On Thu, Oct 22, 2026 at 08:26:49AM -0700, Cheng Yongkang wrote: > del_nbp() flushes the port's FDB entries before it unregisters the RX > handler. For a normal port, br_stp_disable_port() has already moved > the port to BR_STATE_DISABLED, so no frame is learned in between. > > That does not hold for an MRP ring port. br_set_state() ignores state > changes while BR_MRP_AWARE_BIT is set, so br_stp_disable_port() leaves > the port state alone, and br_mrp_port_del() then sets the port to > BR_STATE_FORWARDING (when the bridge is up) before clearing the bit.
Same root cause as [1] where I suggested moving br_mrp_port_del() before br_stp_disable_port() so that the port is actually disabled. That would also fix this issue as the port would be disabled before the synchronize_net() in nbp_vlan_group_unpublish() and the FDB flush that follows it. Can you test it with your reproducer? [1] https://lore.kernel.org/netdev/20261012123051.GA714215@shredder/
