wifi: mac80211_hwsim: handle invalid tx rate index

mac80211_hwsim_get_tx_rate() calls ieee80211_get_tx_rate() without checking whether the rate index is valid.

A monitor frame with an invalid or missing legacy rate can leave rates[0].idx set to -1. This triggers the WARN_ON_ONCE() in ieee80211_get_tx_rate().

Treat a negative rate index like the existing MCS/VHT case and return NULL. The caller already handles a missing tx rate.

---
 drivers/net/wireless/virtual/mac80211_hwsim_main.c | 3 +++
 1 file changed, 3 insertions(+)

index 02b6d81cccd1..e7bf91e06e40 100644
@@ -1332,6 +1332,9 @@ mac80211_hwsim_get_tx_rate(struct ieee80211_hw *hw,
 	    (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
 		return NULL;
 
+	if (info->control.rates[0].idx < 0)
+		return NULL;
+
 	return ieee80211_get_tx_rate(hw, info);
 }
 

2.43.0