From: Mordechay Goodstein <mordechay.goodstein@intel.com>
Date: Wed, 29 May 2019 12:25:31 +0000 (+0300)
Subject: cfg80211: util: fix bit count off by one
X-Git-Tag: v5.4-rc1~783^2~21^2~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1a473d6092d5d182914bea854ce0b21e6d12519d;p=platform%2Fkernel%2Flinux-rpi.git

cfg80211: util: fix bit count off by one

The bits of Rx MCS Map in VHT capability were enumerated
with index transform - index i -> (i + 1) bit => nss i. BUG!
while it should be -   index i -> (i + 1) bit => (i + 1) nss.

The bug was exposed in commit a53b2a0b1245 ("iwlwifi: mvm: implement VHT
extended NSS support in rs.c"), where iwlwifi started using the
function.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: b0aa75f0b1b2 ("ieee80211: add new VHT capability fields/parsing")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

diff --git a/net/wireless/util.c b/net/wireless/util.c
index b9d8ceb..1c39d6a 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1998,7 +1998,7 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
 			continue;
 
 		if (supp >= mcs_encoding) {
-			max_vht_nss = i;
+			max_vht_nss = i + 1;
 			break;
 		}
 	}