net: ipv6: fix dif and sdif mismatch in raw6_icmp_error

In raw6_icmp_error(), raw_v6_match() is called with inet6_iif(skb) passed
to both the 'dif' and 'sdif' arguments. This is a copy-paste or typo error,
as the last argument should represent the secondary interface index (sdif).

This mismatch breaks ICMPv6 error handling for IPv6 raw sockets in VRF
(Virtual Routing and Forwarding) environments. When a raw socket is bound
to a VRF master device, raw_v6_match() fails to find a match because it is
not given the correct sdif value, causing the socket to miss relevant
ICMPv6 error notifications.

Fix this by properly passing inet6_sdif(skb) as the last argument to
raw_v6_match().

Fixes: 5108ab4bf446fa ("net: ipv6: add second dif to raw socket lookups")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260717143230.1836-1-lirongqing@baidu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 3cc58698cbbd3a16cf0145e0afff7a6cec8dc56f..b88d364e78aae911bb7978f316ceaaaa55441efd 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -349,7 +349,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
                const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data;
 
                if (!raw_v6_match(net, sk, nexthdr, &ip6h->saddr, &ip6h->daddr,
-                                 inet6_iif(skb), inet6_iif(skb)))
+                                 inet6_iif(skb), inet6_sdif(skb)))
                        continue;
                rawv6_err(sk, skb, type, code, inner_offset, info);
        }