mac80211_hwsim_get_tx_rate() calls ieee80211_get_tx_rate()
without checking whether the rate index is valid.

A monitor frame with an invalid or missing legacy rate can leave
rates[0].idx set to -1. This triggers the WARN_ON_ONCE() in
ieee80211_get_tx_rate().

Treat a negative rate index like the existing MCS/VHT case and
return NULL. The caller already handles a missing tx rate.

Reported-by: syzbot+847847e76c6983a5b3dd@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=847847e76c6983a5b3dd
Signed-off-by: Adi Prasan <itsadi2409@gmail.com>
---
 drivers/net/wireless/virtual/mac80211_hwsim_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 02b6d81cccd1..e7bf91e06e40 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -1332,6 +1332,9 @@ mac80211_hwsim_get_tx_rate(struct ieee80211_hw *hw,
 	    (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
 		return NULL;
 
+	if (info->control.rates[0].idx < 0)
+		return NULL;
+
 	return ieee80211_get_tx_rate(hw, info);
 }
 
-- 
2.43.0