6.12-stable patches

added patches:
	series
	stable-crypto-sha256-fix-crash-at-kexec.patch

diff --git a/queue-6.12/series b/queue-6.12/series
new file mode 100644 (file)
index 0000000..6801d93
--- /dev/null
+++ b/queue-6.12/series
@@ -0,0 +1 @@
+stable-crypto-sha256-fix-crash-at-kexec.patch

diff --git a/queue-6.12/stable-crypto-sha256-fix-crash-at-kexec.patch b/queue-6.12/stable-crypto-sha256-fix-crash-at-kexec.patch
new file mode 100644 (file)
index 0000000..e28d811
--- /dev/null
+++ b/queue-6.12/stable-crypto-sha256-fix-crash-at-kexec.patch
@@ -0,0 +1,65 @@
+From leitao@debian.org  Fri Oct  3 14:51:49 2025
+From: Breno Leitao <leitao@debian.org>
+Date: Thu, 02 Oct 2025 04:26:20 -0700
+Subject: crypto: sha256 - fix crash at kexec
+To: gregkh@linuxfoundation.org, sashal@kernel.org
+Cc: stable@vger.kernel.org, Herbert Xu <herbert@gondor.apana.org.au>,  "David S. Miller" <davem@davemloft.net>, Ard Biesheuvel <ardb@kernel.org>,  linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,  kernel-team@meta.com, Breno Leitao <leitao@debian.org>,  Michael van der Westhuizen <rmikey@meta.com>,  Tobias Fleig <tfleig@meta.com>
+Message-ID: <20251002-stable_crash-v2-1-836adf233521@debian.org>
+
+From: Breno Leitao <leitao@debian.org>
+
+Loading a large (~2.1G) files with kexec crashes the host with when
+running:
+
+  # kexec --load kernel --initrd initrd_with_2G_or_more
+
+  UBSAN: signed-integer-overflow in ./include/crypto/sha256_base.h:64:19
+  34152083 * 64 cannot be represented in type 'int'
+  ...
+  BUG: unable to handle page fault for address: ff9fffff83b624c0
+  sha256_update (lib/crypto/sha256.c:137)
+  crypto_sha256_update (crypto/sha256_generic.c:40)
+  kexec_calculate_store_digests (kernel/kexec_file.c:769)
+  __se_sys_kexec_file_load (kernel/kexec_file.c:397 kernel/kexec_file.c:332)
+  ...
+
+(Line numbers based on commit da274362a7bd9 ("Linux 6.12.49")
+
+This started happening after commit f4da7afe07523f
+("kexec_file: increase maximum file size to 4G") that landed in v6.0,
+which increased the file size for kexec.
+
+This is not happening upstream (v6.16+), given that `block` type was
+upgraded from "int" to "size_t" in commit 74a43a2cf5e8 ("crypto:
+lib/sha256 - Move partial block handling out")
+
+Upgrade the block type similar to the commit above, avoiding hitting the
+overflow.
+
+This patch is only suitable for the stable tree, and before 6.16, which
+got commit 74a43a2cf5e8 ("crypto: lib/sha256 - Move partial block
+handling out"). This is not required before f4da7afe07523f ("kexec_file:
+increase maximum file size to 4G"). In other words, this fix is required
+between versions v6.0 and v6.16.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Fixes: f4da7afe07523f ("kexec_file: increase maximum file size to 4G") # Before v6.16
+Reported-by: Michael van der Westhuizen <rmikey@meta.com>
+Reported-by: Tobias Fleig <tfleig@meta.com>
+Reviewed-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/crypto/sha256_base.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/crypto/sha256_base.h
++++ b/include/crypto/sha256_base.h
+@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_upd
+       sctx->count += len;
+ 
+       if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) {
+-              int blocks;
++              unsigned int blocks;
+ 
+               if (partial) {
+                       int p = SHA256_BLOCK_SIZE - partial;