6.18-stable patches

added patches:
	block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch

diff --git a/queue-6.18/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch b/queue-6.18/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch
new file mode 100644 (file)
index 0000000..3202e3f
--- /dev/null
+++ b/queue-6.18/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch
@@ -0,0 +1,58 @@
+From 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a Mon Sep 17 00:00:00 2001
+From: Chao Shi <coshi036@gmail.com>
+Date: Fri, 22 May 2026 18:00:25 -0400
+Subject: block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
+
+From: Chao Shi <coshi036@gmail.com>
+
+commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a upstream.
+
+bdev_mark_dead()'s @surprise == true means the device is already gone.
+The filesystem callback fs_bdev_mark_dead() honours this and skips
+sync_filesystem(), but the bare block device path (no ->mark_dead op)
+lost its !surprise guard when the holder ->mark_dead callback was wired
+up (see Fixes), and now calls sync_blockdev() unconditionally, which can
+hang forever waiting on writeback that can no longer complete.
+
+syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
+nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
+bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
+folio_wait_writeback(), wedging the reset worker and every task waiting
+on it.
+
+Skip the sync on surprise removal, matching fs_bdev_mark_dead();
+invalidate_bdev() still runs. Orderly removal (surprise == false) is
+unchanged.
+
+Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).
+
+Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
+Acked-by: Sungwoo Kim <iam@sung-woo.kim>
+Acked-by: Dave Tian <daveti@purdue.edu>
+Acked-by: Weidong Zhu <weizhu@fiu.edu>
+Signed-off-by: Chao Shi <coshi036@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://patch.msgid.link/20260522220025.1770388-1-coshi036@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bdev.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/block/bdev.c
++++ b/block/bdev.c
+@@ -1237,7 +1237,13 @@ void bdev_mark_dead(struct block_device
+               bdev->bd_holder_ops->mark_dead(bdev, surprise);
+       else {
+               mutex_unlock(&bdev->bd_holder_lock);
+-              sync_blockdev(bdev);
++              /*
++               * On surprise removal the device is already gone; syncing is
++               * futile and can hang forever waiting on I/O that will never
++               * complete.  Match fs_bdev_mark_dead(), which also skips it.
++               */
++              if (!surprise)
++                      sync_blockdev(bdev);
+       }
+ 
+       invalidate_bdev(bdev);

diff --git a/queue-6.18/series b/queue-6.18/series
index f0e063eeed43a7a729a3ad021f44b985fc9c4839..083b2bc7acedea8ece4d32b0ace0d14b1cc7bf93 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -317,3 +317,4 @@ usb-typec-ucsi-pass-full-dp-config-payload-in-set_new_cam-for-dp-alt-mode.patch
 usb-typec-ucsi-ccg-fix-use-after-free-of-ucsi-on-remove.patch
 usb-typec-ucsi-cancel-pending-work-on-system-suspend.patch
 usb-gadget-f_fs-fix-dma-fence-leak.patch
+block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch