From: Yuqi Xu cfg80211_wext_giwrange() fills iw_range.encoding_size[] from the cipher suites advertised by the wiphy. The WEXT range data describes supported key sizes, but the current code appends one entry for every WEP cipher occurrence. A wiphy may expose repeated WEP cipher entries, which can make cfg80211_wext_giwrange() grow num_encoding_sizes past the available encoding_size[] slots. Track whether WEP40 and WEP104 are present while scanning the cipher list, then emit each corresponding key size once. This keeps the exported WEXT data aligned with the supported key sizes and makes duplicate cipher entries irrelevant. Fixes: 2ab658f9ce21 ("cfg80211: set WE encoding size based on available ciphers") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Yuqi Xu Signed-off-by: Ren Wei --- net/wireless/wext-compat.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c index 22d9d9bae8f5..6d64facd8115 100644 --- a/net/wireless/wext-compat.c +++ b/net/wireless/wext-compat.c @@ -109,6 +109,7 @@ int cfg80211_wext_giwrange(struct net_device *dev, struct iw_point *data = &wrqu->data; struct wireless_dev *wdev = dev->ieee80211_ptr; struct iw_range *range = (struct iw_range *) extra; + bool have_wep40 = false, have_wep104 = false; enum nl80211_band band; int i, c = 0; @@ -170,17 +171,22 @@ int cfg80211_wext_giwrange(struct net_device *dev, break; case WLAN_CIPHER_SUITE_WEP40: - range->encoding_size[range->num_encoding_sizes++] = - WLAN_KEY_LEN_WEP40; + have_wep40 = true; break; case WLAN_CIPHER_SUITE_WEP104: - range->encoding_size[range->num_encoding_sizes++] = - WLAN_KEY_LEN_WEP104; + have_wep104 = true; break; } } + if (have_wep40) + range->encoding_size[range->num_encoding_sizes++] = + WLAN_KEY_LEN_WEP40; + if (have_wep104) + range->encoding_size[range->num_encoding_sizes++] = + WLAN_KEY_LEN_WEP104; + for (band = 0; band < NUM_NL80211_BANDS; band ++) { struct ieee80211_supported_band *sband; -- 2.54.0