[PATCH net] tcp: fix device binding after failed IPv6 connect

[Xia Yan]

tcp_v6_connect() sets sk_bound_dev_if from sin6_scope_id when connecting
to a link-local address. If the route lookup fails, the failure path
clears the destination port and route capabilities but leaves the
device binding in place.

A failed connection through a down interface can therefore leave the
socket bound to that interface. A subsequent connect() on the same
socket to ::1 then fails with ENETUNREACH, even though a fresh socket
can reach the listener.

Save the original device binding before processing the destination and
restore it on failure.

Found while reviewing the error paths in tcp_v6_connect(). Reproduced
in UML by connecting to fe80::1 on a down dummy interface, then retrying
the same socket against a listener on ::1. With the fix, the retry
succeeds and data flows in both directions. Tests also confirm that
existing device bindings are retained after failed IPv6, IPv4-mapped
and link-local connections without an explicit scope ID.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Xia Yan <yanxia@xxxxxxxxxxxxxxxxxxxx>
---

Tested in UML on net fcc00b15cb21. The complete tcp_ipv6.c file is
unchanged at the base commit. Before the fix, the socket remains
bound after the failed link-local connect and cannot reconnect.
With the fix, all 12 checks pass.

Build-tested on x86_64 with W=1 using configurations based on
allmodconfig and allyesconfig. The corrected tcp_ipv6.o compiles
without warnings in both configurations, and incremental kernel
builds complete successfully. WERROR was disabled for both;
allyesconfig also had KUNIT_ALL_TESTS disabled.

 net/ipv6/tcp_ipv6.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e006a30360eae..7bb8266d9d1b7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -146,6 +146,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr_unsized *uaddr,
 	struct flowi6 *fl6;
 	int addr_type;
 	int err;
+	int old_bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
 
 	if (addr_len < SIN6_LEN_RFC2133)
 		return -EINVAL;
@@ -358,6 +359,7 @@ late_failure:
 failure:
 	inet->inet_dport = 0;
 	sk->sk_route_caps = 0;
+	WRITE_ONCE(sk->sk_bound_dev_if, old_bound_dev_if);
 	return err;
 }
 

base-commit: cb284914e749388eef402938bdb3115fe1f6d337
-- 
2.39.0.windows.2