_scan_sumnode) from [<c0504160>] (jffs2_scan_medium+0xbcc/0x1840)
[   12.581338] [<c0504160>] (jffs2_scan_medium) from [<c05072b4>] (jffs2_do_mount_fs+0x188/0x764)
[   12.590539] [<c05072b4>] (jffs2_do_mount_fs) from [<c0509714>] (jffs2_do_fill_super+0xfc/0x27c)
[   12.598962] [<c0509714>] (jffs2_do_fill_super) from [<c06b9158>] (mtd_get_sb+0x84/0xac)
[   12.607555] [<c06b9158>] (mtd_get_sb) from [<c046a818>] (vfs_get_tree+0x24/0xe4)
[   12.615539] [<c046a818>] (vfs_get_tree) from [<c048f080>] (path_mount+0x6e8/0xa90)
[   12.623176] [<c048f080>] (path_mount) from [<c048f8ec>] (sys_mount+0x144/0x214)
[   12.630554] [<c048f8ec>] (sys_mount) from [<c0300040>] (ret_fast_syscall+0x0/0x54)
[   12.637751] Exception stack(0xc21cffa8 to 0xc21cfff0)
[   12.645389] ffa0:                   00000000 bea35df4 bea35e04 bea35df4 00017e2e 00000400
[   12.650520] ffc0: 00000000 bea35df4 00000002 00000015 00000001 00000000 bea35eb4 00000000
[   12.658675] ffe0: 00028f18 bea35d40 0001214c b6ec9b00
[   12.666834] Code: e5943004 e3c33003 e1530002 0affffcf (e7f001f2) 
[   12.671868] ---[ end trace f1bbbda587e15ece ]---
[   12.677940] Kernel panic - not syncing: Fatal exception
[   12.682640] CPU1: stopping
[   12.687576] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G      D           5.10.120 #0
[   12.690354] Hardware name: Generic DT based system
[   12.697917] [<c030cd78>] (unwind_backtrace) from [<c0309978>] (show_stack+0x10/0x14)
[   12.702606] [<c0309978>] (show_stack) from [<c060394c>] (dump_stack+0x94/0xa8)
[   12.710504] [<c060394c>] (dump_stack) from [<c030bb9c>] (do_handle_IPI+0xf4/0x12c)
[   12.717534] [<c030bb9c>] (do_handle_IPI) from [<c030bbec>] (ipi_handler+0x18/0x20)
[   12.725086] [<c030bbec>] (ipi_handler) from [<c036c7d8>] (__handle_domain_irq+0x84/0xd8)
[   12.732641] [<c036c7d8>] (__handle_domain_irq) from [<c061b21c>] (gic_handle_irq+0x80/0x94)
[   12.740885] [<c061b21c>] (gic_handle_irq) from [<c0300b4c>] (__irq_svc+0x6c/0x90)
[   12.748950] Exception stack(0xc1063f58 to 0xc1063fa0)
[   12.756585] 3f40:                                                       0000fb3a 00000000
[   12.761629] 3f60: 0000fb3c c0312c80 c1062000 00000001 c0c04f14 c0c04f54 00000000 00000000
[   12.769791] 3f80: 00000000 c0b45fe8 0099c117 c1063fa8 c03070bc c03070c0 60000013 ffffffff
[   12.777955] [<c0300b4c>] (__irq_svc) from [<c03070c0>] (arch_cpu_idle+0x38/0x3c)
[   12.786113] [<c03070c0>] (arch_cpu_idle) from [<c034cd90>] (do_idle+0x220/0x280)
[   12.793576] [<c034cd90>] (do_idle) from [<c034d08c>] (cpu_startup_entry+0x18/0x1c)
[   12.800952] [<c034d08c>] (cpu_startup_entry) from [<8030156c>] (0x8030156c)
[   12.808327] CPU3: stopping
[   12.815178] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G      D           5.10.120 #0
[   12.817957] Hardware name: Generic DT based system
