qcacmn: Decrease the peer ref count after use

Decrease the ref count for peer when peer is no longer
needed in case of mgmt tx and rx frame handling.

Change-Id: I1e0599271a05add0a2e6f06d3809a1d2e54732e3
CRs-Fixed: 1103247

umac/cmn_services/mgmt_txrx/core/src/wlan_mgmt_txrx_main.c

@@ -48,7 +48,7 @@ QDF_STATUS wlan_mgmt_txrx_desc_pool_init(
 	}
 	qdf_list_create(&mgmt_txrx_ctx->mgmt_desc_pool.free_list, pool_size);
 
-	for (i = 0; i < (pool_size - 1); i++) {
+	for (i = 0; i < pool_size; i++) {
 		mgmt_txrx_ctx->mgmt_desc_pool.pool[i].desc_id = i;
 		mgmt_txrx_ctx->mgmt_desc_pool.pool[i].in_use = false;
 		qdf_list_insert_front(&mgmt_txrx_ctx->mgmt_desc_pool.free_list,
@@ -68,17 +68,14 @@ void wlan_mgmt_txrx_desc_pool_deinit(
 	uint32_t pool_size;
 	QDF_STATUS status;
 
-	qdf_spin_lock_bh(&mgmt_txrx_ctx->mgmt_desc_pool.desc_pool_lock);
 	if (!mgmt_txrx_ctx->mgmt_desc_pool.pool) {
-		qdf_spin_unlock_bh(
-			&mgmt_txrx_ctx->mgmt_desc_pool.desc_pool_lock);
 		mgmt_txrx_err("Empty mgmt descriptor pool");
 		qdf_assert_always(0);
 		return;
 	}
 
 	pool_size = mgmt_txrx_ctx->mgmt_desc_pool.free_list.max_size;
-	for (i = 0; i < (pool_size - 1); i++) {
+	for (i = 0; i < pool_size; i++) {
 		status = qdf_list_remove_node(
 				&mgmt_txrx_ctx->mgmt_desc_pool.free_list,
 				&mgmt_txrx_ctx->mgmt_desc_pool.pool[i].entry);
@@ -91,8 +88,6 @@ void wlan_mgmt_txrx_desc_pool_deinit(
 	qdf_mem_free(mgmt_txrx_ctx->mgmt_desc_pool.pool);
 	mgmt_txrx_ctx->mgmt_desc_pool.pool = NULL;
 
-	qdf_spin_unlock_bh(
-		&mgmt_txrx_ctx->mgmt_desc_pool.desc_pool_lock);
 	qdf_spinlock_destroy(
 		&mgmt_txrx_ctx->mgmt_desc_pool.desc_pool_lock);
 }

umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c

@@ -26,6 +26,7 @@
 #include "wlan_mgmt_txrx_utils_api.h"
 #include "wlan_mgmt_txrx_main_i.h"
 #include "wlan_objmgr_psoc_obj.h"
+#include "wlan_objmgr_peer_obj.h"
 
 
 /**
@@ -806,7 +807,8 @@ QDF_STATUS tgt_mgmt_txrx_rx_frame_handler(
 		mgmt_txrx_err("Rx event doesn't conatin a mgmt. packet, %d",
 			mgmt_type);
 		qdf_nbuf_free(buf);
-		return QDF_STATUS_E_FAILURE;
+		status = QDF_STATUS_E_FAILURE;
+		goto dec_peer_ref_cnt;
 	}
 
 	/* mpdu_data_ptr is pointer to action header */
@@ -816,7 +818,8 @@ QDF_STATUS tgt_mgmt_txrx_rx_frame_handler(
 	if (frm_type == MGMT_FRM_UNSPECIFIED) {
 		mgmt_txrx_err("Unspecified mgmt frame type");
 		qdf_nbuf_free(buf);
-		return QDF_STATUS_E_FAILURE;
+		status = QDF_STATUS_E_FAILURE;
+		goto dec_peer_ref_cnt;
 	}
 
 	mgmt_txrx_info("Rcvd mgmt frame, mgmt txrx frm type: %u, seq. no.: %u, peer: %p",
@@ -832,7 +835,8 @@ QDF_STATUS tgt_mgmt_txrx_rx_frame_handler(
 		mgmt_txrx_info("No rx callback registered for frm_type: %d",
 			frm_type);
 		qdf_nbuf_free(buf);
-		return QDF_STATUS_E_FAILURE;
+		status = QDF_STATUS_E_FAILURE;
+		goto dec_peer_ref_cnt;
 	}
 
 	while (rx_handler) {
@@ -876,6 +880,10 @@ rx_handler_mem_free:
 		rx_handler_head = rx_handler_head->next;
 		qdf_mem_free(rx_handler);
 	}
+dec_peer_ref_cnt:
+	if (peer)
+		wlan_objmgr_peer_unref_peer(peer);
+
 	return status;
 }
 
@@ -941,6 +949,12 @@ QDF_STATUS tgt_mgmt_txrx_tx_completion_handler(
 		ota_comp_cb(cb_context, nbuf, status, tx_compl_params);
 
 no_registered_cb:
+	/**
+	 * decremneting the peer ref count that has been incremented while
+	 * passing peer in wlan_mgmt_txrx_mgmt_frame_tx or
+	 * wlan_mgmt_txrx_beacon_frame_tx APIs.
+	 */
+	wlan_objmgr_peer_unref_peer(mgmt_desc->peer);
 	wlan_mgmt_txrx_desc_put(mgmt_txrx_ctx, desc_id);
 	return QDF_STATUS_SUCCESS;
 }