Re: [PATCH 2/3] ipv6: return EMSGSIZE when first route in dump does not fit

[Hangbin Liu]

On Sun, Nov 08, 2026 at 05:13:13PM -0800, Stephen Hemminger wrote:
> If a route does not fit in an empty dump skb, fib6_dump_node()
> suspends the walker and inet6_dump_fib() returns 1. rtnl_dumpit()
> then returns skb->len, which is 0, and the dump ends with NLMSG_DONE
> and status 0, silently dropping the route and those after it.
> 
> This became reachable when multipath routes started being dumped as a
> single message with an RTA_MULTIPATH attribute; a wide enough route no
> longer fits.
> 
> Return -EMSGSIZE in this case, as IPv4 does. This depends on the
> rtnl_dumpit() fix in the previous patch.
> 
> Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx>
> ---
>  net/ipv6/ip6_fib.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
> index e1d49897d6ab..1025267992f0 100644
> --- a/net/ipv6/ip6_fib.c
> +++ b/net/ipv6/ip6_fib.c
> @@ -755,6 +755,12 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
>  
>  unlock:
>  	rcu_read_unlock();
> +	/* The walker stopped before adding anything, so the next route
> +	 * is too large for this skb. Report that instead of letting an
> +	 * empty skb look like the end of the dump.
> +	 */
> +	if (err > 0 && !skb->len)
> +		err = -EMSGSIZE;
>  	if (err <= 0)
>  		fib6_dump_end(cb);
>  	return err;
> -- 
> 2.53.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>