qcacmn: Free every nbuf in the list before reset the list

nbuf is queued to head_nbuf in dp_rx_reo_err_entry_process. Before
reset head_nbuf, free all the nbuf queued to head_nbuf. Otherwise
there is nbuf memory leak.

Change-Id: Ib4bd64b51d750dac972298ddc46acd4294f2ed81
CRs-Fixed: 3449992

dp/wifi3.0/dp_rx_err.c

@@ -1032,6 +1032,7 @@ dp_rx_reo_err_entry_process(struct dp_soc *soc,
 	struct dp_rx_desc *rx_desc;
 	struct rx_desc_pool *rx_desc_pool;
 	qdf_nbuf_t nbuf;
+	qdf_nbuf_t next_nbuf;
 	struct hal_buf_info buf_info;
 	struct hal_rx_msdu_list msdu_list;
 	uint16_t num_msdus;
@@ -1123,6 +1124,7 @@ more_msdu_link_desc:
 					     rx_desc_pool_id)) {
 			/* MSDU queued back to the pool */
 			msdu_dropped = true;
+			head_nbuf = NULL;
 			goto process_next_msdu;
 		}
 
@@ -1147,9 +1149,8 @@ more_msdu_link_desc:
 					/*
 					 * We do not have valid mpdu_desc_info
 					 * to process this nbuf, hence drop it.
+					 * TODO - Increment stats
 					 */
-					dp_rx_nbuf_free(nbuf);
-					/* TODO - Increment stats */
 					goto process_next_msdu;
 				}
 				/*
@@ -1164,7 +1165,6 @@ more_msdu_link_desc:
 			if (QDF_IS_STATUS_ERROR(status)) {
 				DP_STATS_INC(soc, rx.err.pn_in_dest_check_fail,
 					     1);
-				dp_rx_nbuf_free(nbuf);
 				goto process_next_msdu;
 			}
 
@@ -1195,6 +1195,7 @@ more_msdu_link_desc:
 			qdf_nbuf_set_is_frag(nbuf, 1);
 			DP_STATS_INC(soc, rx.err.reo_err_oor_sg_count, 1);
 		}
+		head_nbuf = NULL;
 
 		switch (err_code) {
 		case HAL_REO_ERR_REGULAR_FRAME_2K_JUMP:
@@ -1241,6 +1242,12 @@ more_msdu_link_desc:
 		}
 
 process_next_msdu:
+		nbuf = head_nbuf;
+		while (nbuf) {
+			next_nbuf = qdf_nbuf_next(nbuf);
+			dp_rx_nbuf_free(nbuf);
+			nbuf = next_nbuf;
+		}
 		msdu_processed++;
 		head_nbuf = NULL;
 		tail_nbuf = NULL;