On Wed, Feb 14, 2018 at 01:30:37PM +0100, Florian Westphal wrote: > Eric Dumazet <eric.duma...@gmail.com> wrote: > > On Wed, 2018-02-14 at 12:13 +0100, Paolo Abeni wrote: > > > syzbot reported a division by 0 bug in the netfilter nat code: > > > > > Adding the relevant check at parse time could break existing > > > setup, moreover we would need to read/write such values atomically > > > to avoid possible transient negative ranges at update time. > > > > I do not quite follow why it is so hard to add a check at parse time. > > > > Breaking buggy setups would not be a concern I think. > > It would be possible for xtables but afaics in nft_nat.c case > (nft_nat_eval) range.{min,max}_proto.all values are loaded from nft > registers at runtime.
Then, restrict this from nft_nat.