Most of the error handling code in this function frees the buffers
kcmd_addr, kvb_addr, and kbox_addr allocated at the beginning of this
function.  These two branches are changed to do the same.
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Dave Airlie <airlied@redhat.com>
                                DRM_ERROR("indexed drawing command extends "
                                          "beyond end of command buffer\n");
                                DMA_FLUSH();
-                               return -EINVAL;
+                               ret = -EINVAL;
+                               goto done;
                        }
                        /* fall through */
                case SAVAGE_CMD_DMA_PRIM:
                                      cmdbuf->vb_stride,
                                      cmdbuf->nbox, cmdbuf->box_addr);
                                if (ret != 0)
-                                       return ret;
+                                       goto done;
                                first_draw_cmd = NULL;
                        }
                }