Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> The sband->bitrates[] array has "sband->n_bitrates" elements so this
> check needs to be >= instead of > or we could read beyond the end of the
> array.
>
> These values come from when we call mt76_register_device():
>
> ret = mt76_register_device(&dev->mt76, true, mt7603_rates,
> ARRAY_SIZE(mt7603_rates));
>
> Here sband->bitrates[] is mt7603_rates[] and ->n_bitrates is the
> ARRAY_SIZE()
>
> Fixes: 5ce09c1a7907 ("mt76: track rx airtime for airtime fairness and survey")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Patch applied to wireless-drivers.git, thanks.
b43e36d75e87 mt76: Off by one in mt76_calc_rx_airtime()
--
https://patchwork.kernel.org/patch/11261391/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
