Why does adding a non-VLANed interface to a bridge break the VLANed interfaces?

Question

I'm working with VLANs on briges and have found that if I add a non-VLAN interface to any bridge, it breaks all the VLAN interfaces - packets leave just fine, but the return packets (which are appropriately VLAN tagged) are getting dropped somewhere. The minute I drop the non-VLAN interface from the bridge, the VLAN interfaces start working again.

What is the reason for this? Is it a bug?

To clear up any possible questions:

#setup bridges and vlans
vconfig add eth0 2
vconfig add eth0 3
brctl addbr br2
brctl addbr br3
brctl addif br2 eth2.2
brctl addif br3 eth2.3
ip link set dev br2 up
ip link set dev br3 up

#wait for forwarding state and test
arping -I br2 10.10.10.1
#this works - I get replies
arping -I br3 192.168.1.1
#this works - I get replies

brctl addbr br0
brctl addif eth0

arping -I br2 10.10.10.1
#broken - no replies. Wireshark shows reply packets coming in exactly as before.
arping -I br3 192.168.1.1
#also broken

ip link set br0 up
#wait for forwarding mode, then...
arping -I br3 192.168.1.1
#still broken

brctl delif br0 eth0
arping -I br3 192.168.1.1
#working again!

Solution

In your particular example, br0 is consuming the packets from eth0 and the VLAN code is not getting them. That's probably the right behaviour.

If you are adding a trunk port to a bridge, you should run the VLANs off the bridge:

brctl addbr br0
brctl addif br0 eth0
ip link set br0 up

vconfig add br0 2
brctl addbr br2
brctl addif br2 br0.2
ip link set br2 up

vconfig add br0 3
brctl addbr br3
brctl addif br3 br0.3
ip link set br3 up

I don't have my bridge & vlan setup handy, so I can't test this, but it makes logical sense to me. It removes the conflict between whether VLAN or bridge consumes packets from eth0 and makes the layering clear.