wext: fix maxrate calculation

When scan results got moved from wpa_scan_result -> wpa_scan_res, the
'maxrate' member was dropped from wpa_scan_res.  The D-Bus interface
used 'maxrate', which was replaced with wpa_scan_get_max_rate().
Unfortunately, wpa_scan_get_max_rate() returns 802.11 rate values
directly from the IE, where 'maxrate' was the rate in bits/second.  The
supplicant internally fakes an IE for wpa_scan_res from the value of
wpa_scan_result->maxrate, but interprets ->maxrate as an 802.11 rate
index.

As a side-effect, this fixes a soft-break of the D-Bus control API since
the wpa_scan_res change was introduced.

src/drivers/driver_nl80211.c

@@ -1237,7 +1237,11 @@ static void wext_get_scan_rate(struct iw_event *iwe,
 		clen -= sizeof(struct iw_param);
 		custom += sizeof(struct iw_param);
 	}
-	res->maxrate = maxrate;
+
+	/* Convert the maxrate from WE-style (b/s units) to
+	 * 802.11 rates (500000 b/s units).
+	 */
+	res->maxrate = maxrate / 500000;
 }
 
 

src/drivers/driver_wext.c

@@ -1364,7 +1364,11 @@ static void wext_get_scan_rate(struct iw_event *iwe,
 		clen -= sizeof(struct iw_param);
 		custom += sizeof(struct iw_param);
 	}
-	res->maxrate = maxrate;
+
+	/* Convert the maxrate from WE-style (b/s units) to
+	 * 802.11 rates (500000 b/s units).
+	 */
+	res->maxrate = maxrate / 500000;
 }
 
 

wpa_supplicant/ctrl_iface_dbus_handlers.c

@@ -435,7 +435,7 @@ DBusMessage * wpas_dbus_bssid_properties(DBusMessage *message,
 	if (!wpa_dbus_dict_append_int32(&iter_dict, "level", res->level))
 		goto error;
 	if (!wpa_dbus_dict_append_int32(&iter_dict, "maxrate",
-					wpa_scan_get_max_rate(res)))
+					wpa_scan_get_max_rate(res) * 500000))
 		goto error;
 
 	if (!wpa_dbus_dict_close_write(&iter, &iter_dict))