In rxkad_verify_response(), if skb_copy_bits() fails, the function jumps to
the protocol_error label without freeing the allocated ticket, leading to
a memory leak.

Fix this by jumping to the protocol_error_free label to ensure the ticket
is freed.

Fixes: 57af281e5389b ("rxrpc: Tidy up abort generation infrastructure")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 net/rxrpc/rxkad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 3657c0661cdc..4679c2be4235 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1184,7 +1184,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
 			  ticket, ticket_len) < 0) {
 		rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
 				 rxkad_abort_resp_short_tkt);
-		goto protocol_error;
+		goto protocol_error_free;
 	}
 
 	ret = rxkad_decrypt_ticket(conn, server_key, skb, ticket, ticket_len,
-- 
2.34.1