qcacmn: increment refcount for peer find by id

Use unified version of dp_peer_find_by_id API
which will take peer reference

Also use unified peer ref release API dp_peer_unref_delete

Change-Id: Ibb516a933020a42a5584dbbbba59f8d9b72dcaa4

dp/wifi3.0/dp_htt.c

@@ -2415,7 +2415,7 @@ static void dp_process_ppdu_stats_user_common_tlv(
 		}
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 }
 
@@ -2460,13 +2460,12 @@ static void dp_process_ppdu_stats_user_rate_tlv(struct dp_pdev *pdev,
 			     QDF_MAC_ADDR_SIZE);
 	} else {
 		peer = dp_peer_find_by_id(pdev->soc, peer_id);
-
 		if (peer) {
 			ppdu_desc->vdev_id = peer->vdev->vdev_id;
 			qdf_mem_copy(ppdu_user_desc->mac_addr,
 				     peer->mac_addr.raw,
 				     QDF_MAC_ADDR_SIZE);
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 		}
 	}
 
@@ -2558,7 +2557,7 @@ static void dp_process_ppdu_stats_enq_mpdu_bitmap_64_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	ppdu_user_desc->peer_id = peer_id;
 
@@ -2604,6 +2603,7 @@ static void dp_process_ppdu_stats_enq_mpdu_bitmap_256_tlv(
 	HTT_PPDU_STATS_ENQ_MPDU_BITMAP_TLV_SW_PEER_ID_GET(*tag_buf);
 
 	peer = dp_peer_find_by_id(pdev->soc, peer_id);
+
 	curr_user_index = dp_get_ppdu_info_user_index(pdev, peer_id, ppdu_info);
 	ppdu_user_desc = &ppdu_desc->user[curr_user_index];
 	ppdu_user_desc->tlv_bitmap |= (1 << tlv_type);
@@ -2611,7 +2611,7 @@ static void dp_process_ppdu_stats_enq_mpdu_bitmap_256_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	ppdu_user_desc->peer_id = peer_id;
 
@@ -2662,7 +2662,7 @@ static void dp_process_ppdu_stats_user_cmpltn_common_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	ppdu_user_desc->peer_id = peer_id;
 
@@ -2792,7 +2792,7 @@ static void dp_process_ppdu_stats_user_compltn_ba_bitmap_64_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	ppdu_user_desc->peer_id = peer_id;
 
@@ -2839,7 +2839,7 @@ static void dp_process_ppdu_stats_user_compltn_ba_bitmap_256_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	ppdu_user_desc->peer_id = peer_id;
 
@@ -2883,13 +2883,12 @@ static void dp_process_ppdu_stats_user_compltn_ack_ba_status_tlv(
 		ppdu_desc->vdev_id = peer->vdev->vdev_id;
 		qdf_mem_copy(ppdu_user_desc->mac_addr,
 			     peer->mac_addr.raw, QDF_MAC_ADDR_SIZE);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	if (!ppdu_user_desc->ack_ba_tlv) {
 		ppdu_user_desc->ack_ba_tlv = 1;
 	} else {
 		pdev->stats.ack_ba_comes_twice++;
-		dp_peer_unref_del_find_by_id(peer);
 		return;
 	}
 
@@ -3029,7 +3028,7 @@ dp_process_ppdu_stats_user_compltn_flush_tlv(struct dp_pdev *pdev,
 			     ppdu_desc->num_msdu);
 	}
 
-	dp_peer_unref_del_find_by_id(peer);
+	dp_peer_unref_delete(peer);
 
 add_ppdu_to_sched_list:
 	ppdu_info->done = 1;
@@ -3111,7 +3110,7 @@ dp_process_ppdu_stats_sch_cmd_status_tlv(struct dp_pdev *pdev,
 			ppdu_desc->user[i].peer_last_delayed_ba =
 				peer->last_delayed_ba;
 
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 
 			if (ppdu_desc->user[i].delayed_ba &&
 			    !ppdu_desc->user[i].debug_copied) {
@@ -3149,7 +3148,7 @@ dp_process_ppdu_stats_sch_cmd_status_tlv(struct dp_pdev *pdev,
 
 			if (ppdu_desc->user[i].completion_status !=
 			    HTT_PPDU_STATS_USER_STATUS_OK) {
-				dp_peer_unref_del_find_by_id(peer);
+				dp_peer_unref_delete(peer);
 				continue;
 			}
 
@@ -3167,7 +3166,7 @@ dp_process_ppdu_stats_sch_cmd_status_tlv(struct dp_pdev *pdev,
 			}
 			ppdu_desc->user[i].peer_last_delayed_ba =
 				peer->last_delayed_ba;
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 		}
 	}
 
