bts: Really drop the BTS in case of an OML NACK

The previous code didn't work as expected. The trx and dst pointer
are located in an union and in the case of the Abis code the dst
is used to point to the signalling link timeslot and not the TRX.

The is_ipaccess_bts always returned false because the dst was casted
to a trx while it was no trx.

This fix was tested with the nack_test/NACKTest.st of the test repo.
diff --git a/openbsc/include/openbsc/signal.h b/openbsc/include/openbsc/signal.h
index fa38bbe..598d470 100644
--- a/openbsc/include/openbsc/signal.h
+++ b/openbsc/include/openbsc/signal.h
@@ -185,6 +185,7 @@
 
 struct nm_nack_signal_data {
 	struct msgb *msg;
+	struct gsm_bts *bts;
 	uint8_t mt;
 };
 
diff --git a/openbsc/src/libbsc/abis_nm.c b/openbsc/src/libbsc/abis_nm.c
index 4fd11c7..e95c0a9 100644
--- a/openbsc/src/libbsc/abis_nm.c
+++ b/openbsc/src/libbsc/abis_nm.c
@@ -548,6 +548,7 @@
 
 		nack_data.msg = mb;
 		nack_data.mt = mt;
+		nack_data.bts = sign_link->trx->bts;
 		osmo_signal_dispatch(SS_NM, S_NM_NACK, &nack_data);
 		abis_nm_queue_send_next(sign_link->trx->bts);
 		return 0;
diff --git a/openbsc/src/libbsc/bsc_init.c b/openbsc/src/libbsc/bsc_init.c
index f5d7969..9e734c0 100644
--- a/openbsc/src/libbsc/bsc_init.c
+++ b/openbsc/src/libbsc/bsc_init.c
@@ -43,8 +43,6 @@
 /* Callback function for NACK on the OML NM */
 static int oml_msg_nack(struct nm_nack_signal_data *nack)
 {
-	struct gsm_bts *bts;
-
 	if (nack->mt == NM_MT_SET_BTS_ATTR_NACK) {
 
 		LOGP(DNM, LOGL_ERROR, "Failed to set BTS attributes. That is fatal. "
@@ -58,13 +56,13 @@
 	return 0;
 
 drop_bts:
-	if (!nack->msg || !nack->msg->trx)
+	if (!nack->bts) {
+		LOGP(DNM, LOGL_ERROR, "Unknown bts. Can not drop it.\n");
 		return 0;
+	}
 
-	bts = nack->msg->trx->bts;
-
-	if (is_ipaccess_bts(bts))
-		ipaccess_drop_oml(bts);
+	if (is_ipaccess_bts(nack->bts))
+		ipaccess_drop_oml(nack->bts);
 
 	return 0;
 }