qcacmn: Add upper bound check for scan count

Add upper bound check for Spectral scan count parameter.

CRs-Fixed: 3495755
Change-Id: I31cb9313bc1abcc8323a00242a6f34b25af9ed9d

target_if/spectral/target_if_spectral.c

@@ -2043,6 +2043,7 @@ target_if_init_spectral_param_min_max_be(struct target_if_spectral *spectral)
 
 	param_min_max = &spectral->param_min_max;
 	param_min_max->fft_size_min = SPECTRAL_PARAM_FFT_SIZE_MIN_GEN3_BE;
+	param_min_max->scan_count_max = SPECTRAL_PARAM_SCAN_COUNT_MAX_GEN3_BE;
 
 	for (op_bw = CH_WIDTH_20MHZ; op_bw < CH_WIDTH_MAX; op_bw++) {
 		bool is_supported;
@@ -2113,6 +2114,8 @@ target_if_init_spectral_param_min_max(
 		param_min_max->fft_size_min = SPECTRAL_PARAM_FFT_SIZE_MIN_GEN3;
 		param_min_max->fft_size_max[CH_WIDTH_20MHZ] =
 				SPECTRAL_PARAM_FFT_SIZE_MAX_GEN3_DEFAULT;
+		param_min_max->scan_count_max =
+				SPECTRAL_PARAM_SCAN_COUNT_MAX_GEN3;
 		if (target_type == TARGET_TYPE_QCN9000 ||
 		    target_type == TARGET_TYPE_QCN6122 ||
 		    target_type == TARGET_TYPE_QCN9160 ||
@@ -4483,6 +4486,10 @@ _target_if_set_spectral_config(struct target_if_spectral *spectral,
 		}
 		break;
 	case SPECTRAL_PARAM_SCAN_COUNT:
+		if (param->value > param_min_max->scan_count_max) {
+			*err = SPECTRAL_SCAN_ERR_PARAM_INVALID_VALUE;
+			return QDF_STATUS_E_FAILURE;
+		}
 		sparams->ss_count = param->value;
 		break;
 	case SPECTRAL_PARAM_SHORT_REPORT:

target_if/spectral/target_if_spectral.h

@@ -98,6 +98,8 @@
 #define INVALID_FFT_SIZE                          (0xFFFF)
 #define SPECTRAL_PARAM_RPT_MODE_MIN               (0)
 #define SPECTRAL_PARAM_RPT_MODE_MAX               (3)
+#define SPECTRAL_PARAM_SCAN_COUNT_MAX_GEN3        (4095)
+#define SPECTRAL_PARAM_SCAN_COUNT_MAX_GEN3_BE     (4095)
 #define SPECTRAL_DWORD_SIZE                       (4)
 
 #define MAX_FFTBIN_VALUE_LINEAR_MODE              (U8_MAX)
@@ -652,10 +654,12 @@ struct spectral_report_params {
  * struct spectral_param_min_max - Spectral parameter minimum and maximum values
  * @fft_size_min: Minimum value of fft_size
  * @fft_size_max: Maximum value of fft_size for each BW
+ * @scan_count_max: Maximum value of scan count
  */
 struct spectral_param_min_max {
 	uint16_t fft_size_min;
 	uint16_t fft_size_max[CH_WIDTH_MAX];
+	uint16_t scan_count_max;
 };
 
 /**