Fix: Kill pending downlink TBF, if mobile requests uplink TBF on RACH

If the mobile misses assignment, it changes back to idle mode. In this
case we must kill the pending downlink TBF, because it is not used by
mobile and we can assign a new downlink TBF for new downlink data.
(We may not have two downlink TBF with same TLLI!)
diff --git a/src/gprs_rlcmac_data.cpp b/src/gprs_rlcmac_data.cpp
index 7610dcb..2a4c7b1 100644
--- a/src/gprs_rlcmac_data.cpp
+++ b/src/gprs_rlcmac_data.cpp
@@ -644,6 +644,8 @@
 
 	/* get TLLI */
 	if (!tbf->tlli_valid) {
+		struct gprs_rlcmac_tbf *dl_tbf;
+
 		/* no TLLI yet */
 		if (!rh->ti) {
 			LOGP(DRLCMACUL, LOGL_NOTICE, "UL DATA TBF=%d without "
@@ -659,6 +661,13 @@
 		tbf->tlli_valid = 1;
 		LOGP(DRLCMACUL, LOGL_INFO, "Decoded premier TLLI=0x%08x of "
 			"UL DATA TBF=%d.\n", tbf->tlli, rh->tfi);
+		if ((dl_tbf = tbf_by_tlli(tbf->tlli, GPRS_RLCMAC_DL_TBF))) {
+			LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
+				"TLLI=0x%08x while DL TBF=%d still exists. "
+				"Killing pending DL TBF\n", tbf->tlli,
+				dl_tbf->tfi);
+			tbf_free(dl_tbf);
+		}
 	/* already have TLLI, but we stille get another one */
 	} else if (rh->ti) {
 		uint32_t tlli;