Fix: Add timer for downlink TBF in assignment state

This is required, since the UL TBF which is used to assign downlink TBF
may be freed due to timeouts.
diff --git a/src/gprs_rlcmac_data.cpp b/src/gprs_rlcmac_data.cpp
index d59153f..a1bed3c 100644
--- a/src/gprs_rlcmac_data.cpp
+++ b/src/gprs_rlcmac_data.cpp
@@ -247,6 +247,8 @@
 				break;
 			}
 			tbf_new_state(tbf, GPRS_RLCMAC_FLOW);
+			/* stop pending assignment timer */
+			tbf_timer_stop(tbf);
 			if ((tbf->state_flags &
 				(1 << GPRS_RLCMAC_FLAG_TO_DL_ASS))) {
 				tbf->state_flags &=
@@ -405,13 +407,24 @@
 		break;
 #endif
 	case 0: /* assignment */
-		/* change state to FLOW, so scheduler will start transmission */
-		if (tbf->state == GPRS_RLCMAC_ASSIGN) {
-			tbf_new_state(tbf, GPRS_RLCMAC_FLOW);
-			tbf_assign_control_ts(tbf);
-		} else
-			LOGP(DRLCMAC, LOGL_ERROR, "Error: TBF is not in assign "
-				"state\n");
+		if ((tbf->state_flags & (1 << GPRS_RLCMAC_FLAG_PACCH))) {
+			if (tbf->state == GPRS_RLCMAC_ASSIGN) {
+				LOGP(DRLCMAC, LOGL_NOTICE, "Releasing due to "
+					"PACCH assignment timeout.\n");
+				tbf_free(tbf);
+			} else
+				LOGP(DRLCMAC, LOGL_ERROR, "Error: TBF is not "
+					"in assign state\n");
+		}
+		if ((tbf->state_flags & (1 << GPRS_RLCMAC_FLAG_CCCH))) {
+			/* change state to FLOW, so scheduler will start transmission */
+			if (tbf->state == GPRS_RLCMAC_ASSIGN) {
+				tbf_new_state(tbf, GPRS_RLCMAC_FLOW);
+				tbf_assign_control_ts(tbf);
+			} else
+				LOGP(DRLCMAC, LOGL_ERROR, "Error: TBF is not "
+					"in assign state\n");
+		}
 		break;
 	case 3169:
 	case 3191:
@@ -1575,6 +1588,9 @@
 		tbf->dl_ass_state = GPRS_RLCMAC_DL_ASS_NONE;
 		tbf_new_state(new_tbf, GPRS_RLCMAC_FLOW);
 		tbf_assign_control_ts(new_tbf);
+		/* stop pending assignment timer */
+		tbf_timer_stop(new_tbf);
+
 	}
 
 	return msg;
@@ -1623,6 +1639,8 @@
 		/* change state */
 		tbf_new_state(tbf, GPRS_RLCMAC_ASSIGN);
 		tbf->state_flags |= (1 << GPRS_RLCMAC_FLAG_PACCH);
+		/* start timer */
+		tbf_timer_start(tbf, 0, Tassign_pacch);
 #endif
 	} else {
 		LOGP(DRLCMAC, LOGL_DEBUG, "Send dowlink assignment for TBF=%d on PCH, no TBF exist (IMSI=%s)\n", tbf->tfi, imsi);