[PATCH V3 0/6] null_blk: fix init/exit races and memleaks

[Zizhi Wo]

This series fixes several issues in null_blk around lock initialization,
concurrent configfs access, and module init/exit.

Patch 1 fixes the uninitialized mutex. Following Bart's suggestion, the
fix now uses DEFINE_MUTEX(). This series no longer renames the lock;
following Damien Le Moal's suggestion, the rename and locking rework will
be sent as a separate series.

Patch 2 fixes configfs registration concurrency.

Patch 3 reorders resource release in null_exit() to match null_init().

Patch 4 fixes a global tag_set leak on the null_init() error path.

Patch 5 fixes a mid-setup race where a store changes a field before
CONFIGURED is set, causing out-of-bounds dev->zones[] access

Patch 6 adds READ_ONCE()/WRITE_ONCE() to the configfs attribute
reads/writes that race with each other.

Changes since v2:
- Dropped the lock rename patch; the rename and locking rework will be
  sent as a separate series (per Damien's suggestion).
- Patch 3: fixed the tense in the commit message.
- Patch 5: Mofify the lock position in v2 patch 4 to fix a mid-setup race.
- Added new patch 6.
https://lore.kernel.org/all/20260707025542.1299859-1-wozizhi@xxxxxxxxxxxxxxx/

Changes since v1:
- Added patches 4-6, and modify the lock name in patch 2.
https://lore.kernel.org/all/20260706123507.3809871-1-wozizhi@xxxxxxxxxxxxxxx/

Zizhi Wo (6):
  null_blk: use DEFINE_MUTEX for the file-scope mutex
  null_blk: register configfs subsystem after creating default devices
  null_blk: move unregister_blkdev() after destroying dev in null_exit()
  null_blk: free global tag_set on init error path
  null_blk: serialize configfs attribute stores with device setup
  null_blk: mark racy configfs attribute accesses with
    READ_ONCE/WRITE_ONCE

 drivers/block/null_blk/main.c  | 92 +++++++++++++++-------------------
 drivers/block/null_blk/zoned.c | 18 +++----
 2 files changed, 49 insertions(+), 61 deletions(-)

-- 
2.52.0