On Fri, Sep 11, 2026 at 01:50:21PM +0300, Nikolay Aleksandrov wrote:
> This is a follow-up of one of sashiko's pre-existing bug reports.
> br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs
> while holding rcu_read_lock() which invokes the blocking switchdev
> notifier chain and may sleep. Nonzero MSTI changes come from netlink
> with rtnl held. Move the switchdev call before entering the rcu section and
> assert that rtnl is held.
>
> The call cannot be deferred because netlink needs its error and extack.
> Also DSA reads the old bridge MST state during the callback and checks it.
> A deferred callback will be late and will see the updated state.
>
> Fixes: 7ae9147f4312 ("net: bridge: mst: Notify switchdev drivers of MST state
> changes")
Nit: blaming 3a7c1661ae13 ("net: bridge: mst: fix vlan use-after-free")
would be more accurate, but in practice it doesn't matter since this
commit blamed ec7328b59176 that is present in the same release as
7ae9147f4312.
> Signed-off-by: Nikolay Aleksandrov <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
