From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 15 Jul 2026 04:47:41 +0000 (+0200)
Subject: 6.12-stable patches
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=793976c2cdc1d580867aafa50077f57c73860218;p=thirdparty%2Fkernel%2Fstable-queue.git

6.12-stable patches

added patches:
	block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch
---

diff --git a/queue-6.12/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch b/queue-6.12/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch
new file mode 100644
index 0000000000..49864a0307
--- /dev/null
+++ b/queue-6.12/block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch
@@ -0,0 +1,58 @@
+From 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a Mon Sep 17 00:00:00 2001
+From: Chao Shi <coshi036@gmail.com>
+Date: Fri, 22 May 2026 18:00:25 -0400
+Subject: block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
+
+From: Chao Shi <coshi036@gmail.com>
+
+commit 49f06cff50a4ccf3b7a1a662ceb892b3b21a527a upstream.
+
+bdev_mark_dead()'s @surprise == true means the device is already gone.
+The filesystem callback fs_bdev_mark_dead() honours this and skips
+sync_filesystem(), but the bare block device path (no ->mark_dead op)
+lost its !surprise guard when the holder ->mark_dead callback was wired
+up (see Fixes), and now calls sync_blockdev() unconditionally, which can
+hang forever waiting on writeback that can no longer complete.
+
+syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
+nvme_mark_namespaces_dead() -> blk_mark_disk_dead() ->
+bdev_mark_dead(bdev, true) -> sync_blockdev() blocks in
+folio_wait_writeback(), wedging the reset worker and every task waiting
+on it.
+
+Skip the sync on surprise removal, matching fs_bdev_mark_dead();
+invalidate_bdev() still runs. Orderly removal (surprise == false) is
+unchanged.
+
+Found by FuzzNvme(Syzkaller with FEMU fuzzing framework).
+
+Fixes: d8530de5a6e8 ("block: call into the file system for bdev_mark_dead")
+Acked-by: Sungwoo Kim <iam@sung-woo.kim>
+Acked-by: Dave Tian <daveti@purdue.edu>
+Acked-by: Weidong Zhu <weizhu@fiu.edu>
+Signed-off-by: Chao Shi <coshi036@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://patch.msgid.link/20260522220025.1770388-1-coshi036@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bdev.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/block/bdev.c
++++ b/block/bdev.c
+@@ -1213,7 +1213,13 @@ void bdev_mark_dead(struct block_device
+ 		bdev->bd_holder_ops->mark_dead(bdev, surprise);
+ 	else {
+ 		mutex_unlock(&bdev->bd_holder_lock);
+-		sync_blockdev(bdev);
++		/*
++		 * On surprise removal the device is already gone; syncing is
++		 * futile and can hang forever waiting on I/O that will never
++		 * complete.  Match fs_bdev_mark_dead(), which also skips it.
++		 */
++		if (!surprise)
++			sync_blockdev(bdev);
+ 	}
+ 
+ 	invalidate_bdev(bdev);
diff --git a/queue-6.12/series b/queue-6.12/series
index c9dc06c2ae..0c870d60d2 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -252,3 +252,4 @@ usb-typec-ucsi-pass-full-dp-config-payload-in-set_new_cam-for-dp-alt-mode.patch
 usb-typec-ucsi-ccg-fix-use-after-free-of-ucsi-on-remove.patch
 usb-typec-ucsi-cancel-pending-work-on-system-suspend.patch
 usb-gadget-f_fs-fix-dma-fence-leak.patch
+block-skip-sync_blockdev-on-surprise-removal-in-bdev_mark_dead.patch