git: f119719571b8 - stable/13 - lio: Avoid out-of-bounds read or write MAC address

The branch stable/13 has been updated by zlei:

URL: https://cgit.FreeBSD.org/src/commit/?id=f119719571b84e00efe05c1c3bce7b9ada9fd776

commit f119719571b84e00efe05c1c3bce7b9ada9fd776
Author:     Zhenlei Huang <zlei@FreeBSD.org>
AuthorDate: 2025-12-16 04:41:02 +0000
Commit:     Zhenlei Huang <zlei@FreeBSD.org>
CommitDate: 2026-01-31 18:42:41 +0000

    lio: Avoid out-of-bounds read or write MAC address
    
    While here, replace loop copying the MAC address with memcpy() for
    better readability.
    
    Reviewed by:    markj
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D54177
    
    (cherry picked from commit 094626d3a5009a56bf1b763dbdfc681ce371dc99)
    (cherry picked from commit c162d7febbc83c1d877876b18ee864213dceca51)
    (cherry picked from commit e8de565f6bb8d91e2882ae5422b8a4a0337e4ca4)
---
 sys/dev/liquidio/lio_ioctl.c |  4 ++--
 sys/dev/liquidio/lio_main.c  | 10 ++++------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/sys/dev/liquidio/lio_ioctl.c b/sys/dev/liquidio/lio_ioctl.c
index 449bc0219798..8d918e4f54be 100644
--- a/sys/dev/liquidio/lio_ioctl.c
+++ b/sys/dev/liquidio/lio_ioctl.c
@@ -443,7 +443,7 @@ lio_set_mac(struct ifnet *ifp, uint8_t *p)
 
 	nctrl.udd[0] = 0;
 	/* The MAC Address is presented in network byte order. */
-	memcpy((uint8_t *)&nctrl.udd[0] + 2, p, ETHER_HDR_LEN);
+	memcpy((uint8_t *)&nctrl.udd[0] + 2, p, ETHER_ADDR_LEN);
 
 	ret = lio_send_ctrl_pkt(lio->oct_dev, &nctrl);
 	if (ret < 0) {
@@ -451,7 +451,7 @@ lio_set_mac(struct ifnet *ifp, uint8_t *p)
 		return (ENOMEM);
 	}
 
-	memcpy(((uint8_t *)&lio->linfo.hw_addr) + 2, p, ETHER_HDR_LEN);
+	memcpy(((uint8_t *)&lio->linfo.hw_addr) + 2, p, ETHER_ADDR_LEN);
 
 	return (0);
 }
diff --git a/sys/dev/liquidio/lio_main.c b/sys/dev/liquidio/lio_main.c
index 92a3a4fb3776..b57c18e94302 100644
--- a/sys/dev/liquidio/lio_main.c
+++ b/sys/dev/liquidio/lio_main.c
@@ -1236,7 +1236,7 @@ lio_setup_nic_devices(struct octeon_device *octeon_dev)
 	unsigned int	gmx_port_id;
 	uint32_t	ctx_size, data_size;
 	uint32_t	ifidx_or_pfnum, resp_size;
-	uint8_t		mac[ETHER_HDR_LEN], i, j;
+	uint8_t		mac[ETHER_ADDR_LEN], i, j;
 
 	/* This is to handle link status changes */
 	lio_register_dispatch_fn(octeon_dev, LIO_OPCODE_NIC,
@@ -1379,9 +1379,7 @@ lio_setup_nic_devices(struct octeon_device *octeon_dev)
 		lio_init_ifnet(lio);
 		/* 64-bit swap required on LE machines */
 		lio_swap_8B_data(&lio->linfo.hw_addr, 1);
-		for (j = 0; j < 6; j++)
-			mac[j] = *((uint8_t *)(
-				   ((uint8_t *)&lio->linfo.hw_addr) + 2 + j));
+		memcpy(mac, (uint8_t *)&lio->linfo.hw_addr + 2, ETHER_ADDR_LEN);
 
 		ether_ifattach(ifp, mac);
 
@@ -1588,7 +1586,7 @@ lio_open(void *arg)
 	struct lio	*lio = arg;
 	struct ifnet	*ifp = lio->ifp;
 	struct octeon_device	*oct = lio->oct_dev;
-	uint8_t	*mac_new, mac_old[ETHER_HDR_LEN];
+	uint8_t	*mac_new, mac_old[ETHER_ADDR_LEN];
 	int	ret = 0;
 
 	lio_ifstate_set(lio, LIO_IFSTATE_RUNNING);
@@ -1602,7 +1600,7 @@ lio_open(void *arg)
 	lio_send_rx_ctrl_cmd(lio, 1);
 
 	mac_new = IF_LLADDR(ifp);
-	memcpy(mac_old, ((uint8_t *)&lio->linfo.hw_addr) + 2, ETHER_HDR_LEN);
+	memcpy(mac_old, ((uint8_t *)&lio->linfo.hw_addr) + 2, ETHER_ADDR_LEN);
 
 	if (lio_is_mac_changed(mac_new, mac_old)) {
 		ret = lio_set_mac(ifp, mac_new);