mptctl.c memory leak on failure

@@ -290,6 +290,7 @@
 	dma_addr_t		 fwbuf_dma;
 	FWDownloadTCSGE_t	*fwVoodoo;
 	SGEAllUnion_t		*fwSgl;
+	int ret;
 
 	dprintk((KERN_INFO "mptctl_do_fwdl called. mptctl_id = %xh.\n", mptctl_id)); //tc
 

@@ -309,20 +310,22 @@
 	}
 //dprintk((KERN_INFO "DbG: fwbuf       = %p\n", fwbuf));
 
+	ret = -EFAULT;
 	if (copy_from_user(fwbuf, ufwbuf, fwlen) < 0) {
 		printk(KERN_ERR "%s@%d::_ioctl_fwdl - "
 				"Unable to copy f/w buffer @ %p\n",
 				__FILE__, __LINE__, (void*)ufwbuf);
-		return -EFAULT;
+		goto out;
 	}
 
 	/* Perform Firmware download.
 	 */
 
+	ret = -ENXIO; /* (-6) No such device or address */
 	if ((ioc = mpt_verify_adapter(ioc, &iocp)) < 0) {
 		printk("%s@%d::_ioctl_fwdl - ioc%d not found!\n",
 				__FILE__, __LINE__, ioc);
-		return -ENXIO;			  /* (-6) No such device or address */
+		goto out;
 	}
 
 	mf = MptGetMsgFrame(mptctl_id, ioc);

@@ -373,8 +376,9 @@
 					   "In ReplyMsg loop - iteration %d\n",
 					   foo)); //tc
 			}
+			ret = -ETIME;
 			if (++foo > 60000000)
-				return -ETIME;
+				goto out;
 			mb();
 			schedule();
 			barrier();

@@ -402,6 +406,9 @@
 		printk(KERN_WARNING MYNAM ": (bad VooDoo):\n");
 		return -ENOMSG;
 	}
+	return 0;
+out:	kfree(fwbuf);
+	return ret;
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/