When kmalloc() fails, cipher should be freed just like when krb5_rc4_setup_seq_key() fails. Fixes: e7afe6c1d486b ("sunrpc: fix 4 more call sites that were using stack memory with a scatterlist") Signed-off-by: Dinghao Liu <dinghao.liu@xxxxxxxxxx> --- net/sunrpc/auth_gss/gss_krb5_seqnum.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c index 507105127095..88ca58d11082 100644 --- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c +++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c @@ -53,8 +53,10 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum, return PTR_ERR(cipher); plain = kmalloc(8, GFP_NOFS); - if (!plain) - return -ENOMEM; + if (!plain) { + code = -ENOMEM; + goto out; + } plain[0] = (unsigned char) ((seqnum >> 24) & 0xff); plain[1] = (unsigned char) ((seqnum >> 16) & 0xff); -- 2.17.1