Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed,  2 Nov 2016 22:32:49 +0530
From: Vaishali Thakkar <>
Cc: Vaishali Thakkar <>
Subject: [RFC PATCH] lib: Harden csum_partial_copy_from_user

The routine csum_partial_copy_from_user is same as csum_partial_copy
but it copies from user space for the checksumming. In other respects
it is identical, and can be used to copy an arbitrarily large buffer
from userspace into the kernel. Conceptually this exposes a similar
attack surface like copy_from_user. So, to validate the given address
we should call check_object_size here.

Note that in the absence of hardened usercopy this will have no impact.

Signed-off-by: Vaishali Thakkar <>
 lib/checksum.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/checksum.c b/lib/checksum.c
index d3ec93f..2e0fec8 100644
--- a/lib/checksum.c
+++ b/lib/checksum.c
@@ -33,6 +33,7 @@
  kills, so most of the assembly has to go. */
 #include <linux/export.h>
+#include <linux/thread_info.h>
 #include <net/checksum.h>
 #include <asm/byteorder.h>
@@ -158,6 +159,7 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
 	int missing;
+	check_object_size(dst, len, false);
 	missing = __copy_from_user(dst, src, len);
 	if (missing) {
 		memset(dst + len - missing, 0, missing);

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.