[   12.825519] [<c030cd78>] (unwind_backtrace) from [<c0309978>] (show_stack+0x10/0x14)
[   12.830208] [<c0309978>] (show_stack) from [<c060394c>] (dump_stack+0x94/0xa8)
[   12.838104] [<c060394c>] (dump_stack) from [<c030bb9c>] (do_handle_IPI+0xf4/0x12c)
[   12.845135] [<c030bb9c>] (do_handle_IPI) from [<c030bbec>] (ipi_handler+0x18/0x20)
[   12.852689] [<c030bbec>] (ipi_handler) from [<c036c7d8>] (__handle_domain_irq+0x84/0xd8)
[   12.860240] [<c036c7d8>] (__handle_domain_irq) from [<c061b21c>] (gic_handle_irq+0x80/0x94)
[   12.868487] [<c061b21c>] (gic_handle_irq) from [<c0300b4c>] (__irq_svc+0x6c/0x90)
[   12.876554] Exception stack(0xc1067f58 to 0xc1067fa0)
[   12.884189] 7f40:                                                       0000d98e 00000000
[   12.889236] 7f60: 0000d990 c0312c80 c1066000 00000003 c0c04f14 c0c04f54 00000000 00000000
[   12.897394] 7f80: 00000000 c0b45fe8 0174fc24 c1067fa8 c03070bc c03070c0 60000013 ffffffff
[   12.905554] [<c0300b4c>] (__irq_svc) from [<c03070c0>] (arch_cpu_idle+0x38/0x3c)
[   12.913712] [<c03070c0>] (arch_cpu_idle) from [<c034cd90>] (do_idle+0x220/0x280)
[   12.921178] [<c034cd90>] (do_idle) from [<c034d08c>] (cpu_startup_entry+0x18/0x1c)
[   12.928554] [<c034d08c>] (cpu_startup_entry) from [<8030156c>] (0x8030156c)
[   12.935930] CPU2: stopping
[   12.942782] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G      D           5.10.120 #0
[   12.945563] Hardware name: Generic DT based system
[   12.953121] [<c030cd78>] (unwind_backtrace) from [<c0309978>] (show_stack+0x10/0x14)
[   12.957811] [<c0309978>] (show_stack) from [<c060394c>] (dump_stack+0x94/0xa8)
[   12.965709] [<c060394c>] (dump_stack) from [<c030bb9c>] (do_handle_IPI+0xf4/0x12c)
[   12.972740] [<c030bb9c>] (do_handle_IPI) from [<c030bbec>] (ipi_handler+0x18/0x20)
[   12.980292] [<c030bbec>] (ipi_handler) from [<c036c7d8>] (__handle_domain_irq+0x84/0xd8)
[   12.987846] [<c036c7d8>] (__handle_domain_irq) from [<c061b21c>] (gic_handle_irq+0x80/0x94)
[   12.996092] [<c061b21c>] (gic_handle_irq) from [<c0300b4c>] (__irq_svc+0x6c/0x90)
[   13.004155] Exception stack(0xc1065f58 to 0xc1065fa0)
[   13.011793] 5f40:                                                       00018ce2 00000000
[   13.016839] 5f60: 00018ce4 c0312c80 c1064000 00000002 c0c04f14 c0c04f54 00000000 00000000
[   13.024999] 5f80: 00000000 c0b45fe8 004fda77 c1065fa8 c03070bc c03070c0 60000013 ffffffff
[   13.033160] [<c0300b4c>] (__irq_svc) from [<c03070c0>] (arch_cpu_idle+0x38/0x3c)
[   13.041316] [<c03070c0>] (arch_cpu_idle) from [<c034cd90>] (do_idle+0x220/0x280)
[   13.048781] [<c034cd90>] (do_idle) from [<c034d08c>] (cpu_startup_entry+0x18/0x1c)
[   13.056160] [<c034d08c>] (cpu_startup_entry) from [<8030156c>] (0x8030156c)
[   13.063541] Rebooting in 1 seconds..

