6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jakub Kicinski [ Upstream commit 266297692f97008ca48bc311775c087c59bd7fe3 ] rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation. Fixes: 4f038a6a02d2 ("net: ethtool: Don't call .cleanup_data when prepare_data fails") Link: https://patch.msgid.link/20260522230647.1705600-5-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/ethtool/rss.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ethtool/rss.c b/net/ethtool/rss.c index 5764202e6cb62..8387cbda3373d 100644 --- a/net/ethtool/rss.c +++ b/net/ethtool/rss.c @@ -94,8 +94,10 @@ rss_prepare_data(const struct ethnl_req_info *req_base, ret = ops->get_rxfh(dev, data->indir_table, data->hkey, &dev_hfunc); - if (ret) + if (ret) { + kfree(rss_config); goto out_ops; + } data->hfunc = dev_hfunc; out_ops: -- 2.53.0