[PATCH v2] block: loop: restore backing file state on loop_configure() failure

From: Iván Ezequiel Rodriguez

Date: Wed Sep 02 2026 - 22:13:31 EST


If queue_limits_commit_update() fails after loop_assign_backing_file(),
restore the backing file GFP mask, clear lo_backing_file and lo_device,
and re-enable uevents before unlocking.

Scope the rollback to a dedicated out_restore_backing label reached only
from errors after the backing file is modified in this call. The common
out_unlock path is also used for early validation failures such as
-EBUSY when lo->lo_state != Lo_unbound; in that case the device may
already have a valid backing file that must not be cleared.

Signed-off-by: Iván Ezequiel Rodriguez <ivanrwcm25@xxxxxxxxx>
---
Changes since v1:
- Drop the brd xa_destroy patch: xa_init() does not allocate; there is
nothing to destroy on the blk_alloc_disk() failure path.
- Fix loop rollback scope: do not restore from the common out_unlock
path. That label is also reached for early failures such as -EBUSY
when the device is already bound, where lo_backing_file belongs to
the existing configuration. Use a dedicated out_restore_backing
label only for errors after loop_assign_backing_file().

drivers/block/loop.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 6f12976035b0..aec7fbad1903 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1085,7 +1085,7 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
/* No need to freeze the queue as the device isn't bound yet. */
error = queue_limits_commit_update(lo->lo_queue, &lim);
if (error)
- goto out_unlock;
+ goto out_restore_backing;

/*
* We might switch to direct I/O mode for the loop device, write back
@@ -1122,6 +1122,13 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,

return 0;

+out_restore_backing:
+ mapping_set_gfp_mask(lo->lo_backing_file->f_mapping,
+ lo->old_gfp_mask);
+ lo->lo_backing_file = NULL;
+ lo->lo_device = NULL;
+ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
+
out_unlock:
loop_global_unlock(lo, is_loop);
out_bdev:
--
2.43.0