gadgetfs: Fix leak on error in aio_read()

The previous fix, 'gadgetfs: use-after-free in ->aio_read()',
missed one error path where the iovec needs to be freed.

This fix is not needed upstream as that error path was removed
by commit 7fe3976e ('gadget: switch ep_io_operations to
->read_iter/->write_iter').

Fixes: f01d35a1 ('gadgetfs: use-after-free in ->aio_read()')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

drivers/usb/gadget/inode.c

@@ -648,6 +648,7 @@ ep_aio_rwtail(
 
 	value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
 	if (unlikely(value < 0)) {
+		kfree(priv->iv);
 		kfree(priv);
 		goto fail;
 	}