Date: Sat, 31 Jan 2026 17:04:50 +0000 From: Zhenlei Huang <zlei@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 2b01cc154472 - stable/15 - qlnxe: Avoid out-of-bounds reading the multicast ethernet address Message-ID: <697e3632.186cc.76ca9ab4@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=2b01cc15447251862f5e25332fcbf41516f22a3e commit 2b01cc15447251862f5e25332fcbf41516f22a3e Author: Zhenlei Huang <zlei@FreeBSD.org> AuthorDate: 2025-12-29 14:20:12 +0000 Commit: Zhenlei Huang <zlei@FreeBSD.org> CommitDate: 2026-01-31 17:01:11 +0000 qlnxe: Avoid out-of-bounds reading the multicast ethernet address The correct length of an ethernet address is ETHER_ADDR_LEN but not ETHER_HDR_LEN. MFC after: 1 week (cherry picked from commit 85f499be90c15a3de02d1c62ce03b99fab52f925) --- sys/dev/qlnx/qlnxe/qlnx_os.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/qlnx/qlnxe/qlnx_os.c b/sys/dev/qlnx/qlnxe/qlnx_os.c index 9963f472c615..99110e5e2d8f 100644 --- a/sys/dev/qlnx/qlnxe/qlnx_os.c +++ b/sys/dev/qlnx/qlnxe/qlnx_os.c @@ -2539,7 +2539,7 @@ qlnx_hw_set_multi(qlnx_host_t *ha, uint8_t *mta, uint32_t mcnt, break; } - mta += ETHER_HDR_LEN; + mta += ETHER_ADDR_LEN; } return; } @@ -2552,7 +2552,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) if (mcnt == QLNX_MAX_NUM_MULTICAST_ADDRS) return (0); - bcopy(LLADDR(sdl), &mta[mcnt * ETHER_HDR_LEN], ETHER_HDR_LEN); + bcopy(LLADDR(sdl), &mta[mcnt * ETHER_ADDR_LEN], ETHER_ADDR_LEN); return (1); } @@ -2560,7 +2560,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) static int qlnx_set_multi(qlnx_host_t *ha, uint32_t add_multi) { - uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_HDR_LEN]; + uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_ADDR_LEN]; if_t ifp = ha->ifp; u_int mcnt;home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?697e3632.186cc.76ca9ab4>