qcacld-3.0: Add vdev id sanity check in wma stats event handlers

Stats events are sent by WLAN FW based on over the air frame reception
and may contain incorrect vdev id hence sanitize vdev id received from
FW in stats events before accessing interface array based on it.

Change-Id: I4ecc73fc27285c98c0ea8cebc27955213cd68399
CRs-Fixed: 2186953

core/wma/src/wma_utils.c

@@ -2456,6 +2456,12 @@ static void wma_vdev_stats_lost_link_helper(tp_wma_handle wma,
 	static const uint8_t zero_mac[QDF_MAC_ADDR_SIZE] = {0};
 	int32_t bcn_snr, dat_snr;
 
+	if (vdev_stats->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: Invalid vdev_id %hu",
+			__func__, vdev_stats->vdev_id);
+		return;
+	}
+
 	node = &wma->interfaces[vdev_stats->vdev_id];
 	if (wma_is_vdev_up(vdev_stats->vdev_id) &&
 	    !qdf_mem_cmp(node->bssid, zero_mac, QDF_MAC_ADDR_SIZE)) {
@@ -2505,6 +2511,12 @@ static void wma_update_vdev_stats(tp_wma_handle wma,
 	struct scheduler_msg sme_msg = { 0 };
 	int32_t bcn_snr, dat_snr;
 
+	if (vdev_stats->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: Invalid vdev_id %hu",
+			__func__, vdev_stats->vdev_id);
+		return;
+	}
+
 	bcn_snr = vdev_stats->vdev_snr.bcn_snr;
 	dat_snr = vdev_stats->vdev_snr.dat_snr;
 	WMA_LOGD("vdev id %d beancon snr %d data snr %d",
@@ -2776,6 +2788,12 @@ static void wma_update_rssi_stats(tp_wma_handle wma,
 	uint32_t temp_mask;
 	uint8_t vdev_id;
 
+	if (rssi_stats->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("%s: Invalid vdev_id %hu",
+			__func__, rssi_stats->vdev_id);
+		return;
+	}
+
 	vdev_id = rssi_stats->vdev_id;
 	node = &wma->interfaces[vdev_id];
 	stats_rsp_params = (tAniGetPEStatsRsp *) node->stats_rsp;