qcacld-3.0: Fix memory leaks in driver

Fix memory leak:
1) during driver shutdown as netbufs associated with
   outstanding descriptors at the time of driver shutdown
   are not getting freed.
2) in ol_tx_ll_fast where in case packet fails to download,
   descriptor is being freed but the netbuf associated with
   it is not getting freed.

Change-Id: I6c3eaf551149078f1ecd1329d5f3fe8ab36c2f34
CRs-Fixed: 1081206
(cherry picked from commit 2e5ea6c3489e8ef40e07c45d0f8e244bbd6bee7f)

core/dp/txrx/ol_tx.c

@@ -625,7 +625,8 @@ ol_tx_ll_fast(ol_txrx_vdev_handle vdev, qdf_nbuf_t msdu_list)
 					 * Free the descriptor, return the
 					 * packet to the caller.
 					 */
-					ol_tx_desc_free(pdev, tx_desc);
+					ol_tx_desc_frame_free_nonstd(pdev,
+								tx_desc, 1);
 					return msdu;
 				}
 				if (msdu_info.tso_info.curr_seg) {

core/dp/txrx/ol_tx_desc.c

@@ -171,6 +171,7 @@ struct ol_tx_desc_t *ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev,
 
 	ol_tx_desc_vdev_update(tx_desc, vdev);
 	ol_tx_desc_count_inc(vdev);
+	qdf_atomic_inc(&tx_desc->ref_cnt);
 
 	return tx_desc;
 }
@@ -225,6 +226,7 @@ struct ol_tx_desc_t *ol_tx_desc_alloc(struct ol_txrx_pdev_t *pdev,
 			ol_tx_desc_sanity_checks(pdev, tx_desc);
 			ol_tx_desc_compute_delay(tx_desc);
 			ol_tx_desc_vdev_update(tx_desc, vdev);
+			qdf_atomic_inc(&tx_desc->ref_cnt);
 		} else {
 			pool->pkt_drop_no_desc++;
 			qdf_spin_unlock_bh(&pool->flow_pool_lock);

core/dp/txrx/ol_txrx.c

@@ -1633,10 +1633,8 @@ void ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
 		ol_txrx_peer_find_hash_erase(pdev);
 	}
 
-	htt_deregister_rx_pkt_dump_callback(pdev->htt_pdev);
-	ol_tx_deregister_flow_control(pdev);
-	/* Stop the communication between HTT and target at first */
-	htt_detach_target(pdev->htt_pdev);
+	/* to get flow pool status before freeing descs */
+	ol_tx_dump_flow_pool_info();
 
 	for (i = 0; i < pdev->tx_desc.pool_size; i++) {
 		void *htt_tx_desc;
@@ -1660,6 +1658,11 @@ void ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
 		htt_tx_desc_free(pdev->htt_pdev, htt_tx_desc);
 	}
 
+	htt_deregister_rx_pkt_dump_callback(pdev->htt_pdev);
+	ol_tx_deregister_flow_control(pdev);
+	/* Stop the communication between HTT and target at first */
+	htt_detach_target(pdev->htt_pdev);
+
 	qdf_mem_multi_pages_free(pdev->osdev,
 		&pdev->tx_desc.desc_pages, 0, true);
 	pdev->tx_desc.freelist = NULL;