12 files changed, 149 insertions, 85 deletions

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a9139682c49b..7d68b24b5654 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -45,7 +45,7 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         hdr = nlmsg_data(nlh);
         hdr->ifi_family = AF_BRIDGE;
@@ -72,7 +72,8 @@ static int br_fill_ifinfo(struct sk_buff *skb, const struct net_bridge_port *por
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 /*
@@ -89,9 +90,12 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
                 goto errout;
 
         err = br_fill_ifinfo(skb, port, 0, 0, event, 0);
-        /* failure implies BUG in br_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in br_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 1df6cd4568d3..215f1bff048f 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -331,7 +331,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*frh), flags);
         if (nlh == NULL)
-                return -1;
+                return -EMSGSIZE;
 
         frh = nlmsg_data(nlh);
         frh->table = rule->table;
@@ -359,7 +359,8 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 int fib_rules_dump(struct sk_buff *skb, struct netlink_callback *cb, int family)
@@ -405,9 +406,12 @@ static void notify_rule_change(int event, struct fib_rule *rule,
                 goto errout;
 
         err = fib_nl_fill_rule(skb, rule, pid, nlh->nlmsg_seq, event, 0, ops);
-        /* failure implies BUG in fib_rule_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in fib_rule_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, ops->nlgroup, nlh, GFP_KERNEL);
 errout:
         if (err < 0)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e7300b6b4079..9e26f38ea6e5 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1637,7 +1637,7 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ndtmsg = nlmsg_data(nlh);
 
@@ -1706,7 +1706,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 
 nla_put_failure:
         read_unlock_bh(&tbl->lock);
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int neightbl_fill_param_info(struct sk_buff *skb,
@@ -1720,7 +1721,7 @@ static int neightbl_fill_param_info(struct sk_buff *skb,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ndtmsg = nlmsg_data(nlh);
 
@@ -1737,7 +1738,8 @@ static int neightbl_fill_param_info(struct sk_buff *skb,
         return nlmsg_end(skb, nlh);
 errout:
         read_unlock_bh(&tbl->lock);
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
  
 static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
@@ -1955,7 +1957,7 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ndm = nlmsg_data(nlh);
         ndm->ndm_family  = neigh->ops->family;
@@ -1987,7 +1989,8 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 
@@ -2429,9 +2432,12 @@ static void __neigh_notify(struct neighbour *n, int type, int flags)
                 goto errout;
 
         err = neigh_fill_info(skb, n, 0, 0, type, flags);
-        /* failure implies BUG in neigh_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index e76539a5eb5e..9bf9ae05f157 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -320,7 +320,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ifm = nlmsg_data(nlh);
         ifm->ifi_family = AF_UNSPEC;
@@ -384,7 +384,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
@@ -633,9 +634,12 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         err = rtnl_fill_ifinfo(nskb, dev, iw, iw_buf_len, RTM_NEWLINK,
                                NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0, 0);
-        /* failure impilies BUG in if_nlmsg_size or wireless_rtnetlink_get */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in if_nlmsg_size */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(nskb);
+                goto errout;
+        }
         err = rtnl_unicast(nskb, NETLINK_CB(skb).pid);
 errout:
         kfree(iw_buf);
@@ -678,9 +682,12 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
                 goto errout;
 
         err = rtnl_fill_ifinfo(skb, dev, NULL, 0, type, 0, 0, change, 0);
-        /* failure implies BUG in if_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in if_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_LINK, NULL, GFP_KERNEL);
 errout:
         if (err < 0)
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index ed083ab455b7..90b3dfd72b49 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -749,7 +749,7 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*ifm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ifm = nlmsg_data(nlh);
         ifm->ifa_family = AF_DECnet;
@@ -768,7 +768,8 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static void dn_ifaddr_notify(int event, struct dn_ifaddr *ifa)
@@ -781,9 +782,12 @@ static void dn_ifaddr_notify(int event, struct dn_ifaddr *ifa)
                 goto errout;
 
         err = dn_nl_fill_ifaddr(skb, ifa, 0, 0, event, 0);
-        /* failure implies BUG in dn_ifaddr_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in dn_ifaddr_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_DECnet_IFADDR, NULL, GFP_KERNEL);
 errout:
         if (err < 0)
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 13b2421991ba..c1f0cc1b1c60 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -350,7 +350,7 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 nlmsg_failure:
 rtattr_failure:
         skb_trim(skb, b - skb->data);
-        return -1;
+        return -EMSGSIZE;
 }
 
