qcacmn: flushing reo command list before freeing pdev

In dp_soc_dettach flush the reo command list before freeing
pdev to avoid use after free of pdev memory in reo command
callbacks

Change-Id: I2644b259ed9b10dee9b11007ed9064dd7d2399a9

dp/wifi3.0/dp_main.c

@@ -3261,6 +3261,8 @@ static void dp_soc_detach_wifi3(void *txrx_soc)
 	/* Free pending htt stats messages */
 	qdf_nbuf_queue_free(&soc->htt_stats.msg);
 
+	dp_reo_cmdlist_destroy(soc);
+
 	for (i = 0; i < MAX_PDEV_CNT; i++) {
 		if (soc->pdev_list[i])
 			dp_pdev_detach_wifi3(
@@ -3328,7 +3330,6 @@ static void dp_soc_detach_wifi3(void *txrx_soc)
 
 	qdf_spinlock_destroy(&soc->rx.defrag.defrag_lock);
 
-	dp_reo_cmdlist_destroy(soc);
 	qdf_spinlock_destroy(&soc->rx.reo_cmd_lock);
 	dp_reo_desc_freelist_destroy(soc);
 
@@ -5238,6 +5239,9 @@ void dp_rx_bar_stats_cb(struct dp_soc *soc, void *cb_ctxt,
 	struct dp_pdev *pdev = (struct dp_pdev *)cb_ctxt;
 	struct hal_reo_queue_status *queue_status = &(reo_status->queue_status);
 
+	if (!qdf_atomic_read(&soc->cmn_init_done))
+		return;
+
 	if (queue_status->header.status != HAL_REO_CMD_SUCCESS) {
 		DP_TRACE_STATS(FATAL, "REO stats failure %d \n",
 			queue_status->header.status);