prepare_reply() adds GENL_HDRLEN to the payload (genlmsg_total_size()),
but then it does genlmsg_put()->nlmsg_put().  This means we forget to
reserve a room for 'struct nlmsghdr'.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Thomas Graf <tgraf@suug.ch>
Cc: Andrew Morton <akpm@osdl.org>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
        /*
         * If new attributes are added, please revisit this allocation
         */
-       skb = nlmsg_new(genlmsg_total_size(size), GFP_KERNEL);
+       size = nlmsg_total_size(genlmsg_total_size(size));
+       skb = nlmsg_new(size, GFP_KERNEL);
        if (!skb)
                return -ENOMEM;