@@ -4578,7 +4577,7 @@ static void dp_htt_t2h_msg_handler(void *context, HTC_PACKET *pkt)
 				 * If PEER_LOCK_REF_PROTECT enbled dec ref
 				 * which is inc by dp_peer_find_by_id
 				 */
-				dp_peer_unref_del_find_by_id(peer);
+				dp_peer_unref_delete(peer);
 
 				QDF_TRACE(QDF_MODULE_ID_TXRX,
 					QDF_TRACE_LEVEL_INFO,
@@ -5275,7 +5274,7 @@ dp_peer_update_inactive_time(struct dp_pdev *pdev, uint32_t tag_type,
 			qdf_event_set(&pdev->fw_peer_stats_event);
 		}
 		if (peer)
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 	}
 	break;
 	default:

dp/wifi3.0/dp_internal.h

@@ -1758,24 +1758,6 @@ int dp_tx_delete_flow_pool(struct dp_soc *soc, struct dp_tx_desc_pool_s *pool,
 	bool force);
 #endif /* QCA_LL_TX_FLOW_CONTROL_V2 */
 
-#ifdef PEER_PROTECTED_ACCESS
-/**
- * dp_peer_unref_del_find_by_id() - dec ref and del peer if ref count is
- *                                  taken by dp_peer_find_by_id
- * @peer: peer context
- *
- * Return: none
- */
-static inline void dp_peer_unref_del_find_by_id(struct dp_peer *peer)
-{
-	dp_peer_unref_delete(peer);
-}
-#else
-static inline void dp_peer_unref_del_find_by_id(struct dp_peer *peer)
-{
-}
-#endif
-
 #ifdef WLAN_FEATURE_DP_EVENT_HISTORY
 /**
  * dp_srng_access_start() - Wrapper function to log access start of a hal ring

dp/wifi3.0/dp_main.c

@@ -4366,6 +4366,8 @@ static void dp_soc_deinit(void *txrx_soc)
 	dp_soc_srng_deinit(soc);
 
 	dp_hw_link_desc_ring_deinit(soc);
+	QDF_ASSERT(TAILQ_EMPTY(&soc->inactive_peer_list));
+	qdf_spinlock_destroy(&soc->inactive_peer_list_lock);
 
 	htt_soc_htc_dealloc(soc->htt_handle);
 
@@ -6163,6 +6165,8 @@ void dp_peer_unref_delete(struct dp_peer *peer)
 	struct dp_soc *soc = pdev->soc;
 	uint16_t peer_id;
 	struct cdp_peer_cookie peer_cookie;
+	struct dp_peer *tmp_peer;
+	bool found = false;
 
 	/*
 	 * Hold the lock all the way from checking if the peer ref count
@@ -6207,6 +6211,20 @@ void dp_peer_unref_delete(struct dp_peer *peer)
 #endif
 		peer->wlanstats_ctx = NULL;
 		wlan_minidump_remove(peer);
+
+		qdf_spin_lock_bh(&soc->inactive_peer_list_lock);
+		TAILQ_FOREACH(tmp_peer, &soc->inactive_peer_list,
+			      inactive_list_elem) {
+			if (tmp_peer == peer) {
+				found = 1;
+				break;
+			}
+		}
+		if (found)
+			TAILQ_REMOVE(&soc->inactive_peer_list, peer,
+				     inactive_list_elem);
+		/* delete this peer from the list */
+		qdf_spin_unlock_bh(&soc->inactive_peer_list_lock);
 		/*
 		 * Peer AST list hast to be empty here
 		 */
@@ -6550,7 +6568,7 @@ static QDF_STATUS dp_get_peer_mac_from_peer_id(struct cdp_soc_t *soc,
 		if (peer) {
 			qdf_mem_copy(peer_mac, peer->mac_addr.raw,
 				     QDF_MAC_ADDR_SIZE);
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 			return QDF_STATUS_SUCCESS;
 		}
 	}
@@ -11096,6 +11114,8 @@ void *dp_soc_init(struct dp_soc *soc, HTC_HANDLE htc_handle,
 	/* fill the tx/rx cpu ring map*/
 	dp_soc_set_txrx_ring_map(soc);
 
