net: dsa: mv88e6xxx: check the port when reading back a policy rule

Browse source

chip->policies is one IDR for the whole switch, so the location an
ETHTOOL_GRXCLSRULE caller supplies can name a rule belonging to any port.
mv88e6xxx_get_rxnfc() copies it out without looking at policy->port, which
lets a user on one user port read the MAC address and VID of a policy an
admin installed on another.  ETHTOOL_GRXCLSRULE needs no CAP_NET_ADMIN.

The GRXCLSRLCNT and GRXCLSRLALL arms of the same switch statement already
filter on policy->port, which makes the GRXCLSRULE omission look
unintentional. Nonetheless, changing this does carry some regression
risk.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Link: https://patch.msgid.link/20260918185326.3940857-2-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

...

This commit is contained in:

Jakub Kicinski 2026-09-18 11:53:25 -07:00 • committed by Paolo Abeni

parent 2d7341a020

commit e3624f5eea

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/net/dsa/mv88e6xxx/chip.c

View file