Dan Carpenter <dan.carpenter@xxxxxxxxxx> writes:
> The sband->bitrates[] array has "sband->n_bitrates" elements so this
> check needs to be >= instead of > or we could read beyond the end of the
> array.
>
> These values come from when we call mt76_register_device():
>
> ret = mt76_register_device(&dev->mt76, true, mt7603_rates,
> ARRAY_SIZE(mt7603_rates));
>
> Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the
> ARRAY_SIZE()
>
> Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Should I queue this to v5.5?
--
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
