git: 37de97853422 - stable/13 - qlnxe: Avoid out-of-bounds reading the multicast ethernet address

The branch stable/13 has been updated by zlei:

URL: https://cgit.FreeBSD.org/src/commit/?id=37de97853422a9e27c35fcc2365e7f561dc8d674

commit 37de97853422a9e27c35fcc2365e7f561dc8d674
Author:     Zhenlei Huang <zlei@FreeBSD.org>
AuthorDate: 2025-12-29 14:20:12 +0000
Commit:     Zhenlei Huang <zlei@FreeBSD.org>
CommitDate: 2026-01-31 18:42:41 +0000

    qlnxe: Avoid out-of-bounds reading the multicast ethernet address
    
    The correct length of an ethernet address is ETHER_ADDR_LEN but not
    ETHER_HDR_LEN.
    
    MFC after:      1 week
    
    (cherry picked from commit 85f499be90c15a3de02d1c62ce03b99fab52f925)
    (cherry picked from commit 2b01cc15447251862f5e25332fcbf41516f22a3e)
    (cherry picked from commit a1828b1226fe8de1325a0e46ec5732268ba4525a)
---
 sys/dev/qlnx/qlnxe/qlnx_os.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sys/dev/qlnx/qlnxe/qlnx_os.c b/sys/dev/qlnx/qlnxe/qlnx_os.c
index 745bd44e5b7f..ba9731600b50 100644
--- a/sys/dev/qlnx/qlnxe/qlnx_os.c
+++ b/sys/dev/qlnx/qlnxe/qlnx_os.c
@@ -2586,7 +2586,7 @@ qlnx_hw_set_multi(qlnx_host_t *ha, uint8_t *mta, uint32_t mcnt,
                                 break;
                 }
 
-                mta += ETHER_HDR_LEN;
+                mta += ETHER_ADDR_LEN;
         }
         return;
 }
@@ -2599,7 +2599,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt)
 	if (mcnt == QLNX_MAX_NUM_MULTICAST_ADDRS)
 		return (0);
 
-	bcopy(LLADDR(sdl), &mta[mcnt * ETHER_HDR_LEN], ETHER_HDR_LEN);
+	bcopy(LLADDR(sdl), &mta[mcnt * ETHER_ADDR_LEN], ETHER_ADDR_LEN);
 
 	return (1);
 }
@@ -2607,7 +2607,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt)
 static int
 qlnx_set_multi(qlnx_host_t *ha, uint32_t add_multi)
 {
-	uint8_t		mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_HDR_LEN];
+	uint8_t		mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_ADDR_LEN];
 	struct ifnet	*ifp = ha->ifp;
 	u_int		mcnt;