[PATCH ath-next] wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

[Rameshkumar Sundaram]

On 7/1/2026 7:19 AM, Baochen Qiang wrote:
> ath11k can receive HT/VHT/HE frames whose reported MCS is above the
> maximum that can be expressed in the corresponding mac80211 rate space
> (e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).
> 
> The frame itself is valid and decodes correctly, but for such a frame
> ath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range
> value and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY
> from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches
> mac80211 it trips the rate sanity check and the frame is dropped with a
> splat:
> 
>    ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12
>    WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]
> 
> Dropping the frame would discard otherwise valid data, so instead cap the
> reported MCS to the maximum the rate space can express and deliver the
> frame. Set rx_status->encoding before the range check and assign rate_idx
> from the capped value, so a frame with an out-of-range MCS no longer
> leaves partial or bogus rate metadata behind. Also downgrade the logging
> level since they are not treated as invalid frames now. The only loss is
> that such a frame is reported as the capped MCS in the rx rate statistics.
> 
> Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
> 
> Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
> Signed-off-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram at oss.qualcomm.com>