qcacld-3.0: Fix double free of skb in case of send failure for TSO

In case of TSO, same buffer results in multiple tx_desc after
segmentations. To avoid multiple free of skb ref_cnt is used.
Currently ref_cnt is incremented twice for 1st segment and
not incremented for last segment and in case of failure from
ce_send_fast, ref_cnt is decremented twice.

Above logic don't work in case when TSO packet with segment
count is 1 and ce_send_fast failure is observed.
So, Change logic to increment ref_cnt only once for 1st segment
and avoid reducing ref_cnt twice in case of ce_send_fast failure.

Change-Id: Ia85a6a8f905310b210d6f480a004feb2528a31d7
CRs-Fixed: 2469773

core/dp/txrx/ol_tx_desc.c

@@ -966,10 +966,6 @@ void ol_tx_desc_frame_free_nonstd(struct ol_txrx_pdev_t *pdev,
 		}
 	} else if (had_error == htt_tx_status_download_fail) {
 		/* Failed to send to target */
-
-		/* This is to decrement skb->users count for TSO segment */
-		if (tx_desc->pkt_type == OL_TX_FRM_TSO)
-			qdf_nbuf_tx_free(tx_desc->netbuf, had_error);
 		goto free_tx_desc;
 	} else {
 		/* single regular frame, called from completion path */

core/dp/txrx/ol_tx_ll_fastpath.c

@@ -429,7 +429,8 @@ ol_tx_ll_fast(ol_txrx_vdev_handle vdev, qdf_nbuf_t msdu_list)
 				 * the skb is freed only after receiving tx
 				 * completion for all segments of an nbuf.
 				 */
-				if (segments)
+				if (segments !=
+					(msdu_info.tso_info.num_segs - 1))
 					qdf_nbuf_inc_users(msdu);
 
 				ol_tx_trace_pkt(msdu, tx_desc->id,