[PATCH 2/3] ipv6: return EMSGSIZE when first route in dump does not fit

From: Stephen Hemminger

Date: Sun Nov 08 2026 - 20:34:50 EST


If a route does not fit in an empty dump skb, fib6_dump_node()
suspends the walker and inet6_dump_fib() returns 1. rtnl_dumpit()
then returns skb->len, which is 0, and the dump ends with NLMSG_DONE
and status 0, silently dropping the route and those after it.

This became reachable when multipath routes started being dumped as a
single message with an RTA_MULTIPATH attribute; a wide enough route no
longer fits.

Return -EMSGSIZE in this case, as IPv4 does. This depends on the
rtnl_dumpit() fix in the previous patch.

Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx>
---
net/ipv6/ip6_fib.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e1d49897d6ab..1025267992f0 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -755,6 +755,12 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)

unlock:
rcu_read_unlock();
+ /* The walker stopped before adding anything, so the next route
+ * is too large for this skb. Report that instead of letting an
+ * empty skb look like the end of the dump.
+ */
+ if (err > 0 && !skb->len)
+ err = -EMSGSIZE;
if (err <= 0)
fib6_dump_end(cb);
return err;
--
2.53.0