If a route does not fit in an empty dump skb, fib6_dump_node() suspends the walker and inet6_dump_fib() returns 1. rtnl_dumpit() then returns skb->len, which is 0, and the dump ends with NLMSG_DONE and status 0, silently dropping the route and those after it. This became reachable when multipath routes started being dumped as a single message with an RTA_MULTIPATH attribute; a wide enough route no longer fits. Return -EMSGSIZE in this case, as IPv4 does. This depends on the rtnl_dumpit() fix in the previous patch. Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute") Signed-off-by: Stephen Hemminger --- net/ipv6/ip6_fib.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index e1d49897d6ab..1025267992f0 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -755,6 +755,12 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) unlock: rcu_read_unlock(); + /* The walker stopped before adding anything, so the next route + * is too large for this skb. Report that instead of letting an + * empty skb look like the end of the dump. + */ + if (err > 0 && !skb->len) + err = -EMSGSIZE; if (err <= 0) fib6_dump_end(cb); return err; -- 2.53.0