1 files changed, 8 insertions, 2 deletions

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 46dc41a16fa..77b359162d6 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -107,12 +107,14 @@ static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
 static void hif_usb_tx_cb(struct urb *urb)
 {
         struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
-        struct hif_device_usb *hif_dev = tx_buf->hif_dev;
+        struct hif_device_usb *hif_dev;
         struct sk_buff *skb;
 
-        if (!hif_dev || !tx_buf)
+        if (!tx_buf || !tx_buf->hif_dev)
                 return;
 
+        hif_dev = tx_buf->hif_dev;
+
         switch (urb->status) {
         case 0:
                 break;
@@ -607,6 +609,10 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
 
         return 0;
 err:
+        if (tx_buf) {
+                kfree(tx_buf->buf);
+                kfree(tx_buf);
+        }
         ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
         return -ENOMEM;
 }