Safe unmounting of external btrfs disk

[Oliver Freyermuth <o.freyermuth@googlemail.com>]

Dear BTRFS experts,

I've had a rather strange occurence with my external BTRFS backup disk last night,
which makes me question what is the correct way to safely remove a USB drive with BTRFS on it.

Here's the timeline:
- 02:00:00 am: btrbk starts running.
- 02:01:17 am: btrbk deletes the last old subvolume from the disk
                (I have btrfs_commit_delete = no, so the delayed deletion basically starts some time after).
- ~02:18 am: I performn an "umount" of the disk.
- ~02:18:43 am: I unplug the USB drive.
- 02:25:05 am: My kernel tells me this:
[19268.944902] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 1, rd 0, flush 0, corrupt 0, gen 0
[19268.944904] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 2, rd 0, flush 0, corrupt 0, gen 0
[19268.944926] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0
[19268.944926] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 4, rd 0, flush 0, corrupt 0, gen 0
[19268.944938] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 5, rd 0, flush 0, corrupt 0, gen 0
[19268.944938] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 6, rd 0, flush 0, corrupt 0, gen 0
[19268.944963] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 7, rd 0, flush 0, corrupt 0, gen 0
[19268.944964] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 8, rd 0, flush 0, corrupt 0, gen 0
[19268.944973] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 9, rd 0, flush 0, corrupt 0, gen 0
[19268.944974] BTRFS error (device sdc1): bdev /dev/sdc1 errs: wr 10, rd 0, flush 0, corrupt 0, gen 0
[19268.946460] BTRFS: error (device sdc1) in btrfs_commit_transaction:2327: errno=-5 IO failure (Error while writing out transaction)
[19268.946461] BTRFS info (device sdc1): forced readonly
[19268.946462] BTRFS warning (device sdc1): Skipping commit of aborted transaction.
[19268.946463] BTRFS: error (device sdc1) in cleanup_transaction:1898: errno=-5 IO failure
[19268.946483] BTRFS error (device sdc1): commit super ret -5

What's worrisome is that this happened 7 minutes after the device was unmounted and unpluggied.
I use Kernel 5.9.11 and the following mount options on the backup disk:
  space_cache=v2,noatime,compress-force=zstd:6,commit=120,subvolid=0,noauto

Reconecting the disk, I do not see any subvolumes still pending deletion.

The good news: It seems the filesystem did not suffer at all,
probably since the whole transaction never reached the disk.

Is this behaviour expected?
If yes, how to "unmount" correctly (btrfs filesystem sync only seems to work on mounted filesystems)?
I believe udisks unmounts and then quickly removes power, so this would basically be similar to what I did manually here.

I've never seen this on earlier kernels, but I don't check my kernel logs each time, and don't unmount before shutdown each time,
so I can't state where this is a kernel version dependent issue.

Cheers,
	Oliver