wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()

After the DMA buffer is mapped to a physical address, address is stored
in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
and later unmap the DMA buffer. But when count is always equal to
pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
will not be unmapped anyway.

Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
Signed-off-by: Zhengchao Shao <[e-mail]>
Reviewed-by: Sebastian Andrzej Siewior <[e-mail]>
Signed-off-by: Kalle Valo <[e-mail]>
Link: https://lore.kernel.org/r/[e-mail]

drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

···
 		count++;
 	} while (count < pktids->array_size);
 
-	if (count == pktids->array_size)
+	if (count == pktids->array_size) {
+		dma_unmap_single(dev, *physaddr, skb->len - data_offset,
+				 pktids->direction);
 		return -ENOMEM;
+	}
 
 	array[*idx].data_offset = data_offset;
 	array[*idx].physaddr = *physaddr;