Please backport 49f06cff50a4 ("block: skip sync_blockdev() on surprise removal in bdev_mark_dead()") to 6.6.y, 6.12.y, 6.18.y

Please backport 49f06cff50a4 ("block: skip sync_blockdev() on surprise removal in bdev_mark_dead()") to 6.6.y, 6.12.y, 6.18.y

[Chao S]

Hi stable team,

Please consider the following mainline commit for the stable trees:

  commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a
  Author: Chao Shi <coshi036@gmail.com>
  "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()"

Why it should be applied:
On surprise removal (@surprise == true) the device is already gone, but the
bare block-device path in bdev_mark_dead() (no ->mark_dead holder op) calls
sync_blockdev() unconditionally. It can then hang forever in
folio_wait_writeback() waiting on writeback that can never complete. We hit
this via nvme_reset_work()'s "I/O queues lost" path
(nvme_mark_namespaces_dead -> blk_mark_disk_dead -> bdev_mark_dead(bdev, true)),
which wedges the reset worker and every task serialized behind it -- an
unrecoverable hung-task/DoS (multiple tasks blocked >120s, reproduced several
times under fuzzing). The fix simply skips the futile sync on surprise removal,
matching fs_bdev_mark_dead(); invalidate_bdev() still runs and orderly removal
is unchanged.

Affected versions:
  Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
which first shipped in v6.6 (it dropped the pre-existing !surprise guard from
the bare-bdev path). So the bug is present in v6.6 through the fix.
v7.0+ already
carries the fix, and pre-6.6 trees still have the original guard, so
this is only
needed for the 6.6.y, 6.12.y and 6.18.y stable trees.

The change is a self-contained one-line guard (plus a comment) in
bdev_mark_dead()
and should cherry-pick cleanly onto all three; happy to send adjusted backports
if any tree conflicts.

Thanks,
Chao Shi

Re: Please backport 49f06cff50a4 ("block: skip sync_blockdev() on surprise removal in bdev_mark_dead()") to 6.6.y, 6.12.y, 6.18.y

[Greg KH]

On Tue, Jul 14, 2026 at 05:20:19PM -0400, Chao S wrote:
> Hi stable team,
> 
> Please consider the following mainline commit for the stable trees:
> 
>   commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a
>   Author: Chao Shi <coshi036@gmail.com>
>   "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()"
> 
> Why it should be applied:
> On surprise removal (@surprise == true) the device is already gone, but the
> bare block-device path in bdev_mark_dead() (no ->mark_dead holder op) calls
> sync_blockdev() unconditionally. It can then hang forever in
> folio_wait_writeback() waiting on writeback that can never complete. We hit
> this via nvme_reset_work()'s "I/O queues lost" path
> (nvme_mark_namespaces_dead -> blk_mark_disk_dead -> bdev_mark_dead(bdev, true)),
> which wedges the reset worker and every task serialized behind it -- an
> unrecoverable hung-task/DoS (multiple tasks blocked >120s, reproduced several
> times under fuzzing). The fix simply skips the futile sync on surprise removal,
> matching fs_bdev_mark_dead(); invalidate_bdev() still runs and orderly removal
> is unchanged.
> 
> Affected versions:
>   Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
> which first shipped in v6.6 (it dropped the pre-existing !surprise guard from
> the bare-bdev path). So the bug is present in v6.6 through the fix.
> v7.0+ already
> carries the fix, and pre-6.6 trees still have the original guard, so
> this is only
> needed for the 6.6.y, 6.12.y and 6.18.y stable trees.
> 
> The change is a self-contained one-line guard (plus a comment) in
> bdev_mark_dead()
> and should cherry-pick cleanly onto all three; happy to send adjusted backports
> if any tree conflicts.

We need a 6.6.y backport as it does not apply cleanly there.

thanks,

greg k-h

Re: Please backport 49f06cff50a4 ("block: skip sync_blockdev() on surprise removal in bdev_mark_dead()") to 6.6.y, 6.12.y, 6.18.y

[Chao S]

Hi Greg,

Thanks for your email. Sure, working on it.

