Larry Finger wrote:

My only counter argument is that none of the other paths that get to 
ath9k_htc_txcompletion_cb() leak the skb. It only happens for the path that goes 
through htc_connect_service().

Sure, but the TX completion handler would be invoked for every skb that is passed
to the USB layer, including the ones that are allocated in htc_hst.c. When this
skb goes down to hif_usb.c, a URB is allocated and I am not sure how freeing
the skb before the USB layer invokes the completion handler for the URB is correct.

I'll come up with a patch and see if kmemleak still complains.

Sujith