Subject: brcmfmac: fix skb leak in brcmf_sdio_txpkt_prep_sg error path.

From: Dave Jones <[email-masked]>
Date: Thu, 6 Mar 2014 12:03:54 -0500

Commit 1eb4301867 added an allocation of an skb via brcmu_pkt_buf_get_skb()
but forgot to free it on one of the error paths.
 
Cc: Arend van Spriel <[email-masked]>
Signed-off-by: Dave Jones <[email-masked]>

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 119ee6eaf1c3..ddaa9efd053d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -1948,8 +1948,10 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
 		if (pkt_pad == NULL)
 			return -ENOMEM;
 		ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
-		if (unlikely(ret < 0))
+		if (unlikely(ret < 0)) {
+			kfree_skb(pkt_pad);
 			return ret;
+		}
 		memcpy(pkt_pad->data,
 		       pkt->data + pkt->len - tail_chop,
 		       tail_chop);