[PATCH] loop: clear backing file on LOOP_CONFIGURE limits failure

From: liyouhong <[email protected]>

loop_configure() assigns the backing file before queue_limits_commit_update().
If the limits update fails (e.g. an invalid block_size), the error path
fput()s the file but leaves lo->lo_backing_file set, keeps the modified
mapping gfp mask, leaves lo->lo_device dangling, and never clears the
uevent suppression flag.

Undo the assign on that failure path.

Fixes: b38c8be255e8 ("loop: use queue_limits_commit_update() for configuring")
Assisted-by: Cursor:grok-4.5
Signed-off-by: liyouhong <[email protected]>
---
 drivers/block/loop.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 1faecef33009..bfe2a788db44 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1059,7 +1059,7 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
 	/* No need to freeze the queue as the device isn't bound yet. */
 	error = queue_limits_commit_update(lo->lo_queue, &lim);
 	if (error)
-		goto out_unlock;
+		goto out_clear_backing;
 
 	/*
 	 * We might switch to direct I/O mode for the loop device, write back
@@ -1096,6 +1096,11 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
 
 	return 0;
 
+out_clear_backing:
+	mapping_set_gfp_mask(file->f_mapping, lo->old_gfp_mask);
+	lo->lo_backing_file = NULL;
+	lo->lo_device = NULL;
+	dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
 out_unlock:
 	loop_global_unlock(lo, is_loop);
 out_bdev: