1) It didn't free xfer->seg[0] so there was a leak.
2) xfer->seg[cnt] can be NULL.
3) Use usb_free_urb() for ->dto_urb instead of kfree().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>