===MODEL PATCH ===
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -299,6 +299,7 @@ put_chain:
 	if (goto_ch)
 		tcf_chain_put_by_act(goto_ch);
 out_free_ex:
+	kfree(nparms->tcfp_keys);
 	kfree(nparms->tcfp_keys_ex);
 out_free:
 	kfree(nparms);

===ORIGINAL PATCH ===
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index fb93d4c1faca..fc945c7e4123 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -258,7 +258,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 		if (!offmask && cur % 4) {
 			NL_SET_ERR_MSG_MOD(extack, "Offsets must be on 32bit boundaries");
 			ret = -EINVAL;
-			goto put_chain;
+			goto out_free_keys;
 		}
 
 		/* sanitize the shift value for any later use */
@@ -291,6 +291,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 
 	return ret;
 
+out_free_keys:
+	kfree(nparms->tcfp_keys);
 put_chain:
 	if (goto_ch)
 		tcf_chain_put_by_act(goto_ch);

