From 24584d4f0afc75faa57883dd694e0df61af0ad40 Mon Sep 17 00:00:00 2001
From: Peter Seiderer <ps.report@gmx.net>
Date: Sat, 2 Apr 2022 17:30:13 +0200
Subject: [PATCH] ath9k: fix ath_get_rate_txpower() to respect the rate list end tag
Mime-version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
Git-commit: 24584d4f0afc75faa57883dd694e0df61af0ad40
Patch-mainline: v5.19-rc1
References: bsc#1206451

Stop reading (and copying) from ieee80211_tx_rate to ath_tx_info.rates
after list end tag (count == 0, idx < 0), prevents copying of garbage
to card registers.

Note: no need to write to the remaining ath_tx_info.rates entries
as the complete ath_tx_info struct is already initialized to zero from
both call sites.

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220402153014.31332-1-ps.report@gmx.net
Acked-by: Takashi Iwai <tiwai@suse.de>

---
 drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d0caf1de2bde..ec9bad2d9510 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1271,7 +1271,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
 		int phy;
 
 		if (!rates[i].count || (rates[i].idx < 0))
-			continue;
+			break;
 
 		rix = rates[i].idx;
 		info->rates[i].Tries = rates[i].count;
-- 
2.35.3