If the driver doesn't fill NL80211_STA_INFO_TX_BITRATE in sta_set_sinfo()
then as a fallback sta->deflink.tx_stats.last_rate is used.  Unfortunately
there's no guarantee that this has actually been set before it's used.
Originally found when 'iw <dev> link' would always return a tx rate of
6Mbps regardless of actual link speed for the QCA9337 running firmware
WLAN.TF.2.1-00021-QCARMSWP-1 in my netbook.
Use the sanity check logic from ieee80211_fill_rx_status() and refactor
that to use the new inline function.
Signed-off-by: Stephen Douthit <stephen.douthit@gmail.com>
Link: https://lore.kernel.org/r/20230213204024.3377-1-stephen.douthit@gmail.com
[change to bool ..._rate_valid() instead of int ..._rate_invalid()]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 #define IEEE80211_MAX_TX_RETRY         31
 
+static inline bool ieee80211_rate_valid(struct ieee80211_tx_rate *rate)
+{
+       return rate->idx >= 0 && rate->count > 0;
+}
+
 static inline void ieee80211_rate_set_vht(struct ieee80211_tx_rate *rate,
                                          u8 mcs, u8 nss)
 {
 
        if (ieee80211_fill_rate_info(hw, stat, band, ri))
                return 0;
 
-       if (rate->idx < 0 || !rate->count)
+       if (!ieee80211_rate_valid(rate))
                return -1;
 
        if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
 
        }
 
        if (!(sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) &&
-           !sta->sta.valid_links) {
+           !sta->sta.valid_links &&
+           ieee80211_rate_valid(&sta->deflink.tx_stats.last_rate)) {
                sta_set_rate_info_tx(sta, &sta->deflink.tx_stats.last_rate,
                                     &sinfo->txrate);
                sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);