qcacmn: Add sanity check for qdf_nbuf_put_tail

In DP while handling ppdu stats, we call qdf_nbuf_put_tail
and proceed with updating the nbuf data whithout a check on
the return status of qdf_nbuf_put_tail.

If the qdf_nbuf_put_tail API failed, would free the nbuf
and subsequent updates to the nbuf would result in use
after free, which is resulting in memory corruption.

Add check to verify the return status of qdf_nbuf_put_tail
and proceed accordingly.

Also while updating the ppdu stats, ensure the num of users
of ppdu is checked against the max number of users defined.

CRs-Fixed: 2678258
Change-Id: I00b661fdb342d31563506f93abd63673af8ede55

dp/wifi3.0/dp_rx_mon_status.c

@@ -526,7 +526,7 @@ static void dp_rx_stats_update(struct dp_pdev *pdev,
 	preamble = ppdu->u.preamble;
 	ppdu_type = ppdu->u.ppdu_type;
 
-	for (i = 0; i < ppdu->num_users; i++) {
+	for (i = 0; i < ppdu->num_users && i < CDP_MU_MAX_USERS; i++) {
 		peer = NULL;
 		ppdu_user = &ppdu->user[i];
 		if (ppdu_user->peer_id != HTT_INVALID_PEER)
@@ -1406,8 +1406,10 @@ dp_rx_handle_ppdu_stats(struct dp_soc *soc, struct dp_pdev *pdev,
 		dp_rx_mon_populate_cfr_info(pdev, ppdu_info, cdp_rx_ppdu);
 		dp_rx_populate_cdp_indication_ppdu(pdev,
 						   ppdu_info, cdp_rx_ppdu);
-		qdf_nbuf_put_tail(ppdu_nbuf,
-				  sizeof(struct cdp_rx_indication_ppdu));
+		if (!qdf_nbuf_put_tail(ppdu_nbuf,
+				       sizeof(struct cdp_rx_indication_ppdu)))
+			return;
+
 		dp_rx_stats_update(pdev, cdp_rx_ppdu);
 
 		if (cdp_rx_ppdu->peer_id != HTT_INVALID_PEER) {