[PATCH] floppy: register the block major after the disks are added

["Denis Efremov (Oracle)" <efremov@linux.com>]

do_floppy_init() registers the block major, and with it floppy_probe(),
before it has detected the controllers and added disks[drive][0]. Once
a controller is found, opening a device node for another media format
makes floppy_probe() add disks[drive][type]. If init then fails, the
error path removes only disks[drive][0] and frees the tag sets, leaving
the probed disks registered on top of freed memory.

add_disk() does not need the major, so register it last. floppy_probe()
can then only run once init has succeeded.

Fixes: 302cfee15029 ("floppy: use a separate gendisk for each media format")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260708105703.747262-1-lgs201920130244%40gmail.com
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
---
 drivers/block/floppy.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index f04397b8e381..23a7a0fa76f6 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4602,13 +4602,9 @@ static int __init do_floppy_init(void)
 		timer_setup(&motor_off_timer[drive], motor_off_callback, 0);
 	}
 
-	err = __register_blkdev(FLOPPY_MAJOR, "fd", floppy_probe);
-	if (err)
-		goto out_put_disk;
-
 	err = platform_driver_register(&floppy_driver);
 	if (err)
-		goto out_unreg_blkdev;
+		goto out_put_disk;
 
 	for (i = 0; i < 256; i++)
 		if (ITYPE(i))
@@ -4733,6 +4729,14 @@ static int __init do_floppy_init(void)
 			goto out_remove_drives;
 	}
 
+	/*
+	 * Register last: floppy_probe() adds disks for the other formats,
+	 * which the error path below does not remove.
+	 */
+	err = __register_blkdev(FLOPPY_MAJOR, "fd", floppy_probe);
+	if (err)
+		goto out_remove_drives;
+
 	return 0;
 
 out_remove_drives:
@@ -4748,8 +4752,6 @@ static int __init do_floppy_init(void)
 		floppy_release_irq_and_dma();
 out_unreg_driver:
 	platform_driver_unregister(&floppy_driver);
-out_unreg_blkdev:
-	unregister_blkdev(FLOPPY_MAJOR, "fd");
 out_put_disk:
 	destroy_workqueue(floppy_wq);
 	for (drive = 0; drive < N_DRIVE; drive++) {

base-commit: 3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0
-- 
2.56.0