rlcmac: Release pending polls in pdch_ul when freeing tbf

Otherwise the events are eventually sheduled and they point to an
already freed TBF.

Change-Id: I2b39ca8e79125eb2f496a92259c09c050e1f369b
---
M src/rlcmac/tbf.c
1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/rlcmac/tbf.c b/src/rlcmac/tbf.c
index c18ad83..524740d 100644
--- a/src/rlcmac/tbf.c
+++ b/src/rlcmac/tbf.c
@@ -27,6 +27,7 @@
 #include <osmocom/gprs/rlcmac/tbf_ul.h>
 #include <osmocom/gprs/rlcmac/gre.h>
 #include <osmocom/gprs/rlcmac/rlcmac_enc.h>
+#include <osmocom/gprs/rlcmac/pdch_ul_controller.h>
 
 void gprs_rlcmac_tbf_constructor(struct gprs_rlcmac_tbf *tbf,
 				 enum gprs_rlcmac_tbf_direction direction,
@@ -38,7 +39,9 @@
 
 void gprs_rlcmac_tbf_destructor(struct gprs_rlcmac_tbf *tbf)
 {
-
+	unsigned int i;
+	for (i = 0; i < ARRAY_SIZE(g_ctx->sched.ulc); i++)
+		gprs_rlcmac_pdch_ulc_release_tbf(g_ctx->sched.ulc[i], tbf);
 }
 
 void gprs_rlcmac_tbf_free(struct gprs_rlcmac_tbf *tbf)

