[BUG] WARNING in mb_avg_fragment_size_order

[Guoyu Yin]

Hi,

This crash can be triggered by repeatedly performing specific file
operations, causing a kernel warning in the Ext4 multi-block allocator
(mballoc) module. The issue arises in mb_avg_fragment_size_order due
to an invalid len parameter leading to an out-of-bound order, thus
triggering the WARNING.

Root Cause:
1. Code Path: In ext4_mb_choose_next_group_best_avail(),
ac_g_ex.fe_len might be incorrectly calculated as an excessively large
value (e.g., via roundup).
2. Invalid Parameter: When ac_g_ex.fe_len is too large, order =
fls(len) - 2 in mb_avg_fragment_size_order() exceeds
MB_NUM_ORDERS(sb), triggering WARN_ON_ONCE(order > MB_NUM_ORDERS(sb)).

Code Locations:
fs/ext4/mballoc.c:834.

Proposed Fix:
1. Add validity checks for ac_g_ex.fe_len in
ext4_mb_choose_next_group_best_avail() to ensure it does not exceed 1
<< (MB_NUM_ORDERS(sb) + 2).
2. Enforce strict input validation for len in
mb_avg_fragment_size_order() to reject invalid values.

This can be reproduced on:
HEAD commit:

fac04efc5c793dccbd07e2d59af9f90b7fc0dca4

report: https://pastebin.com/raw/W5ejqsNx

console output : https://pastebin.com/raw/U9qUGBhY

kernel config: https://pastebin.com/raw/zrj9jd1V

C reproducer : https://pastebin.com/raw/TCwWzfaH

Best regards,
Guoyu