chip->policies is one IDR for the whole switch, so the location an ETHTOOL_GRXCLSRULE caller supplies can name a rule belonging to any port. mv88e6xxx_get_rxnfc() copies it out without looking at policy->port, which lets a user on one user port read the MAC address and VID of a policy an admin installed on another. ETHTOOL_GRXCLSRULE needs no CAP_NET_ADMIN. The GRXCLSRLCNT and GRXCLSRLALL arms of the same switch statement already filter on policy->port, which makes the GRXCLSRULE omission look unintentional. Nonetheless, changing this does carry some regression risk. Signed-off-by: Jakub Kicinski --- CC: andrew@lunn.ch CC: olteanv@gmail.com CC: f.fainelli@gmail.com CC: vivien.didelot@gmail.com --- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 7f68a0c55802..daef7c78b860 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -2457,7 +2457,7 @@ static int mv88e6xxx_get_rxnfc(struct dsa_switch *ds, int port, case ETHTOOL_GRXCLSRULE: err = -ENOENT; policy = idr_find(&chip->policies, fs->location); - if (policy) { + if (policy && policy->port == port) { memcpy(fs, &policy->fs, sizeof(*fs)); err = 0; } -- 2.55.0