qcacld-3.0: Stop TDLS peer_discovery_timer

For MLO TDLS, the discovery request frame is sent on
different links and peer_discovery_timer is started to
receive the discovery response frames from different
links.

One race condition is: the timer is running and then
vdev destroy happens. Then the timer callback could not
get the right pointer when timer is triggered.

To resolve this issue, stop the timer in the function
tdls_vdev_obj_destroy_notification.

Change-Id: I0b7aff14a599229cb5848b0b7eb9d2af53e6ad94
CRs-Fixed: 3554466

components/tdls/core/src/wlan_tdls_ct.c

@@ -105,6 +105,9 @@ void tdls_discovery_timeout_peer_cb(void *user_data)
 
 	vdev = (struct wlan_objmgr_vdev *)user_data;
 	tdls_soc = wlan_vdev_get_tdls_soc_obj(vdev);
+	if (!tdls_soc)
+		return;
+
 	if (wlan_vdev_mlme_is_mlo_vdev(vdev) &&
 	    qdf_atomic_dec_and_test(&tdls_soc->timer_cnt)) {
 		tdls_process_mlo_cal_tdls_link_score(vdev);
@@ -144,6 +147,9 @@ void tdls_discovery_timeout_peer_cb(void *user_data)
 	}
 
 	tdls_vdev = wlan_vdev_get_tdls_vdev_obj(vdev);
+	if (!tdls_vdev)
+		return;
+
 	for (i = 0; i < WLAN_TDLS_PEER_LIST_SIZE; i++) {
 		head = &tdls_vdev->peer_list[i];
 		status = qdf_list_peek_front(head, &p_node);

components/tdls/core/src/wlan_tdls_main.c

@@ -346,6 +346,13 @@ QDF_STATUS tdls_vdev_obj_destroy_notification(struct wlan_objmgr_vdev *vdev,
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	if (wlan_vdev_mlme_is_mlo_vdev(vdev)) {
+		if (QDF_TIMER_STATE_STOPPED !=
+		    qdf_mc_timer_get_current_state(
+					&tdls_vdev_obj->peer_discovery_timer))
+			qdf_mc_timer_stop(&tdls_vdev_obj->peer_discovery_timer);
+	}
+
 	qdf_event_destroy(&tdls_vdev_obj->tdls_teardown_comp);
 	tdls_vdev_deinit(tdls_vdev_obj);