Hi Cheng,
On tor, okt 22, 2026 at 08:26, Cheng Yongkang <[email protected]> wrote: > br_mst_is_enabled() is true when the bridge MST option is set and the > port has a VLAN group, and nbp_vlan_init() installs a VLAN group on > every port even when VLAN filtering is disabled. While it is true, > ingress treats the port as forwarding and egress skips the > BR_STATE_FORWARDING check, so that the per-VLAN MST state is enforced > instead. That state is only checked when VLAN filtering is enabled, > though: br_allowed_ingress() returns early otherwise, and > br_allowed_egress() only checks frames that were VLAN-filtered on > ingress. > > With MST enabled and VLAN filtering disabled, no port state is enforced > at all, and a port in BR_STATE_BLOCKING or BR_STATE_DISABLED still > forwards traffic, defeating STP and MRP loop protection. MST can be > enabled in this configuration, since br_mst_set_enabled() only requires > that no port has a VLAN, for example with default_pvid 0. In that setup > a BLOCKING port kept forwarding broadcast frames while MST was enabled, > and stopped when MST was disabled. > > Commit 8dca36978aa8 ("net: bridge: fix use-after-free due to MST port > state bypass") stopped this bypass during port deletion by also > requiring the port VLAN group; the bypass itself remained. > > Also require VLAN filtering in br_mst_is_enabled(), so the normal port > state checks apply until VLAN filtering is enabled. > > Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") > Assisted-by: LLM > Signed-off-by: Cheng Yongkang <[email protected]> > --- > net/bridge/br_private.h | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h > index ff746f036f54..85065304597e 100644 > --- a/net/bridge/br_private.h > +++ b/net/bridge/br_private.h > @@ -1953,6 +1953,7 @@ static inline bool br_mst_is_enabled(const struct > net_bridge_port *p) > /* check the port's vlan group to avoid racing with port deletion */ > return static_branch_unlikely(&br_mst_used) && > br_opt_get(p->br, BROPT_MST_ENABLED) && > + br_opt_get(p->br, BROPT_VLAN_ENABLED) && > rcu_access_pointer(p->vlgrp); > } > > > base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449 > -- > 2.34.1 I suppose the other way to fix this issue would be to require VLAN filtering being enabled in order to enable MST filtering. >From a user perspective, that seems natural since you need to associate packets with VLANs (i.e., have VLAN filtering enabled) in order to make any use of MST filtering. >From the bridge's perspective it might be less desirable since it would mean that the two options would become entangled - the bridge would have to refuse VLAN filtering disablement while MST is enabled.
