Re: [PATCH net v4 1/2] net/rds: keep the connected peer's scope id apart from the bound one

[Simon Horman <horms@kernel.org>]

On Wed, Oct 07, 2026 at 08:14:25PM -0700, Allison Henderson wrote:
> rds_connect() has nowhere to keep the scope of a link-local peer, so
> it stores it in rs_bound_scope_id, the scope of the socket's own
> bound address, for rds_bind() to check a later link-local bind
> against.  That field is then also what a send without a destination
> uses as the request's scope, what getpeername() and recvmsg() report
> as the peer's scope, and what a later bind() overwrites:
> rds_add_bound() stores the bound address's scope unconditionally,
> which for a non-link-local address is 0.
> 
> So after connect(fe80::x%ifA) followed by bind(global), a send() with
> no destination asks for fe80::x with scope 0.  rds_conn_lookup() keys
> on the interface, so that finds or creates a connection with c_dev_if
> 0, which the TCP transport then tries to connect through
> sin6_scope_id 0 and tcp_v6_connect() rejects for a link-local peer:
> the connected socket's data is queued on a connection that can never
> come up.  In the other order, bind(global) then connect(fe80::x%ifB),
> the connect leaves a global-bound socket with rs_bound_scope_id ifB,
> so sends to other link-local peers are refused as off-link and sends
> to global peers inherit a meaningless interface.
> 
> Give the connected peer its own rs_conn_scope_id.  rds_connect()
> records it there and leaves the bound scope alone, rds_bind()'s
> connected-socket check compares against it, and the destination-less
> send takes its scope from it - falling back to the bound scope for a
> non-link-local peer, so that send() and sendto() to the connected
> peer compute the same scope, and so the same connection.
> getpeername() reports the connected peer with its own scope, and
> recvmsg() reports a sender with the connected peer's scope when there
> is one and the bound scope otherwise, as before.
> 
> Found by inspection while reworking the sendmsg connection cache; not
> observed in the field.
> 
> Fixes: 1e2b44e78eea ("rds: Enable RDS IPv6 support")
> Assisted-by: Claude-Code:claude-fable-5
> Signed-off-by: Allison Henderson <achender@kernel.org>

Reviewed-by: Simon Horman <horms@kernel.org>