bts: delete pch_timer list in destructor

Run bts_pch_timer_remove() on each entry of the BTS specific pch_timer
list, so we don't have a memory leak and so the timer doesn't
potentially fire for a deallocated BTS.

Fixes: d3c7591 ("Add counters: pcu.bts.N.pch.requests.timeout")
Change-Id: Ia5e33d1894408e93a51c452002ef2f5758808269
diff --git a/src/bts.cpp b/src/bts.cpp
index a40e071..daa8ee1 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -32,6 +32,7 @@
 #include <pdch.h>
 #include <gprs_ms_storage.h>
 #include <sba.h>
+#include <bts_pch_timer.h>
 
 extern "C" {
 	#include <osmocom/core/talloc.h>
@@ -230,6 +231,8 @@
 		bts->app_info = NULL;
 	}
 
+	bts_pch_timer_stop_all(bts);
+
 	llist_del(&bts->list);
 	return 0;
 }
diff --git a/src/bts_pch_timer.c b/src/bts_pch_timer.c
index 386a583..20373ac 100644
--- a/src/bts_pch_timer.c
+++ b/src/bts_pch_timer.c
@@ -83,3 +83,12 @@
 	if (p)
 		bts_pch_timer_remove(p);
 }
+
+void bts_pch_timer_stop_all(struct gprs_rlcmac_bts *bts)
+{
+	struct bts_pch_timer *p, *n;
+
+	llist_for_each_entry_safe(p, n, &bts->pch_timer, entry) {
+		bts_pch_timer_remove(p);
+	}
+}
diff --git a/src/bts_pch_timer.h b/src/bts_pch_timer.h
index 91bebed..26b89c8 100644
--- a/src/bts_pch_timer.h
+++ b/src/bts_pch_timer.h
@@ -37,6 +37,7 @@
 
 void bts_pch_timer_start(struct gprs_rlcmac_bts *bts, const char *imsi);
 void bts_pch_timer_stop(struct gprs_rlcmac_bts *bts, const char *imsi);
+void bts_pch_timer_stop_all(struct gprs_rlcmac_bts *bts);
 
 #ifdef __cplusplus
 }