1 files changed, 33 insertions, 9 deletions

diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 317904bb5896..bdbc3f431668 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -263,6 +263,32 @@ static int dn_fib_nh_match(struct rtmsg *r, struct nlmsghdr *nlh, struct dn_kern
         return 0;
 }
 
+static inline size_t dn_fib_nlmsg_size(struct dn_fib_info *fi)
+{
+        size_t payload = NLMSG_ALIGN(sizeof(struct rtmsg))
+                         + nla_total_size(4) /* RTA_TABLE */
+                         + nla_total_size(2) /* RTA_DST */
+                         + nla_total_size(4); /* RTA_PRIORITY */
+
+        /* space for nested metrics */
+        payload += nla_total_size((RTAX_MAX * nla_total_size(4)));
+
+        if (fi->fib_nhs) {
+                /* Also handles the special case fib_nhs == 1 */
+
+                /* each nexthop is packed in an attribute */
+                size_t nhsize = nla_total_size(sizeof(struct rtnexthop));
+
+                /* may contain a gateway attribute */
+                nhsize += nla_total_size(4);
+
+                /* all nexthops are packed in a nested attribute */
+                payload += nla_total_size(fi->fib_nhs * nhsize);
+        }
+
+        return payload;
+}
+
 static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         u32 tb_id, u8 type, u8 scope, void *dst, int dst_len,
                         struct dn_fib_info *fi, unsigned int flags)
@@ -335,17 +361,15 @@ static void dn_rtmsg_fib(int event, struct dn_fib_node *f, int z, u32 tb_id,
         u32 pid = req ? req->pid : 0;
         int err = -ENOBUFS;
 
-        skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        skb = nlmsg_new(dn_fib_nlmsg_size(DN_FIB_INFO(f)), GFP_KERNEL);
         if (skb == NULL)
                 goto errout;
 
         err = dn_fib_dump_info(skb, pid, nlh->nlmsg_seq, event, tb_id,
                                f->fn_type, f->fn_scope, &f->fn_key, z,
                                DN_FIB_INFO(f), 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in dn_fib_nlmsg_size() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, pid, RTNLGRP_DECnet_ROUTE, nlh, GFP_KERNEL);
 errout:
@@ -807,10 +831,11 @@ struct dn_fib_table *dn_fib_get_table(u32 n, int create)
                 printk(KERN_DEBUG "DECnet: BUG! Attempt to create routing table from interrupt\n"); 
                 return NULL;
         }
-        if ((t = kmalloc(sizeof(struct dn_fib_table) + sizeof(struct dn_hash), GFP_KERNEL)) == NULL)
-                return NULL;
 
-        memset(t, 0, sizeof(struct dn_fib_table));
+        t = kzalloc(sizeof(struct dn_fib_table) + sizeof(struct dn_hash),
+                    GFP_KERNEL);
+        if (t == NULL)
+                return NULL;
 
         t->n = n;
         t->insert = dn_fib_table_insert;
@@ -818,7 +843,6 @@ struct dn_fib_table *dn_fib_get_table(u32 n, int create)
         t->lookup = dn_fib_table_lookup;
         t->flush  = dn_fib_table_flush;
         t->dump = dn_fib_table_dump;
-        memset(t->data, 0, sizeof(struct dn_hash));
         hlist_add_head_rcu(&t->hlist, &dn_fib_table_hash[h]);
 
         return t;