git: 094626d3a500 - main - lio: Avoid out-of-bounds read or write MAC address

The branch main has been updated by zlei:

URL: https://cgit.FreeBSD.org/src/commit/?id=094626d3a5009a56bf1b763dbdfc681ce371dc99

commit 094626d3a5009a56bf1b763dbdfc681ce371dc99
Author:     Zhenlei Huang <zlei@FreeBSD.org>
AuthorDate: 2025-12-16 04:41:02 +0000
Commit:     Zhenlei Huang <zlei@FreeBSD.org>
CommitDate: 2025-12-16 04:41:02 +0000

    lio: Avoid out-of-bounds read or write MAC address
    
    While here, replace loop copying the MAC address with memcpy() for
    better readability.
    
    Reviewed by:    markj
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D54177
---
 sys/dev/liquidio/lio_ioctl.c |  4 ++--
 sys/dev/liquidio/lio_main.c  | 10 ++++------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/sys/dev/liquidio/lio_ioctl.c b/sys/dev/liquidio/lio_ioctl.c
index b2fd54f59580..36e7710cccb9 100644
--- a/sys/dev/liquidio/lio_ioctl.c
+++ b/sys/dev/liquidio/lio_ioctl.c
@@ -443,7 +443,7 @@ lio_set_mac(if_t ifp, uint8_t *p)
 
 	nctrl.udd[0] = 0;
 	/* The MAC Address is presented in network byte order. */
-	memcpy((uint8_t *)&nctrl.udd[0] + 2, p, ETHER_HDR_LEN);
+	memcpy((uint8_t *)&nctrl.udd[0] + 2, p, ETHER_ADDR_LEN);
 
 	ret = lio_send_ctrl_pkt(lio->oct_dev, &nctrl);
 	if (ret < 0) {
@@ -451,7 +451,7 @@ lio_set_mac(if_t ifp, uint8_t *p)
 		return (ENOMEM);
 	}
 
-	memcpy(((uint8_t *)&lio->linfo.hw_addr) + 2, p, ETHER_HDR_LEN);
+	memcpy(((uint8_t *)&lio->linfo.hw_addr) + 2, p, ETHER_ADDR_LEN);
 
 	return (0);
 }
diff --git a/sys/dev/liquidio/lio_main.c b/sys/dev/liquidio/lio_main.c
index 7b6eeb460095..5da346e308ba 100644
--- a/sys/dev/liquidio/lio_main.c
+++ b/sys/dev/liquidio/lio_main.c
@@ -1230,7 +1230,7 @@ lio_setup_nic_devices(struct octeon_device *octeon_dev)
 	unsigned int	gmx_port_id;
 	uint32_t	ctx_size, data_size;
 	uint32_t	ifidx_or_pfnum, resp_size;
-	uint8_t		mac[ETHER_HDR_LEN], i, j;
+	uint8_t		mac[ETHER_ADDR_LEN], i, j;
 
 	/* This is to handle link status changes */
 	lio_register_dispatch_fn(octeon_dev, LIO_OPCODE_NIC,
@@ -1373,9 +1373,7 @@ lio_setup_nic_devices(struct octeon_device *octeon_dev)
 		lio_init_ifnet(lio);
 		/* 64-bit swap required on LE machines */
 		lio_swap_8B_data(&lio->linfo.hw_addr, 1);
-		for (j = 0; j < 6; j++)
-			mac[j] = *((uint8_t *)(
-				   ((uint8_t *)&lio->linfo.hw_addr) + 2 + j));
+		memcpy(mac, (uint8_t *)&lio->linfo.hw_addr + 2, ETHER_ADDR_LEN);
 
 		ether_ifattach(ifp, mac);
 
@@ -1579,7 +1577,7 @@ lio_open(void *arg)
 	struct lio	*lio = arg;
 	if_t		ifp = lio->ifp;
 	struct octeon_device	*oct = lio->oct_dev;
-	uint8_t	*mac_new, mac_old[ETHER_HDR_LEN];
+	uint8_t	*mac_new, mac_old[ETHER_ADDR_LEN];
 	int	ret = 0;
 
 	lio_ifstate_set(lio, LIO_IFSTATE_RUNNING);
@@ -1593,7 +1591,7 @@ lio_open(void *arg)
 	lio_send_rx_ctrl_cmd(lio, 1);
 
 	mac_new = if_getlladdr(ifp);
-	memcpy(mac_old, ((uint8_t *)&lio->linfo.hw_addr) + 2, ETHER_HDR_LEN);
+	memcpy(mac_old, ((uint8_t *)&lio->linfo.hw_addr) + 2, ETHER_ADDR_LEN);
 
 	if (lio_is_mac_changed(mac_new, mac_old)) {
 		ret = lio_set_mac(ifp, mac_new);