The branch main has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=85f499be90c15a3de02d1c62ce03b99fab52f925
commit 85f499be90c15a3de02d1c62ce03b99fab52f925 Author: Zhenlei Huang <[email protected]> AuthorDate: 2025-12-29 14:20:12 +0000 Commit: Zhenlei Huang <[email protected]> CommitDate: 2025-12-29 14:20:12 +0000 qlnxe: Avoid out-of-bounds reading the multicast ethernet address The correct length of an ethernet address is ETHER_ADDR_LEN but not ETHER_HDR_LEN. MFC after: 1 week --- sys/dev/qlnx/qlnxe/qlnx_os.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/qlnx/qlnxe/qlnx_os.c b/sys/dev/qlnx/qlnxe/qlnx_os.c index 9963f472c615..99110e5e2d8f 100644 --- a/sys/dev/qlnx/qlnxe/qlnx_os.c +++ b/sys/dev/qlnx/qlnxe/qlnx_os.c @@ -2539,7 +2539,7 @@ qlnx_hw_set_multi(qlnx_host_t *ha, uint8_t *mta, uint32_t mcnt, break; } - mta += ETHER_HDR_LEN; + mta += ETHER_ADDR_LEN; } return; } @@ -2552,7 +2552,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) if (mcnt == QLNX_MAX_NUM_MULTICAST_ADDRS) return (0); - bcopy(LLADDR(sdl), &mta[mcnt * ETHER_HDR_LEN], ETHER_HDR_LEN); + bcopy(LLADDR(sdl), &mta[mcnt * ETHER_ADDR_LEN], ETHER_ADDR_LEN); return (1); } @@ -2560,7 +2560,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) static int qlnx_set_multi(qlnx_host_t *ha, uint32_t add_multi) { - uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_HDR_LEN]; + uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_ADDR_LEN]; if_t ifp = ha->ifp; u_int mcnt;