So, any idea what went wrong?

"Undefined instruction"

Pure guess, but it might a faulty driver code jumping to a location that contains a variable/garbage and not a valid CPU instruction.

Could an oversize firmware cause this? My device has a 32 MB flash. I compiled some packages into my firmware and its size is about 23 MB.

One of the packages I built in the firmware is a VPN client. It will download a GeoIP database which takes several MB of the space...

Possible, but doesn't look like that at the first glance.

However, the error is right after an jffs2 line with error, so there might be something wrong with the flash. Possibly a bad block just at a wrong place of flash?

You might test with a more minimal image, and maybe start with the official release image instead of your own image.

Update:

I captured the kernel log of the last normal operation of my router (with my custom firmware, I will test with the official image later). After this I rebooted my router and it fell into an infinite reboot loop.

There are two abnormal things.

The first one:

[   14.688480] jffs2: notice: (188) jffs2_build_xattr_subsystem: complete building xattr subsystem, 104 of xdatum (96 unchecked, 8 orphan) and 126 of xref (12 dead, 1 orphan) found.
[   14.690251] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[   14.729582] block: extroot: not configured
[   14.894124] jffs2: notice: (186) jffs2_build_xattr_subsystem: complete building xattr subsystem, 104 of xdatum (96 unchecked, 8 orphan) and 126 of xref (12 dead, 1 orphan) found.

The numbers of xdatum and ref increase every time I reboot my router. It is said that this is normal. But getting two same jffs2 notice is an issue.

And the second one, which may directly broke the kernel:

