wcn36xx: dequeue all pending indicator messages

In case wcn36xx_smd_rsp_process() is called more than once before
hal_ind_work was dispatched, the messages will end up in hal_ind_queue,
but wcn36xx_ind_smd_work() will only look at the first message in that
list.

Fix this by dequeing the messages from the list in a loop, and only stop
when it's empty.

This issue was found during a review of the driver. In my tests, that
race never actually occured.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

drivers/net/wireless/ath/wcn36xx/smd.c

@@ -2411,16 +2411,23 @@ static void wcn36xx_ind_smd_work(struct work_struct *work)
 {
 	struct wcn36xx *wcn =
 		container_of(work, struct wcn36xx, hal_ind_work);
+
+	for (;;) {
 		struct wcn36xx_hal_msg_header *msg_header;
 		struct wcn36xx_hal_ind_msg *hal_ind_msg;
 		unsigned long flags;
 
 		spin_lock_irqsave(&wcn->hal_ind_lock, flags);
 
+		if (list_empty(&wcn->hal_ind_queue)) {
+			spin_unlock_irqrestore(&wcn->hal_ind_lock, flags);
+			return;
+		}
+
 		hal_ind_msg = list_first_entry(&wcn->hal_ind_queue,
 					       struct wcn36xx_hal_ind_msg,
 					       list);
-	list_del(wcn->hal_ind_queue.next);
+		list_del(&hal_ind_msg->list);
 		spin_unlock_irqrestore(&wcn->hal_ind_lock, flags);
 
 		msg_header = (struct wcn36xx_hal_msg_header *)hal_ind_msg->msg;
@@ -2458,7 +2465,9 @@ static void wcn36xx_ind_smd_work(struct work_struct *work)
 			wcn36xx_err("SMD_EVENT (%d) not supported\n",
 				    msg_header->msg_type);
 		}
+
 		kfree(hal_ind_msg);
+	}
 }
 int wcn36xx_smd_open(struct wcn36xx *wcn)
 {