+	TAILQ_INIT(&soc->inactive_peer_list);
+	qdf_spinlock_create(&soc->inactive_peer_list_lock);
 	qdf_spinlock_create(&soc->htt_stats.lock);
 	/* initialize work queue for stats processing */
 	qdf_create_work(0, &soc->htt_stats.work, htt_t2h_stats_handler, soc);

dp/wifi3.0/dp_peer.c

@@ -1937,7 +1937,8 @@ dp_rx_peer_map_handler(struct dp_soc *soc, uint16_t peer_id,
 
 		err = dp_peer_map_ast(soc, peer, peer_mac_addr, hw_peer_id,
 				      vdev_id, ast_hash, is_wds);
-
+		if (peer)
+			dp_peer_unref_delete(peer);
 	} else {
 		/*
 		 * It's the responsibility of the CP and FW to ensure
@@ -2020,15 +2021,17 @@ dp_rx_peer_unmap_handler(struct dp_soc *soc, uint16_t peer_id,
 	 * in peer_id_to_obj_map will be NULL.
 	 */
 	if (!peer) {
-		dp_err("Received unmap event for invalid peer_id %u", peer_id);
+		dp_err("Received unmap event for invalid peer_id %u",
+		       peer_id);
 		return;
 	}
 
 	/* If V2 Peer map messages are enabled AST entry has to be freed here
 	 */
 	if (is_wds) {
-		if (!dp_peer_ast_free_entry_by_mac(soc, peer, mac_addr))
+		if (!dp_peer_ast_free_entry_by_mac(soc, peer, mac_addr)) {
 			return;
+		}
 
 		dp_alert("AST entry not found with peer %pK peer_id %u peer_mac %pM mac_addr %pM vdev_id %u next_hop %u",
 			 peer, peer->peer_id,
@@ -2061,6 +2064,9 @@ dp_rx_peer_unmap_handler(struct dp_soc *soc, uint16_t peer_id,
 	dp_peer_cleanup(vdev, peer);
 	DP_UPDATE_STATS(vdev, peer);
 
+	qdf_spin_lock_bh(&soc->inactive_peer_list_lock);
+	TAILQ_INSERT_TAIL(&soc->inactive_peer_list, peer, inactive_list_elem);
+	qdf_spin_unlock_bh(&soc->inactive_peer_list_lock);
 	/*
 	 * Remove a reference to the peer.
 	 * If there are no more references, delete the peer object.
@@ -3662,7 +3668,7 @@ dp_rx_sec_ind_handler(struct dp_soc *soc, uint16_t peer_id,
 	 * is available
 	 */
 
-	dp_peer_unref_del_find_by_id(peer);
+	dp_peer_unref_delete(peer);
 }
 
 #ifdef QCA_PEER_EXT_STATS
@@ -3798,7 +3804,7 @@ dp_rx_delba_ind_handler(void *soc_handle, uint16_t peer_id,
 		status = QDF_STATUS_E_FAILURE;
 	}
 
-	dp_peer_unref_del_find_by_id(peer);
+	dp_peer_unref_delete(peer);
 
 	return status;
 }
@@ -4245,7 +4251,7 @@ bool dp_peer_find_by_id_valid(struct dp_soc *soc, uint16_t peer_id)
 		 * Decrement the peer ref which is taken as part of
 		 * dp_peer_find_by_id if PEER_LOCK_REF_PROTECT is enabled
 		 */
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 		return true;
 	}

dp/wifi3.0/dp_peer.h

@@ -56,7 +56,6 @@ __dp_peer_find_by_id(struct dp_soc *soc,
 	return peer;
 }
 
-#ifdef PEER_PROTECTED_ACCESS
 /**
  * dp_peer_find_by_id() - Returns peer object given the peer id
  *                        if delete_in_progress in not set for peer
@@ -83,21 +82,6 @@ struct dp_peer *dp_peer_find_by_id(struct dp_soc *soc,
 
 	return peer;
 }
-#else
-static inline struct dp_peer *
-dp_peer_find_by_id(struct dp_soc *soc,
-		   uint16_t peer_id)
-{
-	struct dp_peer *peer;
-
-	peer = __dp_peer_find_by_id (soc, peer_id);
-	if (peer && peer->delete_in_progress) {
-		return NULL;
-	}
-
-	return peer;
-}
-#endif /* PEER_LOCK_REF_PROTECT */
 
 #ifdef PEER_CACHE_RX_PKTS
 /**

dp/wifi3.0/dp_rx.c

@@ -2483,7 +2483,7 @@ done:
 		if (qdf_unlikely(!peer)) {
 			peer = dp_peer_find_by_id(soc, peer_id);
 		} else if (peer && peer->peer_id != peer_id) {
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 			peer = dp_peer_find_by_id(soc, peer_id);
 		}
 
