mac80211: minstrel: fix tx status processing corner case

BugLink: https://bugs.launchpad.net/bugs/1908561
commit b2911a84396f72149dce310a3b64d8948212c1b3 upstream.

Some drivers fill the status rate list without setting the rate index after
the final rate to -1. minstrel_ht already deals with this, but minstrel
doesn't, which causes it to get stuck at the lowest rate on these drivers.

Fix this by checking the count as well.

Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-3-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Ian May <ian.may@canonical.com>

diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 4738c842b160b551554f3291b3fd7e85d62ac799..7227343551e99fc4ce6ff5f08012198506871a76 100644 (file)
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -270,7 +270,7 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
        success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-               if (ar[i].idx < 0)
+               if (ar[i].idx < 0 || !ar[i].count)
                        break;
 
                ndx = rix_to_ndx(mi, ar[i].idx);