[BUG] net: bridge: MRP state is not propagated to MSTI zero

[Cheng Yongkang <teel4res@gmail.com>]

Hi all,

With MST enabled, the bridge data path uses MSTI-0 per-VLAN state.
br_set_state() normally synchronizes MSTI 0 through br_mst_set_state(),
but br_mrp_set_port_state() changes only p->state and sends a switchdev
notification.

The MRP-aware guard prevents other STP transitions from synchronizing
MSTI 0.  Direct bridge MST commands cannot address MSTI 0, and direct
VLAN-state changes are rejected while MST is enabled.  A ring port
marked BLOCKING by MRP therefore keeps its PVID/MSTI-0 state at
FORWARDING and continues to pass data.

Observed on Linux v7.3, commit
08ab31164c55f20c7a2653de3186ae333470e2c1:

  net_bridge_port.state: BLOCKING
  port VLAN state:       forwarding

  MST disabled control:  egress=0 ingress=0
  MST enabled candidate: egress=1 ingress=1

The MRP instance add and PORT_STATE BLOCKED requests both returned
success.  The port was observably blocked in sysfs but still forwarded
real broadcast Ethernet frames.

The MRP port-state path needs to synchronize MSTI 0, for example by
calling br_mst_set_state(p, 0, port_state, NULL), in addition to
updating p->state.

This is distinct from candidate BR-039 (MST with VLAN filtering disabled)
and from BR-005 (deletion-time MRP forwarding).  I found no matching
upstream fix or CVE.

The test used a diagnostic switchdev endpoint only to acknowledge the
MRP object.  It did not change bridge port state, VLAN state or packet
forwarding.

The PoC, module source and full logs are available on request.

This was found with a multi-agent workflow; the
state/forwarding differential was reproduced in QEMU.

Thanks,
Cheng Yongkang