qcacmn: Skip invalid Rx descriptor access in wbm err path

There is a possibility where host can receive invalid SW cookie
in wbm internal error path which causes invalid rx descriptor
access.

Add a sanity check on received SW cookie to prevent the invalid
rx descriptor access. Also, add sanity check for the duplicate
rx descriptors.

Change-Id: I6400cb1fc067f4bc474f2768c18c8f7ce587fbbe
CRs-Fixed: 3220371

dp/wifi3.0/dp_rx_err.c

@@ -3444,6 +3444,7 @@ dp_wbm_int_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 	uint32_t msdu_cnt, i;
 	uint32_t rx_link_buf_info[HAL_RX_BUFFINFO_NUM_DWORDS];
 	struct rx_desc_pool *rx_desc_pool;
+	struct dp_rx_desc *rx_desc;
 
 	msdu = 0;
 
@@ -3466,8 +3467,13 @@ dp_wbm_int_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 
 		if (msdu_list.sw_cookie[0] != HAL_RX_COOKIE_SPECIAL) {
 			for (i = 0; i < num_msdus; i++) {
-				struct dp_rx_desc *rx_desc =
-					soc->arch_ops.dp_rx_desc_cookie_2_va(
+				if (!dp_rx_is_sw_cookie_valid(soc, msdu_list.sw_cookie[i])) {
+					dp_rx_err_info_rl("Invalid MSDU info cookie: 0x%x",
+							  msdu_list.sw_cookie[i]);
+					continue;
+				}
+
+				rx_desc = soc->arch_ops.dp_rx_desc_cookie_2_va(
 							soc,
 							msdu_list.sw_cookie[i]);
 				qdf_assert_always(rx_desc);
@@ -3475,6 +3481,17 @@ dp_wbm_int_err_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 					&soc->rx_desc_buf[rx_desc->pool_id];
 				msdu = rx_desc->nbuf;
 
+				/*
+				 * this is a unlikely scenario where the host is reaping
+				 * a descriptor which it already reaped just a while ago
+				 * but is yet to replenish it back to HW.
+				 */
+				if (qdf_unlikely(!rx_desc->in_use) ||
+				    qdf_unlikely(!msdu)) {
+					dp_rx_err_info_rl("Reaping rx_desc not in use!");
+					continue;
+				}
+
 				dp_ipa_rx_buf_smmu_mapping_lock(soc);
 				dp_rx_nbuf_unmap_pool(soc, rx_desc_pool, msdu);
 				rx_desc->unmapped = 1;