diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 893d8a4805921ab69f41dc1ab183b0a67af2d204..a296690e5947985891896a5b27fdb754881f3a49 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -588,6 +588,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
 {
 	int keylen;
 	u32 time32;
+	int ret;
 
 	p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags));
 	if (IS_ERR(p))
@@ -644,16 +645,28 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
 
 	switch (ctx->enctype) {
 	case ENCTYPE_DES3_CBC_RAW:
-		return context_derive_keys_des3(ctx, gfp_mask);
+		ret = context_derive_keys_des3(ctx, gfp_mask);
+		break;
 	case ENCTYPE_ARCFOUR_HMAC:
-		return context_derive_keys_rc4(ctx);
+		ret = context_derive_keys_rc4(ctx);
+		break;
 	case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
 	case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
-		return context_derive_keys_new(ctx, gfp_mask);
+		ret = context_derive_keys_new(ctx, gfp_mask);
+		break;
 	default:
-		return -EINVAL;
+		ret -EINVAL;
 	}
 
+	if (ret) {
+		p = ERR_PTR(ret);
+		goto out_free;
+	}
+
+	return 0;
+
+out_free:
+	kfree(ctx->mech_used.data);
 out_err:
 	return PTR_ERR(p);
 }