3 files changed, 24 insertions, 6 deletions

diff --git a/block/blk-core.c b/block/blk-core.c
index 3636be469fa2..c487b94c59e3 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1689,8 +1689,6 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio)
         struct request *req;
         unsigned int request_count = 0;
 
-        blk_queue_split(q, &bio, q->bio_split);
-
         /*
          * low level driver can indicate that it wants pages above a
          * certain limit bounced to low memory (ie for highmem, or even
@@ -1698,6 +1696,8 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio)
          */
         blk_queue_bounce(q, &bio);
 
+        blk_queue_split(q, &bio, q->bio_split);
+
         if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
                 bio->bi_error = -EIO;
                 bio_endio(bio);
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 8162475d96b5..a428e4ef71fd 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
 {
         struct request_queue *q = NULL;
 
+        if (cmd->rq)
+                q = cmd->rq->q;
+
         switch (queue_mode)  {
         case NULL_Q_MQ:
                 blk_mq_end_request(cmd->rq, 0);
@@ -232,9 +235,6 @@ static void end_cmd(struct nullb_cmd *cmd)
                 goto free_cmd;
         }
 
-        if (cmd->rq)
-                q = cmd->rq->q;
-
         /* Restart queue if needed, as we are freeing a tag */
         if (q && !q->mq_ops && blk_queue_stopped(q)) {
                 unsigned long flags;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9e294ff4e652..0c67b57be83c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2540,8 +2540,17 @@ static void nvme_ns_remove(struct nvme_ns *ns)
 {
         bool kill = nvme_io_incapable(ns->dev) && !blk_queue_dying(ns->queue);
 
-        if (kill)
+        if (kill) {
                 blk_set_queue_dying(ns->queue);
+
+                /*
+                 * The controller was shutdown first if we got here through
+                 * device removal. The shutdown may requeue outstanding
+                 * requests. These need to be aborted immediately so
+                 * del_gendisk doesn't block indefinitely for their completion.
+                 */
+                blk_mq_abort_requeue_list(ns->queue);
+        }
         if (ns->disk->flags & GENHD_FL_UP)
                 del_gendisk(ns->disk);
         if (kill || !blk_queue_dying(ns->queue)) {
@@ -2977,6 +2986,15 @@ static void nvme_dev_remove(struct nvme_dev *dev)
 {
         struct nvme_ns *ns, *next;
 
+        if (nvme_io_incapable(dev)) {
+                /*
+                 * If the device is not capable of IO (surprise hot-removal,
+                 * for example), we need to quiesce prior to deleting the
+                 * namespaces. This will end outstanding requests and prevent
+                 * attempts to sync dirty data.
+                 */
+                nvme_dev_shutdown(dev);
+        }
         list_for_each_entry_safe(ns, next, &dev->namespaces, list)
                 nvme_ns_remove(ns);
 }