Hello, On Sun, 27. Apr 08:39, Stanislaw Gruszka wrote: > > diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > index 78dee8ccfebf..f60d9b9798c1 100644 > > --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, > > */ > > rate_idx = info->control.rates[0].idx; > > if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 > > - || rate_idx > RATE_COUNT_LEGACY) > > + || rate_idx >= RATE_COUNT_LEGACY) > > rate_idx = rate_lowest_index(&il->bands[info->band], sta); > > .. so looks the check is fine already and changing it will induce a bug > for RATE_54M_INDEX. > > Regards > Stanislaw > > > /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ > > if (info->band == NL80211_BAND_5GHZ) Here goes the fragment: rate_idx += IL_FIRST_OFDM_RATE; /* Get PLCP rate for tx_cmd->rate_n_flags */ rate_plcp = il_rates[rate_idx].plcp; > > -- > > 2.39.5 (Apple Git-154) > > Looks like the proper checks should be added to address the 5GHZ case and validate that the index won't exceed the array boundaries after being shifted by IL_FIRST_OFDM_RATE. -- Thanks, Fedor
