1 files changed, 9 insertions, 5 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5f0043c30b70..f4fda80a41a2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2040,7 +2040,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 
         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
         if (nlh == NULL)
-                return -ENOBUFS;
+                return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
         rtm->rtm_family = AF_INET6;
@@ -2111,7 +2111,8 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
-        return nlmsg_cancel(skb, nlh);
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 
 int rt6_dump_route(struct rt6_info *rt, void *p_arg)
@@ -2222,9 +2223,12 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 goto errout;
 
         err = rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0);
-        /* failure implies BUG in rt6_nlmsg_size() */
-        BUG_ON(err < 0);
-
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
         err = rtnl_notify(skb, pid, RTNLGRP_IPV6_ROUTE, nlh, gfp_any());
 errout:
         if (err < 0)