+++ /dev/null
-From leitao@debian.org Fri Oct 3 14:51:49 2025
-From: Breno Leitao <leitao@debian.org>
-Date: Thu, 02 Oct 2025 04:26:20 -0700
-Subject: crypto: sha256 - fix crash at kexec
-To: gregkh@linuxfoundation.org, sashal@kernel.org
-Cc: stable@vger.kernel.org, Herbert Xu <herbert@gondor.apana.org.au>, "David S. Miller" <davem@davemloft.net>, Ard Biesheuvel <ardb@kernel.org>, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com, Breno Leitao <leitao@debian.org>, Michael van der Westhuizen <rmikey@meta.com>, Tobias Fleig <tfleig@meta.com>
-Message-ID: <20251002-stable_crash-v2-1-836adf233521@debian.org>
-
-From: Breno Leitao <leitao@debian.org>
-
-Loading a large (~2.1G) files with kexec crashes the host with when
-running:
-
- # kexec --load kernel --initrd initrd_with_2G_or_more
-
- UBSAN: signed-integer-overflow in ./include/crypto/sha256_base.h:64:19
- 34152083 * 64 cannot be represented in type 'int'
- ...
- BUG: unable to handle page fault for address: ff9fffff83b624c0
- sha256_update (lib/crypto/sha256.c:137)
- crypto_sha256_update (crypto/sha256_generic.c:40)
- kexec_calculate_store_digests (kernel/kexec_file.c:769)
- __se_sys_kexec_file_load (kernel/kexec_file.c:397 kernel/kexec_file.c:332)
- ...
-
-(Line numbers based on commit da274362a7bd9 ("Linux 6.12.49")
-
-This started happening after commit f4da7afe07523f
-("kexec_file: increase maximum file size to 4G") that landed in v6.0,
-which increased the file size for kexec.
-
-This is not happening upstream (v6.16+), given that `block` type was
-upgraded from "int" to "size_t" in commit 74a43a2cf5e8 ("crypto:
-lib/sha256 - Move partial block handling out")
-
-Upgrade the block type similar to the commit above, avoiding hitting the
-overflow.
-
-This patch is only suitable for the stable tree, and before 6.16, which
-got commit 74a43a2cf5e8 ("crypto: lib/sha256 - Move partial block
-handling out"). This is not required before f4da7afe07523f ("kexec_file:
-increase maximum file size to 4G"). In other words, this fix is required
-between versions v6.0 and v6.16.
-
-Signed-off-by: Breno Leitao <leitao@debian.org>
-Fixes: f4da7afe07523f ("kexec_file: increase maximum file size to 4G") # Before v6.16
-Reported-by: Michael van der Westhuizen <rmikey@meta.com>
-Reported-by: Tobias Fleig <tfleig@meta.com>
-Reviewed-by: Eric Biggers <ebiggers@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- include/crypto/sha256_base.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/crypto/sha256_base.h b/include/crypto/sha256_base.h
-index e0418818d63c8..e3e610cfe8d30 100644
---- a/include/crypto/sha256_base.h
-+++ b/include/crypto/sha256_base.h
-@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx,
- sctx->count += len;
-
- if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) {
-- int blocks;
-+ unsigned int blocks;
-
- if (partial) {
- int p = SHA256_BLOCK_SIZE - partial;
-
----
-base-commit: da274362a7bd9ab3a6e46d15945029145ebce672
-change-id: 20251001-stable_crash-f2151baf043b
-
-Best regards,
---
-Breno Leitao <leitao@debian.org>
-