git: 8f6561e8adbd - stable/15 - ixv: fix multicast address enumeration
Date: Sat, 08 Aug 2026 00:38:17 UTC
The branch stable/15 has been updated by kbowling:
URL: https://cgit.FreeBSD.org/src/commit/?id=8f6561e8adbd07f52278b5a404c72d5c9643b471
commit 8f6561e8adbd07f52278b5a404c72d5c9643b471
Author: Kevin Bowling <kbowling@FreeBSD.org>
AuthorDate: 2026-07-28 11:06:23 +0000
Commit: Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-08-08 00:34:24 +0000
ixv: fix multicast address enumeration
if_foreach_llmaddr() adds each callback return value to its running
count. Returning the incremented count made the address indices grow
as 0, 1, 3, 7, and so on, eventually writing beyond the multicast
address array.
Return one address per callback and stop copying when the array is
full, matching the ixv-1.6.12 driver.
Fixes: ff06a8dbb677 ("Mechanically convert ixgbe(4) to IfAPI")
(cherry picked from commit 6020de5ad154d54c8b9a838f28612c2182330c67)
---
sys/dev/ixgbe/if_ixv.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sys/dev/ixgbe/if_ixv.c b/sys/dev/ixgbe/if_ixv.c
index 8a1c1aae041d..24e6fa714a7b 100644
--- a/sys/dev/ixgbe/if_ixv.c
+++ b/sys/dev/ixgbe/if_ixv.c
@@ -842,11 +842,14 @@ ixv_negotiate_api(struct ixgbe_softc *sc)
static u_int
ixv_if_multi_set_cb(void *cb_arg, struct sockaddr_dl *addr, u_int cnt)
{
+ if (cnt >= MAX_NUM_MULTICAST_ADDRESSES)
+ return (0);
+
bcopy(LLADDR(addr),
&((u8 *)cb_arg)[cnt * IXGBE_ETH_LENGTH_OF_ADDRESS],
IXGBE_ETH_LENGTH_OF_ADDRESS);
- return (++cnt);
+ return (1);
}
/************************************************************************
@@ -1982,4 +1985,3 @@ ixv_init_device_features(struct ixgbe_softc *sc)
if (sc->feat_cap & IXGBE_FEATURE_NEEDS_CTXD)
sc->feat_en |= IXGBE_FEATURE_NEEDS_CTXD;
} /* ixv_init_device_features */
-