RDS/IB: always free recv frag as we free its ring entry

RDS/IB: always free recv frag as we free its ring entry

We were still seeing rare occurances of the WARN_ON() that indicates
that the recv refill path was finding allocated frags in ring entries
that were marked free.  These were usually followed by oom crashes.
They only seem to be occuring in the presence of interesting completion
errors and connection resets.

There are error paths in rds_ib_recv_cqe_handler() that could leave a
recv frag sitting in the ring.  This patch ensures that we free the frag
as we mark the ring entry free.  This should stop the refill path from
finding allocated frags in ring entries that were marked free.

Signed-off-by: Zach Brown <zach.brown@oracle.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Bang Nguyen <bang.nguyen@oracle.com>