Re: [PATCH net] net: bridge: do not bypass port state for MST without VLAN filtering

[Nikolay Aleksandrov <razor@blackwall.org>]

On 23/10/2026 11:47, Tobias Waldekranz wrote:
> 
> Hi Cheng,
> 
> On tor, okt 22, 2026 at 08:26, Cheng Yongkang <teel4res@gmail.com> wrote:
>> br_mst_is_enabled() is true when the bridge MST option is set and the
>> port has a VLAN group, and nbp_vlan_init() installs a VLAN group on
>> every port even when VLAN filtering is disabled.  While it is true,
>> ingress treats the port as forwarding and egress skips the
>> BR_STATE_FORWARDING check, so that the per-VLAN MST state is enforced
>> instead.  That state is only checked when VLAN filtering is enabled,
>> though: br_allowed_ingress() returns early otherwise, and
>> br_allowed_egress() only checks frames that were VLAN-filtered on
>> ingress.
>>
>> With MST enabled and VLAN filtering disabled, no port state is enforced
>> at all, and a port in BR_STATE_BLOCKING or BR_STATE_DISABLED still
>> forwards traffic, defeating STP and MRP loop protection.  MST can be
>> enabled in this configuration, since br_mst_set_enabled() only requires
>> that no port has a VLAN, for example with default_pvid 0.  In that setup
>> a BLOCKING port kept forwarding broadcast frames while MST was enabled,
>> and stopped when MST was disabled.
>>
>> Commit 8dca36978aa8 ("net: bridge: fix use-after-free due to MST port
>> state bypass") stopped this bypass during port deletion by also
>> requiring the port VLAN group; the bypass itself remained.
>>
>> Also require VLAN filtering in br_mst_is_enabled(), so the normal port
>> state checks apply until VLAN filtering is enabled.
>>
>> Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode")
>> Assisted-by: LLM
>> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
>> ---
>>   net/bridge/br_private.h | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
>> index ff746f036f54..85065304597e 100644
>> --- a/net/bridge/br_private.h
>> +++ b/net/bridge/br_private.h
>> @@ -1953,6 +1953,7 @@ static inline bool br_mst_is_enabled(const struct net_bridge_port *p)
>>   	/* check the port's vlan group to avoid racing with port deletion */
>>   	return static_branch_unlikely(&br_mst_used) &&
>>   	       br_opt_get(p->br, BROPT_MST_ENABLED) &&
>> +	       br_opt_get(p->br, BROPT_VLAN_ENABLED) &&
>>   	       rcu_access_pointer(p->vlgrp);
>>   }
>>   
>>
>> base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
>> -- 
>> 2.34.1
> 
> I suppose the other way to fix this issue would be to require VLAN
> filtering being enabled in order to enable MST filtering.
> 
>  From a user perspective, that seems natural since you need to associate
> packets with VLANs (i.e., have VLAN filtering enabled) in order to make
> any use of MST filtering.
> 
>  From the bridge's perspective it might be less desirable since it would
> mean that the two options would become entangled - the bridge would have
> to refuse VLAN filtering disablement while MST is enabled.

Indeed, that can break users because of new option ordering.
I'm sorry but this is a no-go.

Cheers,
  Nik