In loop_configure() (drivers/block/loop.c), if
loop_set_status_from_info() or blk_mq_unfreeze_queue() fails after
lo->lo_backing_file has been assigned, reset lo->lo_backing_file = NULL,
lo->lo_device = NULL, lo->lo_flags = 0, mapping_set_gfp_mask(mapping,
lo->old_gfp_mask), and dev_set_uevent_suppress(disk_to_dev(lo->lo_disk),
0) before calling fput(file) so a dangling struct file * pointer is not
left in lo->lo_backing_file with lo_state == Lo_unbound.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 758c20678bf6..8fae858c9df7 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1086,8 +1086,15 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
 	loop_update_limits(lo, &lim, config->block_size);
 	/* No need to freeze the queue as the device isn't bound yet. */
 	error = queue_limits_commit_update(lo->lo_queue, &lim);
-	if (error)
+	if (error) {
+		mapping_set_gfp_mask(file->f_mapping, lo->old_gfp_mask);
+		spin_lock_irq(&lo->lo_lock);
+		lo->lo_backing_file = NULL;
+		spin_unlock_irq(&lo->lo_lock);
+		lo->lo_device = NULL;
+		dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
 		goto out_unlock;
+	}
 
 	/*
 	 * We might switch to direct I/O mode for the loop device, write back