Hi all, With MST enabled, the bridge data path uses MSTI-0 per-VLAN state. br_set_state() normally synchronizes MSTI 0 through br_mst_set_state(), but br_mrp_set_port_state() changes only p->state and sends a switchdev notification.
The MRP-aware guard prevents other STP transitions from synchronizing MSTI 0. Direct bridge MST commands cannot address MSTI 0, and direct VLAN-state changes are rejected while MST is enabled. A ring port marked BLOCKING by MRP therefore keeps its PVID/MSTI-0 state at FORWARDING and continues to pass data. Observed on Linux v7.3, commit 08ab31164c55f20c7a2653de3186ae333470e2c1: net_bridge_port.state: BLOCKING port VLAN state: forwarding MST disabled control: egress=0 ingress=0 MST enabled candidate: egress=1 ingress=1 The MRP instance add and PORT_STATE BLOCKED requests both returned success. The port was observably blocked in sysfs but still forwarded real broadcast Ethernet frames. The MRP port-state path needs to synchronize MSTI 0, for example by calling br_mst_set_state(p, 0, port_state, NULL), in addition to updating p->state. This is distinct from candidate BR-039 (MST with VLAN filtering disabled) and from BR-005 (deletion-time MRP forwarding). I found no matching upstream fix or CVE. The test used a diagnostic switchdev endpoint only to acknowledge the MRP object. It did not change bridge port state, VLAN state or packet forwarding. The PoC, module source and full logs are available on request. This was found with a multi-agent workflow; the state/forwarding differential was reproduced in QEMU. Thanks, Cheng Yongkang
