[PATCH] drbd: Fix double put_ldev in receive_SyncParam on fifo_alloc failure

[PATCH] drbd: Fix double put_ldev in receive_SyncParam on fifo_alloc failure

[Wentao Liang]

In receive_SyncParam(), when the fifo_alloc() call for the resync
plan buffer fails, the error path executes put_ldev(device) at line
3790 and then jumps to the disconnect label. The disconnect label
also calls put_ldev(device) when new_disk_conf is non-NULL, which
is always the case by this point (get_ldev succeeded and
new_disk_conf was allocated).

This results in a double put_ldev, causing the ldev reference count
to underflow. All other goto disconnect sites in the same function
correctly rely solely on the disconnect label to perform the single
put_ldev — the fifo_alloc failure path was the only one to
prematurely release the reference.

Remove the spurious put_ldev(device) call before goto disconnect
to fix the double put.

Cc: stable@vger.kernel.org
Fixes: b30ab7913b0a ("drbd: Rename "mdev" to "device"")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/block/drbd/drbd_receiver.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 58b95bf4bdca..f618d03fd2a6 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3787,7 +3787,6 @@ static int receive_SyncParam(struct drbd_connection *connection, struct packet_i
 				new_plan = fifo_alloc(fifo_size);
 				if (!new_plan) {
 					drbd_err(device, "kmalloc of fifo_buffer failed");
-					put_ldev(device);
 					goto disconnect;
 				}
 			}
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] drbd: Fix double put_ldev in receive_SyncParam on fifo_alloc failure

[Christoph Böhmwalder]

On Thu, Jun 25, 2026 at 11:04:17PM +0800, Wentao Liang wrote:
>In receive_SyncParam(), when the fifo_alloc() call for the resync
>plan buffer fails, the error path executes put_ldev(device) at line
>3790 and then jumps to the disconnect label. The disconnect label
>also calls put_ldev(device) when new_disk_conf is non-NULL, which
>is always the case by this point (get_ldev succeeded and
>new_disk_conf was allocated).
>
>This results in a double put_ldev, causing the ldev reference count
>to underflow. All other goto disconnect sites in the same function
>correctly rely solely on the disconnect label to perform the single
>put_ldev — the fifo_alloc failure path was the only one to
>prematurely release the reference.
>
>Remove the spurious put_ldev(device) call before goto disconnect
>to fix the double put.
>
>Cc: stable@vger.kernel.org
>Fixes: b30ab7913b0a ("drbd: Rename "mdev" to "device"")
>Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
>---
> drivers/block/drbd/drbd_receiver.c | 1 -
> 1 file changed, 1 deletion(-)
>
>diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
>index 58b95bf4bdca..f618d03fd2a6 100644
>--- a/drivers/block/drbd/drbd_receiver.c
>+++ b/drivers/block/drbd/drbd_receiver.c
>@@ -3787,7 +3787,6 @@ static int receive_SyncParam(struct drbd_connection *connection, struct packet_i
> 				new_plan = fifo_alloc(fifo_size);
> 				if (!new_plan) {
> 					drbd_err(device, "kmalloc of fifo_buffer failed");
>-					put_ldev(device);
> 					goto disconnect;
> 				}
> 			}
>-- 
>2.39.5 (Apple Git-154)

Thanks for the patch, the fix itself looks correct to me.

The Fixes tag points at the wrong commit though. b30ab7913b0a is a
purely mechanical rename and only carried the existing code forward.

The double put was actually introduced by 813472ced7fa ("drbd: RCU for
rs_plan_s"), which added the put_ldev() to the disconnect label.

So the tag should be:

Fixes: 813472ced7fa ("drbd: RCU for rs_plan_s")

With that fixed up:

Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>