[ 1663.183633] spi-nor spi0.0: SPI transfer failed: -110
[ 1663.183723] spi_master spi0: failed to transfer one message from queue
[ 1663.187760] blk_update_request: I/O error, dev mtdblock10, sector 20680 op 0x0:(READ) flags 0x800 phys_seg 17 prio class 0
[ 1664.223967] spi-nor spi0.0: SPI transfer failed: -110
[ 1664.224040] spi_master spi0: failed to transfer one message from queue
[ 1664.228065] blk_update_request: I/O error, dev mtdblock10, sector 20688 op 0x0:(READ) flags 0x800 phys_seg 16 prio class 0
[ 1665.264403] spi-nor spi0.0: SPI transfer failed: -110
[ 1665.264938] spi_master spi0: failed to transfer one message from queue
[ 1665.268813] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1665.275547] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1666.303485] spi-nor spi0.0: SPI transfer failed: -110
[ 1666.303562] spi_master spi0: failed to transfer one message from queue
[ 1666.307552] blk_update_request: I/O error, dev mtdblock10, sector 20696 op 0x0:(READ) flags 0x800 phys_seg 15 prio class 0
[ 1667.344129] spi-nor spi0.0: SPI transfer failed: -110
[ 1667.344590] spi_master spi0: failed to transfer one message from queue
[ 1667.348530] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1667.354852] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1668.383583] spi-nor spi0.0: SPI transfer failed: -110
[ 1668.383722] spi_master spi0: failed to transfer one message from queue
[ 1668.387723] blk_update_request: I/O error, dev mtdblock10, sector 20704 op 0x0:(READ) flags 0x800 phys_seg 14 prio class 0
[ 1669.424274] spi-nor spi0.0: SPI transfer failed: -110
[ 1669.424732] spi_master spi0: failed to transfer one message from queue
[ 1669.428772] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1669.435417] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1670.464195] spi-nor spi0.0: SPI transfer failed: -110
[ 1670.464666] spi_master spi0: failed to transfer one message from queue
[ 1670.468677] jffs2: Error reading node from 0x0044bb94: -110
[ 1671.504080] spi-nor spi0.0: SPI transfer failed: -110
[ 1671.504562] spi_master spi0: failed to transfer one message from queue
[ 1671.508557] blk_update_request: I/O error, dev mtdblock10, sector 20712 op 0x0:(READ) flags 0x800 phys_seg 13 prio class 0
[ 1672.544533] spi-nor spi0.0: SPI transfer failed: -110
[ 1672.545000] spi_master spi0: failed to transfer one message from queue
[ 1672.548945] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1672.555664] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1673.584081] spi-nor spi0.0: SPI transfer failed: -110
[ 1673.584682] spi_master spi0: failed to transfer one message from queue
[ 1673.588547] jffs2: Error reading node from 0x0044bb94: -110
[ 1674.623986] spi-nor spi0.0: SPI transfer failed: -110
[ 1674.624462] spi_master spi0: failed to transfer one message from queue
[ 1674.628288] blk_update_request: I/O error, dev mtdblock10, sector 20720 op 0x0:(READ) flags 0x800 phys_seg 12 prio class 0
[ 1675.663455] spi-nor spi0.0: SPI transfer failed: -110
[ 1675.663608] spi_master spi0: failed to transfer one message from queue
[ 1675.667583] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1675.674053] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1676.704111] spi-nor spi0.0: SPI transfer failed: -110
[ 1676.704651] spi_master spi0: failed to transfer one message from queue
[ 1676.708503] jffs2: Error reading node from 0x0044bb94: -110
[ 1677.744171] spi-nor spi0.0: SPI transfer failed: -110
[ 1677.744709] spi_master spi0: failed to transfer one message from queue
[ 1677.748654] blk_update_request: I/O error, dev mtdblock10, sector 20728 op 0x0:(READ) flags 0x800 phys_seg 11 prio class 0
[ 1678.783913] spi-nor spi0.0: SPI transfer failed: -110
[ 1678.784452] spi_master spi0: failed to transfer one message from queue
[ 1678.788349] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1678.795082] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1679.824417] spi-nor spi0.0: SPI transfer failed: -110
[ 1679.824577] spi_master spi0: failed to transfer one message from queue
[ 1679.828536] jffs2: Error reading node from 0x0044bb94: -110
[ 1680.863335] spi-nor spi0.0: SPI transfer failed: -110
[ 1680.863489] spi_master spi0: failed to transfer one message from queue
[ 1680.867474] blk_update_request: I/O error, dev mtdblock10, sector 20736 op 0x0:(READ) flags 0x800 phys_seg 10 prio class 0
[ 1681.904426] spi-nor spi0.0: SPI transfer failed: -110
[ 1681.904966] spi_master spi0: failed to transfer one message from queue
[ 1681.908880] jffs2: Write of 68 bytes at 0x00411b68 failed. returned -110, retlen 0
[ 1681.915503] jffs2: Not marking the space at 0x00411b68 as dirty because the flash driver returned retlen zero
[ 1682.943804] spi-nor spi0.0: SPI transfer failed: -110
[ 1682.944094] spi_master spi0: failed to transfer one message from queue
[ 1682.948077] jffs2: Error reading node from 0x0044bb94: -110
[ 1682.989650] SQUASHFS error: Failed to read block 0xa0fb96: -5
[ 1682.989716] SQUASHFS error: Unable to read data cache entry [a0fb96]
[ 1682.994541] SQUASHFS error: Unable to read page, block a0fb96, size 19fec
[ 1683.000934] SQUASHFS error: Unable to read data cache entry [a0fb96]
[ 1683.007776] SQUASHFS error: Unable to read page, block a0fb96, size 19fec
[ 1683.014159] SQUASHFS error: Unable to read data cache entry [a0fb96]
[ 1683.020627] SQUASHFS error: Unable to read page, block a0fb96, size 19fec
[ 1683.027159] SQUASHFS error: Unable to read data cache entry [a0fb96]
[ 1683.033811] SQUASHFS error: Unable to read page, block a0fb96, size 19fec
[ 1683.040249] SQUASHFS error: Unable to read data cache entry [a0fb96]
[ 1683.047028] SQUASHFS error: Unable to read page, block a0fb96, size 19fec

Does this mean I have a bad block in my flash?