drivers/bluetooth/bpa10x.c: fix memleak

@@ -378,96 +378,97 @@ static int bpa10x_send_frame(struct sk_b
 	urb = usb_alloc_urb(0, GFP_ATOMIC);
 	if (!urb)
 		return -ENOMEM;
 
 	/* Prepend skb with frame type */
 	*skb_push(skb, 1) = bt_cb(skb)->pkt_type;
 
 	switch (bt_cb(skb)->pkt_type) {
 	case HCI_COMMAND_PKT:
 		dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 		if (!dr) {
 			usb_free_urb(urb);
 			return -ENOMEM;
 		}
 
 		dr->bRequestType = USB_TYPE_VENDOR;
 		dr->bRequest     = 0;
 		dr->wIndex       = 0;
 		dr->wValue       = 0;
 		dr->wLength      = __cpu_to_le16(skb->len);
 
 		pipe = usb_sndctrlpipe(data->udev, 0x00);
 
 		usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.cmd_tx++;
 		break;
 
 	case HCI_ACLDATA_PKT:
 		pipe = usb_sndbulkpipe(data->udev, 0x02);
 
 		usb_fill_bulk_urb(urb, data->udev, pipe,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.acl_tx++;
 		break;
 
 	case HCI_SCODATA_PKT:
 		pipe = usb_sndbulkpipe(data->udev, 0x02);
 
 		usb_fill_bulk_urb(urb, data->udev, pipe,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.sco_tx++;
 		break;
 
 	default:
+		usb_free_urb(urb);
 		return -EILSEQ;
 	}
 
 	usb_anchor_urb(urb, &data->tx_anchor);
 
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err < 0) {
 		BT_ERR("%s urb %p submission failed", hdev->name, urb);
 		kfree(urb->setup_packet);
 		usb_unanchor_urb(urb);
 	}
 
 	usb_free_urb(urb);
 
 	return 0;
 }
 
 static void bpa10x_destruct(struct hci_dev *hdev)
 {
 	struct bpa10x_data *data = hdev->driver_data;
 
 	BT_DBG("%s", hdev->name);
 
 	kfree(data->rx_skb[0]);
 	kfree(data->rx_skb[1]);
 	kfree(data);
 }
 
 static int bpa10x_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
 	struct bpa10x_data *data;
 	struct hci_dev *hdev;
 	int err;
 
 	BT_DBG("intf %p id %p", intf, id);
 
 	if (ignore)
 		return -ENODEV;
 
 	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
 		return -ENODEV;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
 	data->udev = interface_to_usbdev(intf);