bridge: Validate that vlan is permitted on ingress

[~andy/linux] / net / bridge / br_device.c

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index ca98fa5b2c78dcf4797e37cc81a8cf8e8bb19ebb..35a2c2c84f33d6dc26771b9c54557d5bfb271e10 100644 (file)
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -45,6 +45,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        brstats->tx_bytes += skb->len;
        u64_stats_update_end(&brstats->syncp);
 
+       if (!br_allowed_ingress(br, br_get_vlan_info(br), skb))
+               goto out;
+
        BR_INPUT_SKB_CB(skb)->brdev = dev;
 
        skb_reset_mac_header(skb);