diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 2423d69f2498..0a1ce9e59a4d 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -108,7 +108,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 		else
 			br_flood(br, vlan, skb, BR_PKT_MULTICAST, false, true);
 	} else if ((dst = br_fdb_find_rcu(br, dest, vid)) != NULL) {
-		br_forward(br_fdb_dst_port(dst), skb, false, true);
+		br_forward(br_fdb_dst_read(dst), skb, false, true);
 	} else {
 		br_flood(br, vlan, skb, BR_PKT_UNICAST, false, true);
 	}
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index b5eece1ff9e8..82645db32efb 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -17,7 +17,7 @@
 #include "br_private.h"
 
 struct br_fwd_dst {
-	const struct net_bridge_port *port;
+	struct net_bridge_port *port;
 	struct net_bridge_vlan *vlan;
 };
 
@@ -149,35 +149,37 @@ static int deliver_clone(const struct br_fwd_dst *fwd,
 
 /**
  * br_forward - forward a packet to a specific port
- * @to: destination port
+ * @dst: bridge destination
  * @skb: packet being forwarded
  * @local_rcv: packet will be received locally after forwarding
  * @local_orig: packet is locally originated
  *
  * Should be called with rcu_read_lock.
  */
-void br_forward(const struct net_bridge_port *to,
+void br_forward(struct net_bridge_dst dst,
 		struct sk_buff *skb, bool local_rcv, bool local_orig)
 {
 	struct br_fwd_dst fwd;
 
-	if (unlikely(!to))
+	br_dst_decode(dst, &fwd.port, &fwd.vlan);
+
+	if (unlikely(!fwd.port))
 		goto out;
 
 	/* redirect to backup link if the destination port is down */
-	if (rcu_access_pointer(to->backup_port) &&
-	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+	if (rcu_access_pointer(fwd.port->backup_port) &&
+	    (!netif_carrier_ok(fwd.port->dev) ||
+	     !netif_running(fwd.port->dev))) {
 		struct net_bridge_port *backup_port;
 
-		backup_port = rcu_dereference(to->backup_port);
+		backup_port = rcu_dereference(fwd.port->backup_port);
 		if (unlikely(!backup_port))
 			goto out;
-		BR_INPUT_SKB_CB(skb)->backup_nhid = READ_ONCE(to->backup_nhid);
-		to = backup_port;
+		BR_INPUT_SKB_CB(skb)->backup_nhid = READ_ONCE(fwd.port->backup_nhid);
+		fwd.port = backup_port;
+		fwd.vlan = NULL;
 	}
 
-	fwd.port = to;
-	fwd.vlan = NULL;
 	if (should_deliver(&fwd, skb)) {
 		if (local_rcv)
 			deliver_clone(&fwd, skb, local_orig);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 44a217d65e7f..fc2e381c4fe0 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -225,7 +225,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
 
 		if (now != READ_ONCE(dst->used))
 			WRITE_ONCE(dst->used, now);
-		br_forward(br_fdb_dst_port(dst), skb, local_rcv, false);
+		br_forward(br_fdb_dst_read(dst), skb, local_rcv, false);
 	} else {
 		if (!mcast_hit)
 			br_flood(br, vlan, skb, pkt_type, local_rcv, false);
diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
index dce6efa96c4c..c8cd5b4f3af8 100644
--- a/net/bridge/br_mrp.c
+++ b/net/bridge/br_mrp.c
@@ -1219,11 +1219,11 @@ static int br_mrp_rcv(struct net_bridge_port *p,
 
 forward:
 	if (p_dst)
-		br_forward(p_dst, skb, true, false);
+		br_forward(br_port_to_dst(p_dst), skb, true, false);
 	if (s_dst)
-		br_forward(s_dst, skb, true, false);
+		br_forward(br_port_to_dst(s_dst), skb, true, false);
 	if (i_dst)
-		br_forward(i_dst, skb, true, false);
+		br_forward(br_port_to_dst(i_dst), skb, true, false);
 
 no_forward:
 	return 1;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index a1c5b1abc1ef..05921192ebda 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -1045,7 +1045,7 @@ enum br_pkt_type {
 	BR_PKT_BROADCAST
 };
 int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb);
-void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+void br_forward(struct net_bridge_dst dst, struct sk_buff *skb,
 		bool local_rcv, bool local_orig);
 int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
 void br_flood(struct net_bridge *br, struct net_bridge_vlan *v,
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index cd2b04236a99..92b488793914 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -55,7 +55,7 @@ static void nft_reject_br_send_v4_tcp_reset(struct net *net,
 
 	nft_reject_br_push_etherhdr(oldskb, nskb);
 
-	br_forward(br_port_get_rcu(dev), nskb, false, true);
+	br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
 }
 
 static void nft_reject_br_send_v4_unreach(struct net *net,
@@ -71,7 +71,7 @@ static void nft_reject_br_send_v4_unreach(struct net *net,
 
 	nft_reject_br_push_etherhdr(oldskb, nskb);
 
-	br_forward(br_port_get_rcu(dev), nskb, false, true);
+	br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
 }
 
 static void nft_reject_br_send_v6_tcp_reset(struct net *net,
@@ -87,7 +87,7 @@ static void nft_reject_br_send_v6_tcp_reset(struct net *net,
 
 	nft_reject_br_push_etherhdr(oldskb, nskb);
 
-	br_forward(br_port_get_rcu(dev), nskb, false, true);
+	br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
 }
 
 
@@ -104,7 +104,7 @@ static void nft_reject_br_send_v6_unreach(struct net *net,
 
 	nft_reject_br_push_etherhdr(oldskb, nskb);
 
-	br_forward(br_port_get_rcu(dev), nskb, false, true);
+	br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
 }
 
 static void nft_reject_bridge_eval(const struct nft_expr *expr,