Best,
Chao Shi

On Wed, Jul 15, 2026 at 12:48 AM Greg KH <greg@kroah.com> wrote:
>
> On Tue, Jul 14, 2026 at 05:20:19PM -0400, Chao S wrote:
> > Hi stable team,
> >
> > Please consider the following mainline commit for the stable trees:
> >
> >   commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a
> >   Author: Chao Shi <coshi036@gmail.com>
> >   "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()"
> >
> > Why it should be applied:
> > On surprise removal (@surprise == true) the device is already gone, but the
> > bare block-device path in bdev_mark_dead() (no ->mark_dead holder op) calls
> > sync_blockdev() unconditionally. It can then hang forever in
> > folio_wait_writeback() waiting on writeback that can never complete. We hit
> > this via nvme_reset_work()'s "I/O queues lost" path
> > (nvme_mark_namespaces_dead -> blk_mark_disk_dead -> bdev_mark_dead(bdev, true)),
> > which wedges the reset worker and every task serialized behind it -- an
> > unrecoverable hung-task/DoS (multiple tasks blocked >120s, reproduced several
> > times under fuzzing). The fix simply skips the futile sync on surprise removal,
> > matching fs_bdev_mark_dead(); invalidate_bdev() still runs and orderly removal
> > is unchanged.
> >
> > Affected versions:
> >   Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
> > which first shipped in v6.6 (it dropped the pre-existing !surprise guard from
> > the bare-bdev path). So the bug is present in v6.6 through the fix.
> > v7.0+ already
> > carries the fix, and pre-6.6 trees still have the original guard, so
> > this is only
> > needed for the 6.6.y, 6.12.y and 6.18.y stable trees.
> >
> > The change is a self-contained one-line guard (plus a comment) in
> > bdev_mark_dead()
> > and should cherry-pick cleanly onto all three; happy to send adjusted backports
> > if any tree conflicts.
>
> We need a 6.6.y backport as it does not apply cleanly there.
>
> thanks,
>
> greg k-h

[PATCH 6.6.y] block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

[Chao Shi]

commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a upstream.

bdev_mark_dead()'s @surprise == true means the device is already gone.
The filesystem callback fs_bdev_mark_dead() honours this and skips
sync_filesystem(), but the bare block device path (no ->mark_dead op)
lost its !surprise guard when the holder ->mark_dead callback was wired
up (see Fixes), and now calls sync_blockdev() unconditionally, which can
hang forever waiting on writeback that can no longer complete.

syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
folio_wait_writeback(), wedging the reset worker and every task waiting
on it.

Skip the sync on surprise removal, matching fs_bdev_mark_dead();
invalidate_bdev() still runs. Orderly removal (surprise == false) is
unchanged.

Found by FuzzNvme.

Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
Acked-by: Sungwoo Kim <iam@sung-woo.kim>
Acked-by: Dave Tian <daveti@purdue.edu>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Signed-off-by: Chao Shi <coshi036@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260522220025.1770388-1-coshi036@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ adjusted for 6.6.y: bdev_mark_dead() there still unlocks bd_holder_lock
  after the if/else and the else arm is a bare sync_blockdev(), so the
  !surprise guard is added as "else if (!surprise)" instead of inside the
  mainline else block. ]
Signed-off-by: Chao Shi <coshi036@gmail.com>
---
 block/bdev.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/block/bdev.c b/block/bdev.c
index f3b13aa1b7d4..2bbe0408dac2 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -961,7 +961,12 @@ void bdev_mark_dead(struct block_device *bdev, bool surprise)
 	mutex_lock(&bdev->bd_holder_lock);
 	if (bdev->bd_holder_ops && bdev->bd_holder_ops->mark_dead)
 		bdev->bd_holder_ops->mark_dead(bdev, surprise);
-	else
+	/*
+	 * On surprise removal the device is already gone; syncing is
+	 * futile and can hang forever waiting on I/O that will never
+	 * complete.  Match fs_bdev_mark_dead(), which also skips it.
+	 */
+	else if (!surprise)
 		sync_blockdev(bdev);
 	mutex_unlock(&bdev->bd_holder_lock);
 
-- 
2.43.0

Re: [PATCH 6.6.y] block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

[Sasha Levin]

On Thu, Jul 16, 2026 at 03:34:52AM -0400, Chao Shi wrote:
> bdev_mark_dead()'s @surprise == true means the device is already gone.
> The filesystem callback fs_bdev_mark_dead() honours this and skips
> sync_filesystem(), but the bare block device path (no ->mark_dead op)
> lost its !surprise guard when the holder ->mark_dead callback was wired
> up (see Fixes), and now calls sync_blockdev() unconditionally, which can
> hang forever waiting on writeback that can no longer complete.

Queued for 6.6, thanks.

-- 
Thanks,
Sasha

Re: [PATCH 6.6.y] block: skip sync_blockdev() on surprise removal in bdev_mark_dead()

[Chao S]

Thank you!

Best,
Chao

On Thu, Jul 16, 2026 at 9:37 PM Sasha Levin <sashal@kernel.org> wrote:
>
> On Thu, Jul 16, 2026 at 03:34:52AM -0400, Chao Shi wrote:
> > bdev_mark_dead()'s @surprise == true means the device is already gone.
> > The filesystem callback fs_bdev_mark_dead() honours this and skips
> > sync_filesystem(), but the bare block device path (no ->mark_dead op)
> > lost its !surprise guard when the holder ->mark_dead callback was wired
> > up (see Fixes), and now calls sync_blockdev() unconditionally, which can
> > hang forever waiting on writeback that can no longer complete.
>
> Queued for 6.6, thanks.
>
> --
> Thanks,
> Sasha