Analyze the code of Linux 6.12.

fs/ext4/mballoc.c
/* Modify block bitmap and group descriptor */
static int
ext4_mb_mark_context(handle_t *handle, struct super_block *sb, bool state,
		     ext4_group_t group, ext4_grpblk_t blkoff,
		     ext4_grpblk_t len, int flags, ext4_grpblk_t *ret_changed)
{
	...
	bitmap_bh = ext4_read_block_bitmap(sb, group);
	...
	gdp = ext4_get_group_desc(sb, group, &gdp_bh);
	...
	if (state) {
		mb_set_bits(bitmap_bh->b_data, blkoff, len);
		ext4_free_group_clusters_set(sb, gdp,
			ext4_free_group_clusters(sb, gdp) - changed);
	} else {
		mb_clear_bits(bitmap_bh->b_data, blkoff, len);
		ext4_free_group_clusters_set(sb, gdp,
			ext4_free_group_clusters(sb, gdp) + changed);
	}

	ext4_block_bitmap_csum_set(sb, gdp, bitmap_bh);
	ext4_group_desc_csum_set(sb, group, gdp);
	...

	err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
	if (err)
		goto out_err;
	err = ext4_handle_dirty_metadata(handle, NULL, gdp_bh);
	if (err)
		goto out_err;
	...
}

ext4_read_block_bitmap() -> ext4_read_block_bitmap_nowait()
fs/ext4/balloc.c
struct buffer_head *
ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group,
			      bool ignore_locked)
{
	...
	desc = ext4_get_group_desc(sb, block_group, NULL);
	...
	bitmap_blk = ext4_block_bitmap(sb, desc);
	...
	bh = sb_getblk(sb, bitmap_blk);
	...
	if (bitmap_uptodate(bh))
		goto verify;

	lock_buffer(bh);
	if (bitmap_uptodate(bh)) {
		unlock_buffer(bh);
		goto verify;
	}
	...
}

/* Write the dirty block buffers of the block device back to the storage device */
__writeback_single_inode() -> do_writepages()
-> mapping->a_ops->writepages() = blkdev_writepages()
-> write_cache_pages() -> block_write_full_folio() -> __block_write_full_folio()
fs/buffer.c
int __block_write_full_folio(struct inode *inode, struct folio *folio,
			get_block_t *get_block, struct writeback_control *wbc)
{
	...
	do {
		if (!buffer_mapped(bh))
			continue;
		if (wbc->sync_mode != WB_SYNC_NONE) {
			lock_buffer(bh);
		} else if (!trylock_buffer(bh)) { /* lock the block buffer */
			folio_redirty_for_writepage(wbc, folio);
			continue;
		}
		if (test_clear_buffer_dirty(bh)) {
			mark_buffer_async_write_endio(bh,
				end_buffer_async_write);/* When write-back completes, call end_buffer_async_write() to unlock the block buffer and clear the PG_writeback flag for the page */
		} else {
			unlock_buffer(bh);
		}
	} while ((bh = bh->b_this_page) != head);

	...
	folio_start_writeback(folio);/* call folio_test_set_writeback(folio) to set the PG_writeback flag for the page */

	do {
		struct buffer_head *next = bh->b_this_page;
		if (buffer_async_write(bh)) {
			submit_bh_wbc(REQ_OP_WRITE | write_flags, bh,
				      inode->i_write_hint, wbc);
			nr_underway++;
		}
		bh = next;
	} while (bh != head);
	folio_unlock(folio);
	...
}

When preparing to modify the block bitmap and the group descriptor, it does not lock the block buffers, and does not wait for the completion of "already started write-back to the storage device".
When writing the block buffer back to the storage device, lock the block buffer and set the write-back flag for the page. Upon completion of the write-back, unlock the block buffer and clear the write-back flag for the page.
The block device was set with the flag BLK_FEAT_STABLE_WRITES, but when preparing to modify the metadata of the EXT4 file system, it does not wait for the completion of "already started write-back to the storage device".
I find this bug in Linux 5.4. I am sure that Linux 6.12 has this bug.

I confirm that our company has disabled the journaling feature of the EXT4 file system.
mkfs.ext4 -O ^has_journal /dev/zram0
mount /dev/zram0 /tmp
If the journaling feature of the EXT4 file system is disabled, then a metadata block buffer is not locked when modifying it, potentially leading to concurrent execution with "writing the metadata block buffer back to the storage device".

mkfs.ext4 /dev/zram0 or mkfs.ext4 -O has_journal /dev/zram0
mount /dev/zram0 /tmp
Enable the journaling feature of the EXT4 file system. 
When committing a transaction, for each block buffer contained in the transaction, a copy is made and written to the journal, ensuring that the copy is not modified during the journaling process. 
"Writing a metadata block buffers back to the storage device" and "modifying the metadata block buffer" will not be executed concurrently.

The suggestions are as follows.
(1) Add a protection measure to the function __zram_bvec_write() of the ZRAM device driver to prevent kernel crash: If the length of the data after the second compression is different from that after the first compression, print a warning message and reallocate an object from the compression pool.
(2) Add a note in the document "admin-guide/blockdev/zram.rst": "When writing the content of a physical page back to the ZRAM device, the content of the physical page cannot be modified. Therefore, when storing an EXT4 file system in a ZRAM device, the journaling feature cannot be disabled."
(3) When mounting an EXT4 file system, if the STABLE_WRITES flag is set for the storage device and the journaling feature of the EXT4 file system is disabled, then report an error.