Re: [SECURITY] netfilter: nft_limit byte-rate bypass via unchecked u64 multiplication

[Pablo Neira Ayuso <pablo@netfilter.org>]

Restoring ML as Cc:, please don't drop these.

On Sun, Oct 11, 2026 at 02:06:15PM +0100, SaifAllah benMassaoud wrote:
> Hi,
> 
> Thank you for your feedback.
> 
> The issue I reported is not that limit rate 30000 bytes/week fails to
> configure. The concern is that the multiplication used to calculate the
> token-bucket cost can overflow:
> 
> u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
> 
> This occurs in both nft_limit_bytes_eval() and nft_limit_obj_bytes_eval().
> For the tested configuration and packet lengths, the overflow causes the
> calculated cost to wrap to a significantly smaller value, allowing
> substantially more traffic than the configured byte rate would otherwise
> permit.
>
> I understand your suggestion to use nft_quota for byte-count enforcement.
> However, I would appreciate clarification on whether this behavior is
> considered expected for nft_limit or whether packet lengths that trigger
> the overflow are intended to be unsupported.

This can just be rejected from _init() path in a patch for nf-next.

> If this behavior is expected, could you point me to the relevant
> documentation or implementation rationale?

You decided to tag this with [SECURITY].

But why you or your LLM decided that this a security issue!?