wlan: Add adapter MAGIC checking in *_tx_fetch_packet_cbk()

A kernel panic in _list_del_entry() was observed when SoftAP was
disabled.  Root cause is that when the SoftAP function was disabled
and the pAdapter was freed, the TX Thread was blocked. When the TX
Thread subsequently unblocked, a stale pAdapter was dereferenced.  Add
adapter MAGIC checking to the *_tx_fetch_packet_cbk() functions to
prevent dereference of a stale pAdapter.

Change-Id: Ief12257ab0f89dba6acf8d86c20f526d90426d7c
CRs-fixed: 580814
wlan: NULL check to ensure preauth candidate is still valid

STA processes the PREAUTH response from the AP2 after switching
back to home channel(AP1). In this possible timing scenario if the
STA receives DEAUTH from the currently associated AP (AP1) before
processing the PREAUTH response then FTPreAuthReq is cleaned-up
and set to NULL.

This causes the crash in the next immediate processing of PREAUTH.
Fix is to add a NULL check to ensure pre-authenticated candidate
is still valid.

Change-Id: Iba1813e2cd5401c75369c5688b730eb0b5416e90
CRs-Fixed: 565333
DroidSec: function iw_set_pno where sscanf return is not checked

Sscanf is called 10 times in this function, and return code is
checked for 4 of those calls. All must check return from all sscanf
to confirm that parameters were parsed correctly before subsequent
use

Change-Id: I83b56f05c7cc67284d802116dd054713ed2ab041
CRs-fixed: 554541
wlan: Serialize enter/exit bmps in hdd_smeRoamCallback

hdd_smeRoamCallback gets called in the MC_Thread context and invoking
wlan_hdd_enter and exit bmps function is causing a deadlock.
In other words the MC_Thread will be blocked waiting for the
MC_Thread to perform some work and subsequently unblock the MC_Thread

The fix is to call SME function to post a command to
the PMC queue (MC_Thread) and there by unblocking the caller
immediately and process the command later when scheduled.

Change-Id: Icaf8105abcc3cbec9670e39f0a5b4dd1340f9d46
CRs-Fixed: 589921
wlan: Panic if there is a WDI timeout during SSR

We have seen instances where the first WDI message (NV Download) from
the host driver times out after SSR. A WDI timeout during SSR cannot be
handled, so invoke panic to collect more logs on this failure.

Change-Id: Ib59ec833297affddc83653da54c9b9faf6a4d7da
CRs-Fixed: 537018
DroidSec: Check sscanf returns in function iw_set_power_params

Return values from the two sscanf calls in this function must
be checked to confirm that parameters were parsed correctly before
proceeding to use them.

Change-Id: Ifbdb7d2366a580d081dc5173fc2c0eb2aa889d42
CRs-fixed: 554545
wlan: fix of kernel panic issue in SAP mode

In SAP mode batch scan un-initialized mutex is acquired which
is leading to kernel panic.

Change-Id: I054d309b8788161a1ab7749d8c0b5cac848c30fe
CRs-fixed: 590915
Merge "Merge "Merge "wlan: wait for thread execution to stop before exiting the driver"""
Merge "Merge "wlan: wait for thread execution to stop before exiting the driver""
wlan: Priority to country in .ini over country in hostapd.conf

The country code in .ini was overwritten by country code in hostapd.conf
during start_bss.

Now when the country code is present in .ini during start_bss, we will
ignore the country in hostapd.conf and set the country from .ini .

Change-Id: Ie128b63b3133a00d4ffa35b2b1b236657e073e1c
CRs-fixed: 566810
Merge "wlan: Fix string termination and integer out of bound errors"
Fix for Immediate block-ack bit not set in the capability info

Though driver supports immediate block ack, the corresponding bit
in the capability info of beacons is not set in the current driver
this commit sets the immediate block ack support bit in capability
information of beacons

Change-Id: Ib9b64c8fbdd5abae33266be4bb3a1166e4c8fcee
CRs-fixed: 579391

Conflicts:
	firmware_bin/WCNSS_cfg.dat
Merge "Merge "Merge "wlan: wait for thread execution to stop before exiting the driver"""
Merge "Merge "wlan: wait for thread execution to stop before exiting the driver""
Revert "wlan: Fix race condition for reliable delivery of action frames."

This reverts commit 5ceca36b86344ce120b8fa4b441c4d7081f1fc45.
This fix will notify supplicant about cancel remain on channel,
but in host a new remain on channel will be started.
Supplicant will come out of listen state and can send new remain
on channel event again. It's always better to tell supplicant about
all remain on channel event.

CRs-Fixed: 586753
Change-Id: I08fe57596083dc3e4fc6c2ea69f0475f57c560e9
Merge "Fix for Immediate block-ack bit not set in the capability info"
Merge "Merge "Merge "wlan: wait for thread execution to stop before exiting the driver"""
wlan: Replace snprintf with scnprintf

The function snprintf() do not write more than size bytes (including
the terminating null byte ('\0')). If the output was truncated due
to this limit then the return value is the number of characters
(excluding the terminating null byte) which would have been written
to the final string if enough space had been available. Thus, a
return value of size or more means that the output was truncated.

Change-Id: Iccf9648961e2ac9eeffa0f824a80fd3798be3870
CRs-Fixed: 548711
wlan: Fix DXE stop during SSR

DXE stop may fail during SSR, even if it fails continue to the next
channel, that will guarantee that the interrupt unregistration and
health monitor timer clean up will be performed.

CRs-Fixed: 566564
Change-Id: I50a1b9d2b10d412c9cb61b30d31a27511078b503
Merge "wlan: remove obsolete platform-specific code"