qcacld-3.0: Fix 2nd STA failed to connect in dbs mode

When STA connect and target AP isn't in scan cache, specific
scan for AP ssid will happen, and roam profile is saved in
scan info.
When scan complete, in registered csr scan callback, if connect
need HW mode change, HW mode change is sent to F/W, and roam
profile in scan info is freed at once.
In HW mode change response handler,  if roam profile in scan info
is found to be freed,  failed to start connect.

Fix:
Make sure roam profile not freed before issue connect.
In specific scan result callback, before issue connect, check
whether need HW mode change.
1. If HW mode change is unneeded or return FAILED, free roam
   profile in scan info.
2. If HW mode change return SUCCESS,  when cmd is finished or
   cancelled, in csr_free_cmd_memory, free roam profile when
   cmd is e_sme_command_set_hw_mode with reason
   POLICY_MGR_UPDATE_REASON_HIDDEN_STA.

Change-Id: I3f87996de4142baea33dd0f56cb2a892f0387336
CRs-Fixed: 2369154

core/sme/src/csr/csr_api_roam.c

@@ -1567,11 +1567,26 @@ void csr_release_command_roam(struct mac_context *mac, tSmeCmd *pCommand)
 }
 
 void csr_release_command_wm_status_change(struct mac_context *mac,
-					tSmeCmd *pCommand)
+					  tSmeCmd *pCommand)
 {
 	csr_reinit_wm_status_change_cmd(mac, pCommand);
 }
 
+static void csr_release_command_set_hw_mode(struct mac_context *mac,
+					    tSmeCmd *cmd)
+{
+	struct csr_roam_session *session;
+	uint32_t session_id;
+
+	if (cmd->u.set_hw_mode_cmd.reason ==
+	    POLICY_MGR_UPDATE_REASON_HIDDEN_STA) {
+		session_id = cmd->u.set_hw_mode_cmd.session_id;
+		session = CSR_GET_SESSION(mac, session_id);
+		if (session)
+			csr_saved_scan_cmd_free_fields(mac, session);
+	}
+}
+
 void csr_roam_substate_change(struct mac_context *mac,
 		enum csr_roam_substate NewSubstate, uint32_t sessionId)
 {
@@ -19209,6 +19224,8 @@ static void csr_free_cmd_memory(struct mac_context *mac, tSmeCmd *pCommand)
 	case eSmeCommandWmStatusChange:
 		csr_release_command_wm_status_change(mac, pCommand);
 		break;
+	case e_sme_command_set_hw_mode:
+		csr_release_command_set_hw_mode(mac, pCommand);
 	default:
 		break;
 	}

core/sme/src/csr/csr_api_scan.c

@@ -1122,6 +1122,7 @@ void csr_saved_scan_cmd_free_fields(struct mac_context *mac_ctx,
 				    struct csr_roam_session *session)
 {
 	if (session->scan_info.profile) {
+		sme_debug("Free profile for session %d", session->sessionId);
 		csr_release_profile(mac_ctx,
 				    session->scan_info.profile);
 		qdf_mem_free(session->scan_info.profile);
@@ -1212,6 +1213,7 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 			       uint8_t chan)
 {
 	QDF_STATUS status, ret;
+	struct csr_roam_session *session;
 
 	switch (nxt_cmd) {
 
@@ -1232,7 +1234,7 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 		if (!QDF_IS_STATUS_SUCCESS(status)) {
 			/* csr_save_profile should report error */
 			sme_err("profile save failed %d", status);
-			return;
+			break;
 		}
 
 		if (QDF_STATUS_E_FAILURE == ret) {
@@ -1247,10 +1249,14 @@ static void csr_handle_nxt_cmd(struct mac_context *mac_ctx,
 		/* Else: Set hw mode was issued and the saved connect would
 		 * be issued after set hw mode response
 		 */
-		break;
+		if (QDF_IS_STATUS_SUCCESS(status))
+			return;
 	default:
 		break;
 	}
+	session = CSR_GET_SESSION(mac_ctx, session_id);
+	if (session)
+		csr_saved_scan_cmd_free_fields(mac_ctx, session);
 }
 
 void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
@@ -1300,14 +1306,6 @@ void csr_scan_callback(struct wlan_objmgr_vdev *vdev,
 	/* We reuse the command here instead reissue a new command */
 	csr_handle_nxt_cmd(mac_ctx, NextCommand,
 			   session_id, chan);
-
-	if (session->scan_info.profile != NULL) {
-		sme_debug("Free the profile scan_id %d", event->scan_id);
-		csr_release_profile(mac_ctx, session->scan_info.profile);
-		qdf_mem_free(session->scan_info.profile);
-		session->scan_info.profile = NULL;
-	}
-
 }
 
 tCsrScanResultInfo *csr_scan_result_get_first(struct mac_context *mac,