bugfix for HFP hci audio crash

components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c

@@ -323,6 +323,7 @@ static void bta_ag_sco_read_cback(UINT16 sco_inx, BT_HDR *p_data, tBTM_SCO_DATA_
 
     /* Callout function must free the data. */
     bta_ag_sco_co_in_data(p_data, status);
+    osi_free(p_data);
 }
 #endif
 /*******************************************************************************

components/bt/host/bluedroid/stack/btu/btu_task.c

@@ -152,7 +152,6 @@ static void btu_hci_msg_process(void *param)
     case BT_EVT_TO_BTU_HCI_SCO:
 #if BTM_SCO_INCLUDED == TRUE
         btm_route_sco_data (p_msg);
-        osi_free(p_msg);
         break;
 #endif