tbf: Only free TBF if it was replaced in rcv_control_ack

Currently the TBF whose PACCH has been used to send an assigment
is freed if it is in state WAIT_RELEASE. Sometimes this TBF could
be used for several assignments (e.g. an 'old' DL TBF is used to
assign an UL and then a DL TBF). The second of these assigments will
never be sent in that case. On the other hand, the MS replaces a
TBF of the same direction, so the old one can be freed in that case.

Only free the TBF if it is in state WAIT_RELEASE and has the same
direction like the new one.

Sponsored-by: On-Waves ehf
diff --git a/src/bts.cpp b/src/bts.cpp
index 8337b06..5cadda1 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -799,7 +799,8 @@
 				"TBF is gone TLLI=0x%08x\n", tlli);
 			return;
 		}
-		if (tbf->state_is(GPRS_RLCMAC_WAIT_RELEASE))
+		if (tbf->state_is(GPRS_RLCMAC_WAIT_RELEASE) &&
+				tbf->direction == new_tbf->direction)
 			tbf_free(tbf);
 
 		if ((new_tbf->state_flags & (1 << GPRS_RLCMAC_FLAG_CCCH))) {
@@ -836,7 +837,8 @@
 				"TBF is gone TLLI=0x%08x\n", tlli);
 			return;
 		}
-		if (tbf->state_is(GPRS_RLCMAC_WAIT_RELEASE))
+		if (tbf->state_is(GPRS_RLCMAC_WAIT_RELEASE) &&
+				tbf->direction == new_tbf->direction)
 			tbf_free(tbf);
 
 		new_tbf->set_state(GPRS_RLCMAC_FLOW);