Currently during runtime suspend, in dp_find_missing_tx_comp(),
TX descriptors are freed forcefully if the TX completions for
those descriptors do not arrive within 60 seconds.
In certain rare corner cases, there is a chance of TX buffer (that is
in the enqueue path) getting freed in the TX completion path due to
delayed completions. This results in NULL pointer dereference.
Following is the sequence of events for such a case,
1. dp_find_missing_tx_comp() frees a TX descriptor
2. Different buffer gets attached to the same TX descriptor
3. Delayed completion for the previous TX arrives and frees
the buffer in point 2.
Defer the free in dp_find_missing_tx_comp() when there is a delta in
HP/TP for the TX/COMP rings. If HP & TP are not same, then there is
high chance of processing the delayed completion beforehand, thus
avoiding the aforementioned race.
Change-Id: Ia835928f85ea0f79d0187a55333cb8959d0a72e9
CRs-Fixed: 3721341
7e58813e0e