Hi, I discovered a kernel crash described as "kernel BUG in mb_mark_used", which is triggered by a BUG_ON() in the ext4 function mb_mark_used()(fs/ext4/mballoc.c:2051). The crash occurs when the expression start + len > (e4b->bd_sb->s_blocksize << 3) evaluates true, indicating that the block range to be marked as used exceeds the size of the bitmap. This suggests that an invalid or corrupted block extent was passed to the allocator, potentially due to inconsistent internal state or a logic flaw in the extent calculation. The call trace shows the crash is triggered via a direct I/O write operation (ext4_dio_write_iter), which ultimately invokes ext4_mb_new_blocks() and its subroutine mb_mark_used(). The crash is reproducible using a crafted workload involving mounting an ext4 loopback device and issuing writes. This may indicate a latent inconsistency in ext4's multiblock allocation logic (mballoc.c), especially under specific block size or extent configurations. Further investigation is recommended in the validation of input to mb_mark_used() and in protecting against block range overflows. This can be reproduced on: HEAD commit: commit e8f897f4afef0031fe618a8e94127a0934896aba report: https://pastebin.com/raw/EHJyW2Ev console output : https://pastebin.com/raw/vKPznSCn kernel config : https://pastebin.com/raw/aJ9rUnhG C reproducer : https://pastebin.com/raw/rZ5xcbt5 Best regards, Xianying
