qcacld-3.0: Hold VDEV ref count for SME command until freed

Currently a ref count for VDEV is taken while posting the SME command
to serialization in csr_set_serialization_params_to_cmd called from
csr_queue_sme_command. However once the command is posted to serialization
queue, the VDEV ref count is released which could lead to the VDEV
object used from the serialization callback without holding the ref count.

Release the VDEV ref count only if the posting to serialization module
fails and for success cases, release the ref count from
sme_ser_cmd_callback under the WLAN_SER_CB_RELEASE_MEM_CMD case.

Change-Id: I8d573ff5a25e6dff928b2708e51ad7b97e292277
CRs-Fixed: 2331716

core/sme/src/common/sme_api.c

@@ -573,6 +573,9 @@ QDF_STATUS sme_ser_cmd_callback(void *buf,
 		break;
 	case WLAN_SER_CB_RELEASE_MEM_CMD:
 		sme_debug("WLAN_SER_CB_RELEASE_MEM_CMD callback");
+		if (cmd->vdev)
+			wlan_objmgr_vdev_release_ref(cmd->vdev,
+						     WLAN_LEGACY_SME_ID);
 		sme_cmd = cmd->umac_cmd;
 		csr_release_command_buffer(mac_ctx, sme_cmd);
 		break;

core/sme/src/csr/csr_api_roam.c

@@ -20437,9 +20437,6 @@ QDF_STATUS csr_queue_sme_command(tpAniSirGlobal mac_ctx, tSmeCmd *sme_cmd,
 	ser_cmd_status = wlan_serialization_request(&cmd);
 	sme_debug("wlan_serialization_request status:%d", ser_cmd_status);
 
-	if (vdev)
-		wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_SME_ID);
-
 	switch (ser_cmd_status) {
 	case WLAN_SER_CMD_PENDING:
 	case WLAN_SER_CMD_ACTIVE:
@@ -20460,7 +20457,11 @@ QDF_STATUS csr_queue_sme_command(tpAniSirGlobal mac_ctx, tSmeCmd *sme_cmd,
 	return status;
 
 error:
+	if (vdev)
+		wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_SME_ID);
+
 	csr_release_command_buffer(mac_ctx, sme_cmd);
+
 	return QDF_STATUS_E_FAILURE;
 }