P2P: Fix GO Probe Response IEs when Wi-Fi Display is enabled

Commit 1a9f6509b3a711071c12006ff7c3a9cb2a6691f2 added support for
fragmenting the P2P IE in Probe Response frames from a GO. However, it
did not take into account the possibility of Wi-Fi Display IE being
included in the same buffer and caused a regression for the cases where
Wi-Fi Display is enabled. Fix this by building the possibly fragmented
P2P IE first and then concatenating the separate IEs together.

Bug: 8225922
Change-Id: I3c11c4558506f2324f883bb555f025b535b9e40e
diff --git a/src/p2p/p2p_group.c b/src/p2p/p2p_group.c
index 633dd5c..9559e44 100644
--- a/src/p2p/p2p_group.c
+++ b/src/p2p/p2p_group.c
@@ -402,22 +402,11 @@
 	u8 *group_info;
 	struct wpabuf *p2p_subelems, *ie;
 	struct p2p_group_member *m;
-	size_t extra = 0;
 
-#ifdef CONFIG_WIFI_DISPLAY
-	if (group->wfd_ie)
-		extra += wpabuf_len(group->wfd_ie);
-#endif /* CONFIG_WIFI_DISPLAY */
-
-	p2p_subelems = wpabuf_alloc(500 + extra);
+	p2p_subelems = wpabuf_alloc(500);
 	if (p2p_subelems == NULL)
 		return NULL;
 
-#ifdef CONFIG_WIFI_DISPLAY
-	if (group->wfd_ie)
-		wpabuf_put_buf(p2p_subelems, group->wfd_ie);
-#endif /* CONFIG_WIFI_DISPLAY */
-
 	p2p_group_add_common_ies(group, p2p_subelems);
 	p2p_group_add_noa(p2p_subelems, group->noa);
 
@@ -436,6 +425,13 @@
 	ie = p2p_group_encaps_probe_resp(p2p_subelems);
 	wpabuf_free(p2p_subelems);
 
+#ifdef CONFIG_WIFI_DISPLAY
+	if (group->wfd_ie) {
+		struct wpabuf *wfd = wpabuf_dup(group->wfd_ie);
+		ie = wpabuf_concat(wfd, ie);
+	}
+#endif /* CONFIG_WIFI_DISPLAY */
+
 	return ie;
 }