BUG_ON is bad:
- it prevents the traceback from being syslogged to another filesystem that hasn't crashed, or even running dmesg | ssh some_other_system if your entire system has to become read only.
- more simply, BUG_ON makes it hard to impossible to get the crash info on most average systems, so it loses the report. Even a picture of your screen is likely to miss earlier info that scrolled off
- Crashing a system because of one filesystem out of potentially many, is clearly the wrong thing to do.
Please remove all of them and convert them to WARN_ON_ONCE or equivalent, and where appropriate remount the filesystem readonly to prevent further damage (this is already done in places, but should be done everywhere).