]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: cfg80211: Fix bitrate calculation overflow for HE rates
authorVeerendranath Jakkam <veerendranath.jakkam@oss.qualcomm.com>
Fri, 9 Jan 2026 15:00:04 +0000 (20:30 +0530)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 12 Jan 2026 18:35:12 +0000 (19:35 +0100)
commita3034bf0746d88a00cceda9541534a5721445a24
tree1c0bbe361b68303049e43262aa132e685acc90b5
parent4f431d88ea8093afc7ba55edf4652978c5a68f33
wifi: cfg80211: Fix bitrate calculation overflow for HE rates

An integer overflow occurs in cfg80211_calculate_bitrate_he() when
calculating bitrates for high throughput HE configurations.
For example, with 160 MHz bandwidth, HE-MCS 13, HE-NSS 4, and HE-GI 0,
the multiplication (result * rate->nss) overflows the 32-bit 'result'
variable before division by 8, leading to significantly underestimated
bitrate values.

The overflow occurs because the NSS multiplication operates on a 32-bit
integer that cannot accommodate intermediate values exceeding
4,294,967,295. When overflow happens, the value wraps around, producing
incorrect bitrates for high MCS and NSS combinations.

Fix this by utilizing the 64-bit 'tmp' variable for the NSS
multiplication and subsequent divisions via do_div(). This approach
preserves full precision throughout the entire calculation, with the
final value assigned to 'result' only after completing all operations.

Signed-off-by: Veerendranath Jakkam <veerendranath.jakkam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260109-he_bitrate_overflow-v1-1-95575e466b6e@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/util.c