IB/ipath: Fix memory leak in init_shadow_tids() error path

If the second vmalloc() fails, the wrong pointer is pased to vfree(), so
the first vmalloc() ends up getting leaked.

This was spotted by the Coverity checker (CID 2709).

Signed-off-by: Roland Dreier <rolandd@cisco.com>