qcacld-3.0: Only modify local buffer in Link-MLD addr trans

For action frames of category non-public userspace expects
source address in frame as MLD address for which change is
introduced using Ie63c09ece7550dfdc69c82ef8b7111251deee33e.

The lim_send_sme_mgmt_frame_ind() API modifies the actual
frame's SA/DA/BSSID fields and copies to buffer malloc'ed.
Processing RRM frame post notifying userspace results in
trying to use modified SA address as peer address which
will result in failure.

As userspace will only receive on the malloc'ed buffer it
is better to do Link-MLD address translation on only that
buffer so that the callers of lim_send_sme_mgmt_frame_ind()
won't have tampered fields.

CRs-Fixed: 3606603
Change-Id: Iaeed8d4467d759cb8e61cd48404b5bc048f18b9a

core/mac/src/pe/lim/lim_utils.c

@@ -9826,25 +9826,8 @@ void lim_send_sme_mgmt_frame_ind(struct mac_context *mac_ctx, uint8_t frame_type
 		!vdev_id) {
 		pe_debug("Broadcast action frame");
 		vdev_id = SME_SESSION_ID_BROADCAST;
-		goto fill_frame;
 	}
 
-	if (frame_type != SIR_MAC_MGMT_ACTION)
-		goto fill_frame;
-
-	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(mac_ctx->psoc, vdev_id,
-						    WLAN_LEGACY_MAC_ID);
-
-	if (!vdev) {
-		pe_debug("Action frame received with invalid vdev id:%d",
-			 vdev_id);
-		goto fill_frame;
-	}
-
-	wlan_mlo_update_action_frame_to_user(vdev, frame, frame_len);
-	wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_MAC_ID);
-
-fill_frame:
 	sme_mgmt_frame->frame_len = frame_len;
 	sme_mgmt_frame->sessionId = vdev_id;
 	sme_mgmt_frame->frameType = frame_type;
@@ -9855,6 +9838,23 @@ fill_frame:
 	qdf_mem_zero(sme_mgmt_frame->frameBuf, frame_len);
 	qdf_mem_copy(sme_mgmt_frame->frameBuf, frame, frame_len);
 
+	if (vdev_id != SME_SESSION_ID_BROADCAST &&
+	    frame_type == SIR_MAC_MGMT_ACTION) {
+		vdev = wlan_objmgr_get_vdev_by_id_from_psoc(mac_ctx->psoc,
+							    vdev_id,
+							    WLAN_LEGACY_MAC_ID);
+		if (!vdev) {
+			pe_debug("Invalid VDEV %d", vdev_id);
+			goto send_frame;
+		}
+
+		wlan_mlo_update_action_frame_to_user(vdev,
+						     sme_mgmt_frame->frameBuf,
+						     sme_mgmt_frame->frame_len);
+		wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_MAC_ID);
+	}
+
+send_frame:
 	if (mac_ctx->mgmt_frame_ind_cb)
 		mac_ctx->mgmt_frame_ind_cb(sme_mgmt_frame);
 	else