qcacld-3.0: Avoid use of uninitialized variables

In rrm_process_channel_load_req API, there is a
possibility that host driver may use uninitialized
variables which may lead to unexpected behavior.

To address this issue, initialize the uninitialized
variables bw_ind and wide_bw = {0}.

Validate vdev-id before getting corresponding
txrx node pointer in wma_tx_packet.

Updated condition to validate vdev-id while processing
vdev delete response.

Change-Id: I837ba84b9f03896d1b8cfede8885fe3e3d72e1f4
CRs-Fixed: 3674684

core/wma/src/wma_data.c

@@ -2339,6 +2339,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 		return QDF_STATUS_E_FAILURE;
 	}
 
+	if (vdev_id >= wma_handle->max_bssid) {
+		wma_err("tx packet with invalid vdev_id :%d", vdev_id);
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	iface = &wma_handle->interfaces[vdev_id];
 
 	if (!soc) {
@@ -2370,7 +2375,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 		return QDF_STATUS_E_FAILURE;
 	}
 
-	if ((iface && (iface->rmfEnabled || tx_flag & HAL_USE_PMF)) &&
+	if (((iface->rmfEnabled || tx_flag & HAL_USE_PMF)) &&
 	    (frmType == TXRX_FRM_802_11_MGMT) &&
 	    (pFc->subType == SIR_MAC_MGMT_DISASSOC ||
 	     pFc->subType == SIR_MAC_MGMT_DEAUTH ||
@@ -2717,7 +2722,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 	mgmt_param.use_6mbps = use_6mbps;
 	mgmt_param.tx_type = tx_frm_index;
 	mgmt_param.peer_rssi = peer_rssi;
-	if (iface && wlan_vdev_mlme_get_opmode(iface->vdev) == QDF_STA_MODE &&
+	if (wlan_vdev_mlme_get_opmode(iface->vdev) == QDF_STA_MODE &&
 	    wlan_vdev_mlme_is_mlo_vdev(iface->vdev) &&
 	    (wlan_vdev_mlme_is_active(iface->vdev) == QDF_STATUS_SUCCESS) &&
 	    frmType == TXRX_FRM_802_11_MGMT &&

core/wma/src/wma_dev_if.c

@@ -412,7 +412,7 @@ QDF_STATUS wma_vdev_detach_callback(struct vdev_delete_response *rsp)
 		return QDF_STATUS_E_FAILURE;
 
 	/* Sanitize the vdev id*/
-	if (rsp->vdev_id > wma->max_bssid) {
+	if (rsp->vdev_id >= wma->max_bssid) {
 		wma_err("vdev delete response with invalid vdev_id :%d",
 			rsp->vdev_id);
 		QDF_BUG(0);