@@ -2754,7 +2754,7 @@ done:
 	}
 
 	if (qdf_likely(peer))
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 	if (dp_rx_enable_eol_data_check(soc) && rx_bufs_used) {
 		if (quota) {

dp/wifi3.0/dp_rx_defrag.c

@@ -220,7 +220,7 @@ void dp_rx_defrag_waitlist_flush(struct dp_soc *soc)
 		}
 
 		if (temp_peer)
-			dp_peer_unref_del_find_by_id(temp_peer);
+			dp_peer_unref_delete(temp_peer);
 
 	}
 }
@@ -1779,7 +1779,7 @@ dp_rx_defrag_store_fragment(struct dp_soc *soc,
 			now_ms + pdev->soc->rx.defrag.timeout_ms;
 
 		dp_rx_defrag_waitlist_add(peer, tid);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 		return QDF_STATUS_SUCCESS;
 	}
@@ -1825,7 +1825,7 @@ dp_rx_defrag_store_fragment(struct dp_soc *soc,
 
 	dp_rx_defrag_cleanup(peer, tid);
 
-	dp_peer_unref_del_find_by_id(peer);
+	dp_peer_unref_delete(peer);
 
 	return QDF_STATUS_SUCCESS;
 
@@ -1842,7 +1842,7 @@ err_free_desc:
 
 end:
 	if (peer)
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 	DP_STATS_INC(soc, rx.rx_frag_err, 1);
 	return QDF_STATUS_E_DEFRAG_ERROR;

dp/wifi3.0/dp_rx_err.c

@@ -405,7 +405,7 @@ dp_rx_pn_error_handle(struct dp_soc *soc, hal_ring_desc_t ring_desc,
 			"discard rx due to PN error for peer  %pK  %pM",
 			peer, peer->mac_addr.raw);
 
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 	}
 	QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
 		"Packet received with PN error");
@@ -451,13 +451,13 @@ dp_rx_oor_handle(struct dp_soc *soc,
 	if (dp_rx_deliver_special_frame(soc, peer, nbuf, frame_mask,
 					rx_tlv_hdr)) {
 		DP_STATS_INC(soc, rx.err.reo_err_oor_to_stack, 1);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 		return;
 	}
 
 free_nbuf:
 	if (peer)
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 	DP_STATS_INC(soc, rx.err.reo_err_oor_drop, 1);
 	qdf_nbuf_free(nbuf);
@@ -791,7 +791,8 @@ dp_2k_jump_handle(struct dp_soc *soc,
 
 	peer = dp_peer_find_by_id(soc, peer_id);
 	if (!peer) {
-		dp_info_rl("peer not found");
+		QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+			  "peer not found");
 		goto free_nbuf;
 	}
 
@@ -832,13 +833,13 @@ nbuf_deliver:
 	if (dp_rx_deliver_special_frame(soc, peer, nbuf, frame_mask,
 					rx_tlv_hdr)) {
 		DP_STATS_INC(soc, rx.err.rx_2k_jump_to_stack, 1);
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 		return;
 	}
 
 free_nbuf:
 	if (peer)
-		dp_peer_unref_del_find_by_id(peer);
+		dp_peer_unref_delete(peer);
 
 	DP_STATS_INC(soc, rx.err.rx_2k_jump_drop, 1);
 	qdf_nbuf_free(nbuf);
@@ -2039,6 +2040,8 @@ done:
 			qdf_nbuf_free(nbuf);
 			dp_info_rl("scattered msdu dropped");
 			nbuf = next;
+			if (peer)
+				dp_peer_unref_delete(peer);
 			continue;
 		}
 
@@ -2066,11 +2069,7 @@ done:
 					dp_rx_null_q_desc_handle(soc, nbuf,
 								 rx_tlv_hdr,
 								 pool_id, peer);
-					nbuf = next;
-					if (peer)
-						dp_peer_unref_del_find_by_id(
-									peer);
-					continue;
+					break;
 				/* TODO */
 				/* Add per error code accounting */
 				case HAL_REO_ERR_REGULAR_FRAME_2K_JUMP:
@@ -2091,23 +2090,20 @@ done:
 					dp_2k_jump_handle(soc, nbuf,
 							  rx_tlv_hdr,
 							  peer_id, tid);
-					nbuf = next;
-					if (peer)
-						dp_peer_unref_del_find_by_id(
-									peer);
-					continue;
+					break;
 				case HAL_REO_ERR_BAR_FRAME_2K_JUMP:
 				case HAL_REO_ERR_BAR_FRAME_OOR:
 					if (peer)
 						dp_rx_wbm_err_handle_bar(soc,
 									 peer,
 									 nbuf);
+					qdf_nbuf_free(nbuf);
 					break;
 
