Skip to contentSkip to conversation

wireless: wext: export each WEP key size only once

PATCH In review Ren Wei 3 participants 3 messages May 27 – May 31 1 message not in the archive 802.11 (including cfg80211/NL80211)

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Ren Wei

author
#1 lore raw

PATCH 1/1 wireless: wext: export each WEP key size only once

From: Yuqi Xu <[email protected]>

cfg80211_wext_giwrange() fills iw_range.encoding_size[] from the cipher suites advertised by the wiphy. The WEXT range data describes supported key sizes, but the current code appends one entry for every WEP cipher occurrence.

A wiphy may expose repeated WEP cipher entries, which can make cfg80211_wext_giwrange() grow num_encoding_sizes past the available encoding_size[] slots. Track whether WEP40 and WEP104 are present while scanning the cipher list, then emit each corresponding key size once.

This keeps the exported WEXT data aligned with the supported key sizes and makes duplicate cipher entries irrelevant.

Fixes 2ab658f9ce21 ("cfg80211: set WE encoding size based on available ciphers")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Reported-by Zhengchuan Liang <[email protected]>
Reported-by Xin Liu <[email protected]>
Assisted-by Codex:GPT-5.4
Signed-off-by Yuqi Xu <[email protected]>
Signed-off-by Ren Wei <[email protected]>
---
 net/wireless/wext-compat.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)
net/wireless/wext-compat.c +10 -4
index 22d9d9bae8f5..6d64facd8115 100644
@@ -109,6 +109,7 @@ int cfg80211_wext_giwrange(struct net_device *dev,
 	struct iw_point *data = &wrqu->data;
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 	struct iw_range *range = (struct iw_range *) extra;
+	bool have_wep40 = false, have_wep104 = false;
 	enum nl80211_band band;
 	int i, c = 0;
 

@@ -170,17 +171,22 @@ int cfg80211_wext_giwrange(struct net_device *dev,
 			break;
 
 		case WLAN_CIPHER_SUITE_WEP40:
-			range->encoding_size[range->num_encoding_sizes++] =
-				WLAN_KEY_LEN_WEP40;
+			have_wep40 = true;
 			break;
 
 		case WLAN_CIPHER_SUITE_WEP104:
-			range->encoding_size[range->num_encoding_sizes++] =
-				WLAN_KEY_LEN_WEP104;
+			have_wep104 = true;
 			break;
 		}
 	}
 
+	if (have_wep40)
+		range->encoding_size[range->num_encoding_sizes++] =
+			WLAN_KEY_LEN_WEP40;
+	if (have_wep104)
+		range->encoding_size[range->num_encoding_sizes++] =
+			WLAN_KEY_LEN_WEP104;
+
 	for (band = 0; band < NUM_NL80211_BANDS; band ++) {
 		struct ieee80211_supported_band *sband;
Signature · 1 line
2.54.0
maintainer
#2 lore raw
Quoted 16 lines · Ren Wei

From: Yuqi Xu <[email protected]>

cfg80211_wext_giwrange() fills iw_range.encoding_size[] from the cipher suites advertised by the wiphy. The WEXT range data describes supported key sizes, but the current code appends one entry for every WEP cipher occurrence.

A wiphy may expose repeated WEP cipher entries, which can make cfg80211_wext_giwrange() grow num_encoding_sizes past the available encoding_size[] slots. Track whether WEP40 and WEP104 are present while scanning the cipher list, then emit each corresponding key size once.

This keeps the exported WEXT data aligned with the supported key sizes and makes duplicate cipher entries irrelevant.

Quoted 9 lines
Fixes 2ab658f9ce21 ("cfg80211: set WE encoding size based on available ciphers")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Reported-by Zhengchuan Liang <[email protected]>
Reported-by Xin Liu <[email protected]>
Assisted-by Codex:GPT-5.4

Please **always** check if the issue has been fixed already...

johannes

#3 lore raw
Quoted 27 lines · Johannes Berg
Quoted 16 lines · Ren Wei

From: Yuqi Xu <[email protected]>

cfg80211_wext_giwrange() fills iw_range.encoding_size[] from the cipher suites advertised by the wiphy. The WEXT range data describes supported key sizes, but the current code appends one entry for every WEP cipher occurrence.

A wiphy may expose repeated WEP cipher entries, which can make cfg80211_wext_giwrange() grow num_encoding_sizes past the available encoding_size[] slots. Track whether WEP40 and WEP104 are present while scanning the cipher list, then emit each corresponding key size once.

This keeps the exported WEXT data aligned with the supported key sizes and makes duplicate cipher entries irrelevant.

Quoted 9 lines
Fixes 2ab658f9ce21 ("cfg80211: set WE encoding size based on available ciphers")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Reported-by Zhengchuan Liang <[email protected]>
Reported-by Xin Liu <[email protected]>
Assisted-by Codex:GPT-5.4
Quoted 1 line

Please **always** check if the issue has been fixed already...

I re-checked the current public trees and searched the public mailing list archives, but I could not find any fix for this issue.

The current public code in both netdev/net and torvalds/linux still has the same logic in cfg80211_wext_giwrange():

        case WLAN_CIPHER_SUITE_WEP40:
                range->encoding_size[range->num_encoding_sizes++] =
                        WLAN_KEY_LEN_WEP40;
                break;
        case WLAN_CIPHER_SUITE_WEP104:
                range->encoding_size[range->num_encoding_sizes++] =
                        WLAN_KEY_LEN_WEP104;
                break;

So as far as I can tell, this issue is still present.

Thanks,
Yuqi