qcacld-3.0: Fix invalid pointer dereference in wma_open

Change-Id I28d5985655b4 is accessing uninitialized pointer
params->rx_ops, which cause failure during load.

To fix this, as well as to avoid big structure on stack,
allocate that structure from heap and free after usage.

Change-Id: Ibcdb2904c223e43744e635ef5d530a63867f644b
CRs-Fixed: 2207937

core/wma/src/wma_main.c

@@ -2894,7 +2894,7 @@ QDF_STATUS wma_open(struct wlan_objmgr_psoc *psoc,
 	qdf_device_t qdf_dev;
 	void *wmi_handle;
 	QDF_STATUS qdf_status;
-	struct wmi_unified_attach_params params;
+	struct wmi_unified_attach_params *params;
 	struct policy_mgr_wma_cbacks wma_cbacks;
 	struct target_psoc_info *tgt_psoc_info;
 	int i;
@@ -2974,19 +2974,33 @@ QDF_STATUS wma_open(struct wlan_objmgr_psoc *psoc,
 	wma_target_if_open(wma_handle);
 	target_if_open(wma_get_psoc_from_scn_handle);
 
-	params.osdev = NULL;
-	params.target_type = WMI_TLV_TARGET;
-	params.use_cookie = false;
-	params.psoc = psoc;
-	params.max_commands = WMI_MAX_CMDS;
+	/*
+	 * Allocate locally used params with its rx_ops member,
+	 * and free it immediately after used.
+	 */
+	params = qdf_mem_malloc(sizeof(*params) + sizeof(struct wmi_rx_ops));
+	if (!params) {
+		WMA_LOGE("%s: failed to allocate attach params", __func__);
+		qdf_status = QDF_STATUS_E_NOMEM;
+		goto err_wma_handle;
+	}
+
+	params->rx_ops = (struct wmi_rx_ops *)(params + 1);
+	params->osdev = NULL;
+	params->target_type = WMI_TLV_TARGET;
+	params->use_cookie = false;
+	params->psoc = psoc;
+	params->max_commands = WMI_MAX_CMDS;
 	/* Attach mc_thread context processing function */
-	params.rx_ops->wma_process_fw_event_handler_cbk = wma_process_fw_event_handler;
+	params->rx_ops->wma_process_fw_event_handler_cbk =
+						wma_process_fw_event_handler;
 
 	/* initialize tlv attach */
 	wmi_tlv_init();
 
 	/* attach the wmi */
-	wmi_handle = wmi_unified_attach(wma_handle, &params);
+	wmi_handle = wmi_unified_attach(wma_handle, params);
+	qdf_mem_free(params);
 	if (!wmi_handle) {
 		WMA_LOGE("%s: failed to attach WMI", __func__);
 		qdf_status = QDF_STATUS_E_NOMEM;