wlan: LFR - invalid channel in INI causes double free.

The crash is happening because of a double free in csrScanCopyRequest.

In csrScanCopyRequest, palCopyMemory is called which copies contents of
tCsrScanRequest from pSrcReq to pDstReq. This will include the address
of pointers as well (i.e. pIEField, ChannelList and SSIDList). Due to a
recent commit in CL663677, we ignore the scan request if the channel is
invalid to prevent spawning scans on ALL valid channels. When the scan
request is ignored, csrScanFreeRequest gets called for both pDstReq
(first) as well as pSrcReq. When we decide to ignore the scan request
due to invalid channel, SSIDList in pDstReq will point to the address
that was copied from pSrcReq. Due to this, we end up double freeing the
memory at address pSrcReq->SSIDs.SSIDList.

This is being addressed by re-initializing all the pointer variables in
pDstReq after the palCopyMemory.

When the scan request is ignored due to an invalid channel, there
will not be a scan callback because the request command was never
sent to PE. Due to this the roaming engine gets stuck and remains in
eCSR_NEIGHBOR_ROAM_STATE_CFG_CHAN_LIST_SCAN. This is being fixed by
calling csrNeighborRoamScanRequestCallback if the scan request
fails to unblock the roaming state machine.

Change-Id: I68f79e1a7cb640140968012fc646cf1bd0268a6b
CR-Fixed: 434971
(cherry picked from commit c7b1d3e9ad417c37b4923899780181e0a6196e97)
wlan: TX_Thread Spinng problem fix

If MGMT Q has pending frame, even AC Mask is DATA frames only,
WLANTL_GetFrames will retunr none 0 value.
This will make DXE indicate that DXE is out from low resource condition
and keep triggering to get frame from data Q.

Change-Id: I31e2d8f4fd1dd7e11d2ca705ee229db224ca2f05
CR-Fixed: 435323
(cherry picked from commit 7e48ca7b1f8054c33b0a8825367b7418e4ddc23e)
wlan: Kernel crash from freeing bss list

Data abort while traversing bss link list as next pointer is
NULL.Therfore we should reset ''pMac->ft.ftPEContext.pFTPreAuthReq' to
NULL, causing the FT session object not to
be checked for freeing in 'limFTCleanup'

Change-Id: I70eba6f1619f2d51bddf248f9ecf7a741586bf30
CR-Fixed: 436485
(cherry picked from commit 2d335f3ff97a4da06e1c3d6d4365ca5c2e2d49ec)
Merge branch 'cm-11.0' into kk_mkt