ireq->ir_rmt_addr = ip_hdr(skb)->saddr;
        write_pnet(&ireq->ireq_net, sock_net(sk));
        ireq->ireq_family = AF_INET;
+       ireq->ir_iif = sk->sk_bound_dev_if;
 
        /*
         * Step 3: Process LISTEN state
 
        r->idiag_timer = 1;
        r->idiag_retrans = req->num_retrans;
 
-       r->id.idiag_if = sk->sk_bound_dev_if;
+       r->id.idiag_if = ireq->ir_iif;
 
        BUILD_BUG_ON(offsetof(struct inet_request_sock, ir_cookie) !=
                     offsetof(struct sock, sk_cookie));
 
        write_pnet(&ireq->ireq_net, sock_net(sk));
        ireq->ireq_family = AF_INET;
 
+       ireq->ir_iif = sk->sk_bound_dev_if;
+
        /* We throwed the options of the initial SYN away, so we hope
         * the ACK carries the same options again (see RFC1122 4.2.3.8)
         */
 
        tcp_openreq_init(req, &tmp_opt, skb, sk);
        write_pnet(&inet_rsk(req)->ireq_net, sock_net(sk));
 
+       /* Note: tcp_v6_init_req() might override ir_iif for link locals */
+       inet_rsk(req)->ir_iif = sk->sk_bound_dev_if;
+
        af_ops->init_req(req, sk, skb);
 
        if (security_inet_conn_request(sk, skb, req))
 
        ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
        ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 
-       ireq->ir_iif = sk->sk_bound_dev_if;
-
        /* So that link locals have meaning */
        if (!sk->sk_bound_dev_if &&
            ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)