 
@@ -368,9 +368,12 @@ static void dn_rtmsg_fib(int event, struct dn_fib_node *f, int z, u32 tb_id,
         err = dn_fib_dump_info(skb, pid, nlh->nlmsg_seq, event, tb_id,
                                f->fn_type, f->fn_scope, &f->fn_key, z,
                                DN_FIB_INFO(f), 0);
-        /* failure implies BUG in dn_fib_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in dn_fib_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, RTNLGRP_DECnet_ROUTE, nlh, GFP_KERNEL);
 errout:
         if (err < 0)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 480ace9819f6..c40203640966 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1140,7 +1140,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*ifm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         ifm = nlmsg_data(nlh);
         ifm->ifa_family = AF_INET;
@@ -1167,7 +1167,8 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
@@ -1225,9 +1226,12 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa, struct nlmsghdr *nlh,
                 goto errout;
 
         err = inet_fill_ifaddr(skb, ifa, pid, seq, event, 0);
-        /* failure implies BUG in inet_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, RTNLGRP_IPV4_IFADDR, nlh, GFP_KERNEL);
 errout:
         if (err < 0)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e63b8a98fb4d..be1028c9933e 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -314,9 +314,12 @@ void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
         err = fib_dump_info(skb, info->pid, seq, event, tb_id,
                             fa->fa_type, fa->fa_scope, key, dst_len,
                             fa->fa_tos, fa->fa_info, 0);
-        /* failure implies BUG in fib_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in fib_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, info->pid, RTNLGRP_IPV4_ROUTE,
                           info->nlh, GFP_KERNEL);
 errout:
@@ -960,7 +963,7 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*rtm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
         rtm->rtm_family = AF_INET;
@@ -1031,7 +1034,8 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 /*
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 77761ac4f7bb..9cd53addb784 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -153,7 +153,7 @@ static int inet_csk_diag_fill(struct sock *sk,
 rtattr_failure:
 nlmsg_failure:
         skb_trim(skb, b - skb->data);
-        return -1;
+        return -EMSGSIZE;
 }
 
 static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
@@ -209,7 +209,7 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
         return skb->len;
 nlmsg_failure:
         skb_trim(skb, previous_tail - skb->data);
-        return -1;
+        return -EMSGSIZE;
 }
 
 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
@@ -274,11 +274,14 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
         if (!rep)
                 goto out;
 
-        if (sk_diag_fill(sk, rep, req->idiag_ext,
-                         NETLINK_CB(in_skb).pid,
-                         nlh->nlmsg_seq, 0, nlh) <= 0)
-                BUG();
-
+        err = sk_diag_fill(sk, rep, req->idiag_ext,
+                           NETLINK_CB(in_skb).pid,
+                           nlh->nlmsg_seq, 0, nlh);
+        if (err < 0) {
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(rep);
+                goto out;
+        }
         err = netlink_unicast(idiagnl, rep, NETLINK_CB(in_skb).pid,
                               MSG_DONTWAIT);
         if (err > 0)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2daa0dc19d33..baee304a3cb7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2635,7 +2635,7 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*r), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         r = nlmsg_data(nlh);
         r->rtm_family    = AF_INET;
@@ -2718,7 +2718,8 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e3854696988d..fe5e1d833871 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3117,7 +3117,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
                       ifa->idev->dev->ifindex);
@@ -3137,8 +3137,10 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
         }
 
         if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
-            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
-                return nlmsg_cancel(skb, nlh);
+            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3155,13 +3157,15 @@ static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
         if (nla_put(skb, IFA_MULTICAST, 16, &ifmca->mca_addr) < 0 ||
             put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
-                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
-                return nlmsg_cancel(skb, nlh);
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3178,13 +3182,15 @@ static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
         if (nla_put(skb, IFA_ANYCAST, 16, &ifaca->aca_addr) < 0 ||
             put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
-                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
-                return nlmsg_cancel(skb, nlh);
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0) {
+                nlmsg_cancel(skb, nlh);
+                return -EMSGSIZE;
+        }
 
         return nlmsg_end(skb, nlh);
 }
@@ -3334,9 +3340,12 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
 
         err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
                                 nlh->nlmsg_seq, RTM_NEWADDR, 0);
-        /* failure implies BUG in inet6_ifaddr_msgsize() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout_ifa;
+        }
         err = rtnl_unicast(skb, NETLINK_CB(in_skb).pid);
 errout_ifa:
         in6_ifa_put(ifa);
@@ -3354,9 +3363,12 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
                 goto errout;
 
         err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
-        /* failure implies BUG in inet6_ifaddr_msgsize() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
@@ -3426,7 +3438,7 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         hdr = nlmsg_data(nlh);
         hdr->ifi_family = AF_INET6;
@@ -3469,7 +3481,8 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
@@ -3507,9 +3520,12 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
                 goto errout;
 
         err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
-        /* failure implies BUG in inet6_if_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_if_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
@@ -3533,7 +3549,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
 
         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*pmsg), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         pmsg = nlmsg_data(nlh);
         pmsg->prefix_family = AF_INET6;
@@ -3558,7 +3574,8 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 static void inet6_prefix_notify(int event, struct inet6_dev *idev, 
@@ -3572,9 +3589,12 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                 goto errout;
 
         err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
-        /* failure implies BUG in inet6_prefix_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in inet6_prefix_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
 errout:
         if (err < 0)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5f0043c30b70..f4fda80a41a2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2040,7 +2040,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
         rtm->rtm_family = AF_INET6;
@@ -2111,7 +2111,8 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 int rt6_dump_route(struct rt6_info *rt, void *p_arg)
@@ -2222,9 +2223,12 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 goto errout;
 
         err = rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0);
-        /* failure implies BUG in rt6_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, RTNLGRP_IPV6_ROUTE, nlh, gfp_any());
 errout:
         if (err < 0)