pdch: Make sure pending ImmAssRej scheduled for disabled pdch are dropped

When a PDCH TS becomes disabled (eg due to dyn TS being used for a
call), we are currently freeing all attached PDCHs in order to avoid
further use of it. However, pdch_free_all_tbf() was only freeing TBFs
attached to the PDCH, that is, TBFs having a valid TFI assigned.
There are some cases where temporary dummy TBFs are created which have
no TFI assigned, such as when creating an ImmAssReject. Let's take those
into account too, and make sure they are freed.

Related: OS#5226
Change-Id: Ibfe78448ebdedc8b049c80664711e166d910f9b7

src/pdch.cpp

@@ -1145,6 +1145,9 @@ void gprs_rlcmac_pdch::update_ta(uint8_t tai, uint8_t ta)
 
 void pdch_free_all_tbf(struct gprs_rlcmac_pdch *pdch)
 {
+	struct llist_item *pos;
+	struct llist_item *pos2;
+
 	for (uint8_t tfi = 0; tfi < 32; tfi++) {
 		struct gprs_rlcmac_tbf *tbf;
 
@@ -1155,6 +1158,15 @@ void pdch_free_all_tbf(struct gprs_rlcmac_pdch *pdch)
 		if (tbf)
 			tbf_free(tbf);
 	}
+
+	/* Some temporary dummy TBFs to tx ImmAssRej may be left linked to the
+	 * PDCH, since they have no TFI assigned (see handle_tbf_reject()).
+	 * Get rid of them too: */
+	llist_for_each_entry_safe(pos, pos2, &pdch->trx->ul_tbfs, list) {
+		struct gprs_rlcmac_ul_tbf *ul_tbf = as_ul_tbf((struct gprs_rlcmac_tbf *)pos->entry);
+		if (ul_tbf->control_ts == pdch->ts_no)
+			tbf_free(ul_tbf);
+	}
 }
 
 void pdch_disable(struct gprs_rlcmac_pdch *pdch)