qcacld-3.0: Release vdev ref count for TDLS

The vdev ref count does not release properly for
WLAN_OSIF_TDLS_ID, it causes driver crash when
rmmod wifi module.

To address this issue, release the vdev ref count
properly for TDLS module.

Change-Id: I9c206f212ff5ba5a362c91d32519bc7903cbec3d
CRs-Fixed: 3470275

core/hdd/src/wlan_hdd_cfg80211.c

@@ -21712,6 +21712,9 @@ static int wlan_hdd_add_key_mlo_vdev(mac_handle_t mac_handle,
 		return errno;
 	}
 
+	if (link_vdev)
+		ucfg_tdls_put_tdls_link_vdev(link_vdev, WLAN_OSIF_TDLS_ID);
+
 	if (wlan_vdev_get_link_id(adapter->deflink->vdev) == link_id) {
 		hdd_debug("add_key for same vdev: %d",
 			  adapter->deflink->vdev_id);

os_if/tdls/src/wlan_cfg80211_tdls.c

@@ -1219,6 +1219,10 @@ wlan_cfg80211_tdls_mgmt_mlo(struct hdd_adapter *adapter, const uint8_t *peer,
 				vdev = wlan_key_get_link_vdev(adapter,
 							      WLAN_OSIF_TDLS_ID,
 							      link_id);
+				if (!vdev) {
+					osif_err("vdev is null");
+					return -EINVAL;
+				}
 			} else if (action_code == TDLS_DISCOVERY_REQUEST) {
 				if (ucfg_tdls_discovery_on_going(vdev)) {
 					osif_err("discovery request is going");
@@ -1259,8 +1263,10 @@ wlan_cfg80211_tdls_mgmt_mlo(struct hdd_adapter *adapter, const uint8_t *peer,
 
 	if (vdev && link_id_vdev)
 		wlan_key_put_link_vdev(vdev, WLAN_OSIF_TDLS_ID);
-	else if (!tdls_link_vdev)
-		ucfg_tdls_put_tdls_link_vdev(vdev, WLAN_OSIF_TDLS_ID);
+	else if (tdls_link_vdev)
+		ucfg_tdls_put_tdls_link_vdev(tdls_link_vdev, WLAN_OSIF_TDLS_ID);
+	else
+		hdd_objmgr_put_vdev_by_user(vdev, WLAN_OSIF_TDLS_ID);
 
 	return ret;
 }