4 files changed, 12 insertions, 9 deletions

diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 4400da7739da..b2c26b081134 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -702,7 +702,8 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
              nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
              nla_put_u32(skb, IFA_FLAGS, ifa_flags))
                 goto nla_put_failure;
-        return nlmsg_end(skb, nlh);
+        nlmsg_end(skb, nlh);
+        return 0;
 
 nla_put_failure:
         nlmsg_cancel(skb, nlh);
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index d332aefb0846..df4803437888 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -298,7 +298,8 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct nlattr *att
                         int type = nla_type(attr);
 
                         if (type) {
-                                if (type > RTAX_MAX || nla_len(attr) < 4)
+                                if (type > RTAX_MAX || type == RTAX_CC_ALGO ||
+                                    nla_len(attr) < 4)
                                         goto err_inval;
 
                                 fi->fib_metrics[type-1] = nla_get_u32(attr);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index daccc4a36d80..1d7c1256e845 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1616,7 +1616,8 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
             nla_put_u32(skb, RTA_IIF, rt->fld.flowidn_iif) < 0)
                 goto errout;
 
-        return nlmsg_end(skb, nlh);
+        nlmsg_end(skb, nlh);
+        return 0;
 
 errout:
         nlmsg_cancel(skb, nlh);
@@ -1709,9 +1710,6 @@ static int dn_cache_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
                 rt->rt_flags |= RTCF_NOTIFY;
 
         err = dn_rt_fill_info(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, RTM_NEWROUTE, 0, 0);
-
-        if (err == 0)
-                goto out_free;
         if (err < 0) {
                 err = -EMSGSIZE;
                 goto out_free;
@@ -1762,7 +1760,7 @@ int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
                         skb_dst_set(skb, dst_clone(&rt->dst));
                         if (dn_rt_fill_info(skb, NETLINK_CB(cb->skb).portid,
                                         cb->nlh->nlmsg_seq, RTM_NEWROUTE,
-                                        1, NLM_F_MULTI) <= 0) {
+                                        1, NLM_F_MULTI) < 0) {
                                 skb_dst_drop(skb);
                                 rcu_read_unlock_bh();
                                 goto done;
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 86e3807052e9..1540b506e3e0 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -29,6 +29,7 @@
 #include <linux/route.h> /* RTF_xxx */
 #include <net/neighbour.h>
 #include <net/netlink.h>
+#include <net/tcp.h>
 #include <net/dst.h>
 #include <net/flow.h>
 #include <net/fib_rules.h>
@@ -273,7 +274,8 @@ static inline size_t dn_fib_nlmsg_size(struct dn_fib_info *fi)
         size_t payload = NLMSG_ALIGN(sizeof(struct rtmsg))
                          + nla_total_size(4) /* RTA_TABLE */
                          + nla_total_size(2) /* RTA_DST */
-                         + nla_total_size(4); /* RTA_PRIORITY */
+                         + nla_total_size(4) /* RTA_PRIORITY */
+                         + nla_total_size(TCP_CA_NAME_MAX); /* RTAX_CC_ALGO */
 
         /* space for nested metrics */
         payload += nla_total_size((RTAX_MAX * nla_total_size(4)));
@@ -365,7 +367,8 @@ static int dn_fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                 nla_nest_end(skb, mp_head);
         }
 
-        return nlmsg_end(skb, nlh);
+        nlmsg_end(skb, nlh);
+        return 0;
 
 errout:
         nlmsg_cancel(skb, nlh);