qcacmn: Don't send roam indication to kernel if bss is NULL

Currently, before sending a roamed indication to the kernel,
the host calls kernel APIs ieee80211_get_channel and
cfg80211_get_bss to confirm whether the roamed channel and
BSSID are present in the kernel scan cache or not.

In case if kernel returns the BSS pointer as NULL, Host calls
osif_populate_mlo_info_for_link API and uses BSS pointer
to populate MLO info for the link(s), this results in a
NULL pointer dereference in the host.

Fix is to avoid sending roam done indication to kernel/
userspace if kernel returns BSS pointer as NULL and issue
disconnection with reason REASON_UNSPEC_FAILURE.

Change-Id: I28f51369115a7ef20105073e4fcf6ee912c068b2
CRs-Fixed: 3404248

os_if/linux/mlme/src/osif_cm_roam_rsp.c

@@ -34,6 +34,7 @@
 #include "wlan_mlme_ucfg_api.h"
 #endif
 #include "wlan_crypto_global_api.h"
+#include <osif_cm_req.h>
 
 #ifdef CONN_MGR_ADV_FEATURE
 #ifdef WLAN_FEATURE_FILS_SK
@@ -694,6 +695,7 @@ void osif_indicate_reassoc_results(struct wlan_objmgr_vdev *vdev,
 	struct cfg80211_bss *bss;
 	struct ieee80211_channel *chan;
 	struct wlan_objmgr_psoc *psoc;
+	QDF_STATUS status;
 
 	if (wlan_vdev_mlme_is_mlo_vdev(vdev) &&
 	    wlan_vdev_mlme_is_mlo_link_vdev(vdev))
@@ -706,13 +708,17 @@ void osif_indicate_reassoc_results(struct wlan_objmgr_vdev *vdev,
 	if (!psoc)
 		return;
 
-	chan = ieee80211_get_channel(osif_priv->wdev->wiphy,
-				     rsp->freq);
+	chan = ieee80211_get_channel(osif_priv->wdev->wiphy, rsp->freq);
+
 	bss = wlan_cfg80211_get_bss(osif_priv->wdev->wiphy, chan,
 				    rsp->bssid.bytes, rsp->ssid.ssid,
 				    rsp->ssid.length);
-	if (!bss)
-		osif_warn("not able to find bss");
+	if (!bss) {
+		osif_warn("BSS "QDF_MAC_ADDR_FMT" is null, issue disconnect",
+			  QDF_MAC_ADDR_REF(rsp->bssid.bytes));
+		goto issue_disconnect;
+	}
+
 	if (rsp->is_assoc)
 		osif_cm_get_assoc_req_ie_data(&rsp->connect_ies.assoc_req,
 					      &req_len, &req_ie);
@@ -726,6 +732,12 @@ void osif_indicate_reassoc_results(struct wlan_objmgr_vdev *vdev,
 				  rsp_len);
 
 	osif_update_fils_hlp_data(dev, vdev, rsp);
+	return;
+
+issue_disconnect:
+	status = osif_cm_disconnect(dev, vdev, REASON_UNSPEC_FAILURE);
+	if (QDF_IS_STATUS_ERROR(status))
+		osif_err("Disconnect failed with status %d", status);
 }
 
 QDF_STATUS