 				default:
 					dp_info_rl("Got pkt with REO ERROR: %d",
 						   wbm_err_info.reo_err_code);
-					break;
+					qdf_nbuf_free(nbuf);
 				}
 			}
 		} else if (wbm_err_info.wbm_err_src ==
@@ -2135,33 +2131,29 @@ done:
 								wbm_err_info.
 								rxdma_err_code,
 								pool_id);
-					nbuf = next;
-					if (peer)
-						dp_peer_unref_del_find_by_id(peer);
-					continue;
+					break;
 
 				case HAL_RXDMA_ERR_TKIP_MIC:
 					dp_rx_process_mic_error(soc, nbuf,
 								rx_tlv_hdr,
 								peer);
-					nbuf = next;
-					if (peer) {
+					if (peer)
 						DP_STATS_INC(peer, rx.err.mic_err, 1);
-						dp_peer_unref_del_find_by_id(
-									peer);
-					}
-					continue;
+					break;
 
 				case HAL_RXDMA_ERR_DECRYPT:
 
 					if (peer) {
 						DP_STATS_INC(peer, rx.err.
 							     decrypt_err, 1);
+						qdf_nbuf_free(nbuf);
 						break;
 					}
 
-					if (!dp_handle_rxdma_decrypt_err())
+					if (!dp_handle_rxdma_decrypt_err()) {
+						qdf_nbuf_free(nbuf);
 						break;
+					}
 
 					pool_id = wbm_err_info.pool_id;
 					err_code = wbm_err_info.rxdma_err_code;
@@ -2170,10 +2162,10 @@ done:
 								tlv_hdr, NULL,
 								err_code,
 								pool_id);
-					nbuf = next;
-					continue;
+					break;
 
 				default:
+					qdf_nbuf_free(nbuf);
 					dp_err_rl("RXDMA error %d",
 						  wbm_err_info.rxdma_err_code);
 				}
@@ -2184,11 +2176,8 @@ done:
 		}
 
 		if (peer)
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 
-		hal_rx_dump_pkt_tlvs(hal_soc, rx_tlv_hdr,
-				     QDF_TRACE_LEVEL_DEBUG);
-		qdf_nbuf_free(nbuf);
 		nbuf = next;
 	}
 	return rx_bufs_used; /* Assume no scale factor for now */

dp/wifi3.0/dp_tx.c

@@ -3680,7 +3680,7 @@ dp_tx_comp_process_desc_list(struct dp_soc *soc,
 						HAL_TX_TQM_RR_FRAME_ACKED)
 					peer->stats.tx.tx_failed++;
 
-				dp_peer_unref_del_find_by_id(peer);
+				dp_peer_unref_delete(peer);
 			}
 
 			qdf_assert(pdev);
@@ -3712,7 +3712,7 @@ dp_tx_comp_process_desc_list(struct dp_soc *soc,
 		dp_tx_comp_process_desc(soc, desc, &ts, peer);
 
 		if (peer)
-			dp_peer_unref_del_find_by_id(peer);
+			dp_peer_unref_delete(peer);
 
 		next = desc->next;
 
@@ -3821,13 +3821,14 @@ void dp_tx_process_htt_completion(struct dp_tx_desc_s *tx_desc, uint8_t *status,
 		}
 
 		peer = dp_peer_find_by_id(soc, ts.peer_id);
-		if (qdf_likely(peer))
-			dp_peer_unref_del_find_by_id(peer);
 
 		dp_tx_comp_process_tx_status(soc, tx_desc, &ts, peer, ring_id);
 		dp_tx_comp_process_desc(soc, tx_desc, &ts, peer);
 		dp_tx_desc_release(tx_desc, tx_desc->pool_id);
 
+		if (qdf_likely(peer))
+			dp_peer_unref_delete(peer);
+
 		break;
 	}
 	case HTT_TX_FW2WBM_TX_STATUS_REINJECT:

dp/wifi3.0/dp_types.h

@@ -1462,6 +1462,8 @@ struct dp_soc {
 	struct rx_buff_pool rx_buff_pool[MAX_PDEV_CNT];
 	/* Save recent operation related variable */
 	struct dp_last_op_info last_op_info;
+	TAILQ_HEAD(, dp_peer) inactive_peer_list;
+	qdf_spinlock_t inactive_peer_list_lock;
 };
 
 #ifdef IPA_OFFLOAD
@@ -2458,6 +2460,8 @@ struct dp_peer {
 #ifdef QCA_PEER_MULTIQ_SUPPORT
 	struct dp_peer_ast_params peer_ast_flowq_idx[DP_PEER_AST_FLOWQ_MAX];
 #endif
+	/* entry to inactive_list*/
+	TAILQ_ENTRY(dp_peer) inactive_list_elem;
 };
 
 /*