In rxkad_verify_response(), if skb_copy_bits() fails, the function jumps to the protocol_error label without freeing the allocated ticket, leading to a memory leak. Fix this by jumping to the protocol_error_free label to ensure the ticket is freed. Fixes: 57af281e5389b ("rxrpc: Tidy up abort generation infrastructure") Signed-off-by: Zilin Guan --- net/rxrpc/rxkad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c index 3657c0661cdc..4679c2be4235 100644 --- a/net/rxrpc/rxkad.c +++ b/net/rxrpc/rxkad.c @@ -1184,7 +1184,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, ticket, ticket_len) < 0) { rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO, rxkad_abort_resp_short_tkt); - goto protocol_error; + goto protocol_error_free; } ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len, -- 2.34.1