diff --git a/[refs] b/[refs]
index 3072881c6486..5084854907e9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: c14d01b8a159b9b6a337ccd91de2b89c8f37b3a4
+refs/heads/master: dce15efebe76088dc381ab91156842ebf7c79aca
diff --git a/trunk/drivers/staging/bcm/Bcmchar.c b/trunk/drivers/staging/bcm/Bcmchar.c
index cf411d1706b1..3d02c2ebfb8d 100644
--- a/trunk/drivers/staging/bcm/Bcmchar.c
+++ b/trunk/drivers/staging/bcm/Bcmchar.c
@@ -820,6 +820,7 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
 
 		if (copy_from_user(psFwInfo, IoBuffer.InputBuffer, IoBuffer.InputLength)) {
 			up(&Adapter->fw_download_sema);
+			kfree(psFwInfo);
 			return -EFAULT;
 		}
 
@@ -829,6 +830,7 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
 			BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Something else is wrong %lu\n",
 					psFwInfo->u32FirmwareLength);
 			up(&Adapter->fw_download_sema);
+			kfree(psFwInfo);
 			Status = -EINVAL;
 			return Status;
 		}