msm: ipa: Fix to use after free issue

Added to code changes to ref_cnt variable will decrement only
when add_ref_hdr variable is true.

Change-Id: I0bcc3909669f4843c43135e5f047ac28fa62bb63
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>

drivers/platform/msm/ipa/ipa_v2/ipa_hdr.c

@@ -581,6 +581,7 @@ ipa_insert_failed:
 	htbl->proc_ctx_cnt--;
 
 bad_len:
+	if (add_ref_hdr)
 		hdr_entry->ref_cnt--;
 	entry->cookie = 0;
 	kmem_cache_free(ipa_ctx->hdr_proc_ctx_cache, entry);

drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c

@@ -462,6 +462,7 @@ ipa_insert_failed:
 	htbl->proc_ctx_cnt--;
 
 bad_len:
+	if (add_ref_hdr)
 		hdr_entry->ref_cnt--;
 	entry->cookie = 0;
 	kmem_cache_free(ipa3_ctx->hdr_proc_ctx_cache, entry);