[Android 5.10] kernel BUG in ext4_mb_release_inode_pa

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e5e5644ea27f Revert "udf: Avoid excessive partition lengths"
git tree: android13-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=114b8d5f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=4b4a7b8638c3099
dashboard link: https://syzkaller.appspot.com/bug?extid=d3c89c58559390a48d89
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a2b630580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d76b40580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0a4309df0fe8/disk-e5e5644e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5a70844d43b/vmlinux-e5e5644e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/985df9651f99/bzImage-e5e5644e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e30ba0c5a0bd/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3c89c...@syzkaller.appspotmail.com

EXT4-fs (loop2): pa ffff888120a39000: logic 0, phys. 193, len 32
EXT4-fs error (device loop2): ext4_mb_release_inode_pa:4362: group 0, free 13, pa_free 16
------------[ cut here ]------------
kernel BUG at fs/ext4/mballoc.c:4335!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 340 Comm: syz-executor336 Not tainted 5.10.226-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:ext4_mb_release_inode_pa+0xce7/0xcf0 fs/ext4/mballoc.c:4335
Code: 07 80 c1 03 38 c1 0f 8c 5f fd ff ff 4c 89 ff e8 ff f2 c7 ff e9 52 fd ff ff e8 35 59 8a ff 0f 0b e8 ae bd cc 02 e8 29 59 8a ff <0f> 0b 0f 1f 80 00 00 00 00 55 48 89 e5 41 57 41 56 53 49 89 fe 49
RSP: 0018:ffffc90000e76700 EFLAGS: 00010293

RAX: ffffffff81e053c7 RBX: 0000000000000060 RCX: ffff8881111813c0
RDX: 0000000000000000 RSI: 0000000000000060 RDI: 0000000000000000
RBP: ffffc90000e76850 R08: ffffffff81e0498c R09: 0000000000000003
R10: fffff520001cecfc R11: dffffc0000000001 R12: ffff8881209f2498
R13: 00000000000000ed R14: 0000000000911ef2 R15: dffffc0000000000
FS: 00007f74b4af26c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f74b4b8eb28 CR3: 0000000110f0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ext4_mb_discard_group_preallocations+0xbe3/0xe40 fs/ext4/mballoc.c:4481
ext4_mb_discard_preallocations fs/ext4/mballoc.c:5047 [inline]
ext4_mb_discard_preallocations_should_retry+0x1b7/0x8a0 fs/ext4/mballoc.c:5068
ext4_mb_new_blocks+0x3347/0x43e0 fs/ext4/mballoc.c:5271
ext4_alloc_branch fs/ext4/indirect.c:340 [inline]
ext4_ind_map_blocks+0x11cf/0x2ab0 fs/ext4/indirect.c:633
ext4_map_blocks+0xa0d/0x1d10 fs/ext4/inode.c:675
_ext4_get_block+0x21b/0x610 fs/ext4/inode.c:816
ext4_get_block+0x39/0x50 fs/ext4/inode.c:833
ext4_block_write_begin+0x61e/0x13b0 fs/ext4/inode.c:1100
ext4_write_begin+0x6fa/0x1730
ext4_da_write_begin+0x49d/0xf60 fs/ext4/inode.c:3032
generic_perform_write+0x2cd/0x570 mm/filemap.c:3509
ext4_buffered_write_iter+0x482/0x610 fs/ext4/file.c:271
ext4_file_write_iter+0x193/0x1c80 fs/ext4/file.c:685
call_write_iter include/linux/fs.h:2021 [inline]
new_sync_write fs/read_write.c:518 [inline]
vfs_write+0xb4c/0xe70 fs/read_write.c:605
ksys_write+0x199/0x2c0 fs/read_write.c:658
__do_sys_write fs/read_write.c:670 [inline]
__se_sys_write fs/read_write.c:667 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:667
do_syscall_64+0x34/0x70
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f74b4b42149
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f74b4af2218 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f74b4bc46e8 RCX: 00007f74b4b42149
RDX: 000000000208e24b RSI: 0000000020000240 RDI: 0000000000000006
RBP: 00007f74b4bc46e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74b4b8fe4c
R13: 00007f74b4b8f04d R14: 0000000000003d61 R15: 65646f6d746f6f72
Modules linked in:
---[ end trace b952f2ce7e974c53 ]---
RIP: 0010:ext4_mb_release_inode_pa+0xce7/0xcf0 fs/ext4/mballoc.c:4335
Code: 07 80 c1 03 38 c1 0f 8c 5f fd ff ff 4c 89 ff e8 ff f2 c7 ff e9 52 fd ff ff e8 35 59 8a ff 0f 0b e8 ae bd cc 02 e8 29 59 8a ff <0f> 0b 0f 1f 80 00 00 00 00 55 48 89 e5 41 57 41 56 53 49 89 fe 49
RSP: 0018:ffffc90000e76700 EFLAGS: 00010293
RAX: ffffffff81e053c7 RBX: 0000000000000060 RCX: ffff8881111813c0
RDX: 0000000000000000 RSI: 0000000000000060 RDI: 0000000000000000
RBP: ffffc90000e76850 R08: ffffffff81e0498c R09: 0000000000000003
R10: fffff520001cecfc R11: dffffc0000000001 R12: ffff8881209f2498
R13: 00000000000000ed R14: 0000000000911ef2 R15: dffffc0000000000
FS: 00007f74b4af26c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f74b4b8eb28 CR3: 0000000110f0f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup