Hi, This crash can be triggered by repeatedly performing specific file operations, causing a kernel warning in the Ext4 multi-block allocator (mballoc) module. The issue arises in mb_avg_fragment_size_order due to an invalid len parameter leading to an out-of-bound order, thus triggering the WARNING. Root Cause: 1. Code Path: In ext4_mb_choose_next_group_best_avail(), ac_g_ex.fe_len might be incorrectly calculated as an excessively large value (e.g., via roundup). 2. Invalid Parameter: When ac_g_ex.fe_len is too large, order = fls(len) - 2 in mb_avg_fragment_size_order() exceeds MB_NUM_ORDERS(sb), triggering WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)). Code Locations: fs/ext4/mballoc.c:834. Proposed Fix: 1. Add validity checks for ac_g_ex.fe_len in ext4_mb_choose_next_group_best_avail() to ensure it does not exceed 1 << (MB_NUM_ORDERS(sb) + 2). 2. Enforce strict input validation for len in mb_avg_fragment_size_order() to reject invalid values. This can be reproduced on: HEAD commit: fac04efc5c793dccbd07e2d59af9f90b7fc0dca4 report: https://pastebin.com/raw/W5ejqsNx console output : https://pastebin.com/raw/U9qUGBhY kernel config: https://pastebin.com/raw/zrj9jd1V C reproducer : https://pastebin.com/raw/TCwWzfaH Best regards, Guoyu
