cfg80211: util: fix bit count off by one

The bits of Rx MCS Map in VHT capability were enumerated
with index transform - index i -> (i + 1) bit => nss i. BUG!
while it should be -   index i -> (i + 1) bit => (i + 1) nss.

The bug was exposed in commit a53b2a0b1245 ("iwlwifi: mvm: implement VHT
extended NSS support in rs.c"), where iwlwifi started using the
function.

Signed-off-by: Mordechay Goodstein <[email protected]>
Fixes: b0aa75f0b1b2 ("ieee80211: add new VHT capability fields/parsing")
Signed-off-by: Luca Coelho <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>

diff --git a/net/wireless/util.c b/net/wireless/util.c
index b9d8ceb21327729889cc19f2fc4b8e0c3ff60865..1c39d6a2e85011aff8a4991473fdec387c93bdac 100644 (file)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1998,7 +1998,7 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
                        continue;
 
                if (supp >= mcs_encoding) {
-                       max_vht_nss = i;
+                       max_vht_nss = i + 1;
                        break;
                }
        }