mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference

1) Using fwctx variable after brcmf_fw_request_done() was executed meant
   accessing freed memory.
2) Using fwctx->completion for the wait_for_completion_timeout() call
   could reuslt in NULL pointer dereference on fw loading error or if
   brcmf_fw_request_done() was executed quickly enough.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 529c95cc15)

package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch

@@ -88,9 +88,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
  				       GFP_KERNEL, fwctx,
  				       brcmf_fw_request_code_done);
 +	if (!err)
-+		wait_for_completion_timeout(fwctx->completion,
++		wait_for_completion_timeout(&completion,
 +					    msecs_to_jiffies(5000));
-+	fwctx->completion = NULL;
++
 +	return err;
  }