1 files changed, 12 insertions, 6 deletions

diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index e1c4502b26bf..51dca21f77c7 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -73,17 +73,23 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
+        if (idx < 0 || idx >= NUM_DEFAULT_KEYS) {
+                printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
+                       dev->name, idx);
+                return -EINVAL;
+        }
+
         if (is_broadcast_ether_addr(sta_addr)) {
                 sta = NULL;
-                if (idx >= NUM_DEFAULT_KEYS) {
-                        printk(KERN_DEBUG "%s: set_encrypt - invalid idx=%d\n",
-                               dev->name, idx);
-                        return -EINVAL;
-                }
                 key = sdata->keys[idx];
         } else {
                 set_tx_key = 0;
-                if (idx != 0) {
+                /*
+                 * According to the standard, the key index of a pairwise
+                 * key must be zero. However, some AP are broken when it
+                 * comes to WEP key indices, so we work around this.
+                 */
+                if (idx != 0 && alg != ALG_WEP) {
                         printk(KERN_DEBUG "%s: set_encrypt - non-zero idx for "
                                "individual key\n", dev->name);
                         return -EINVAL;