Re: Please backport 49f06cff50a4 ("block: skip sync_blockdev() on surprise removal in bdev_mark_dead()") to 6.6.y, 6.12.y, 6.18.y

[Greg KH <greg@kroah.com>]

On Tue, Jul 14, 2026 at 05:20:19PM -0400, Chao S wrote:
> Hi stable team,
> 
> Please consider the following mainline commit for the stable trees:
> 
>   commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a
>   Author: Chao Shi <coshi036@gmail.com>
>   "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()"
> 
> Why it should be applied:
> On surprise removal (@surprise == true) the device is already gone, but the
> bare block-device path in bdev_mark_dead() (no ->mark_dead holder op) calls
> sync_blockdev() unconditionally. It can then hang forever in
> folio_wait_writeback() waiting on writeback that can never complete. We hit
> this via nvme_reset_work()'s "I/O queues lost" path
> (nvme_mark_namespaces_dead -> blk_mark_disk_dead -> bdev_mark_dead(bdev, true)),
> which wedges the reset worker and every task serialized behind it -- an
> unrecoverable hung-task/DoS (multiple tasks blocked >120s, reproduced several
> times under fuzzing). The fix simply skips the futile sync on surprise removal,
> matching fs_bdev_mark_dead(); invalidate_bdev() still runs and orderly removal
> is unchanged.
> 
> Affected versions:
>   Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
> which first shipped in v6.6 (it dropped the pre-existing !surprise guard from
> the bare-bdev path). So the bug is present in v6.6 through the fix.
> v7.0+ already
> carries the fix, and pre-6.6 trees still have the original guard, so
> this is only
> needed for the 6.6.y, 6.12.y and 6.18.y stable trees.
> 
> The change is a self-contained one-line guard (plus a comment) in
> bdev_mark_dead()
> and should cherry-pick cleanly onto all three; happy to send adjusted backports
> if any tree conflicts.

We need a 6.6.y backport as it does not apply cleanly there.

thanks,

greg k-h