From: liyouhong loop_configure() assigns the backing file before queue_limits_commit_update(). If the limits update fails (e.g. an invalid block_size), the error path fput()s the file but leaves lo->lo_backing_file set, keeps the modified mapping gfp mask, leaves lo->lo_device dangling, and never clears the uevent suppression flag. Undo the assign on that failure path. Fixes: b38c8be255e8 ("loop: use queue_limits_commit_update() for configuring") Assisted-by: Cursor:grok-4.5 Signed-off-by: liyouhong --- drivers/block/loop.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 1faecef33009..bfe2a788db44 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1059,7 +1059,7 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode, /* No need to freeze the queue as the device isn't bound yet. */ error = queue_limits_commit_update(lo->lo_queue, &lim); if (error) - goto out_unlock; + goto out_clear_backing; /* * We might switch to direct I/O mode for the loop device, write back @@ -1096,6 +1096,11 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode, return 0; +out_clear_backing: + mapping_set_gfp_mask(file->f_mapping, lo->old_gfp_mask); + lo->lo_backing_file = NULL; + lo->lo_device = NULL; + dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); out_unlock: loop_global_unlock(lo, is_loop); out_bdev: