[AutoPR- Security] Patch qemu for CVE-2025-63913 [MEDIUM]

SPECS/qemu/CVE-2025-63913.patch

@@ -0,0 +1,102 @@
+From 14dd6601b9806aa2932ed7a63e09db638efc4b04 Mon Sep 17 00:00:00 2001
+From: James Raphael Tiovalen <jamestiotio@gmail.com>
+Date: Tue, 20 May 2025 21:25:33 +0800
+Subject: [PATCH] lib: sbi: pmu: Return SBI_EINVAL if cidx_mask is 0
+
+Currently, when configuring a matching programmable HPM counter with
+Sscofpmf being present, cidx_base > 2, and cidx_mask == 0 to monitor
+either the CPU_CYCLES or INSTRUCTIONS hardware event,
+sbi_pmu_ctr_cfg_match will succeed but it will configure the
+corresponding fixed counter instead of the counter specified by the
+cidx_base parameter.
+
+During counter configuration, the following issues may arise:
+- If the SKIP_MATCH flag is set, an out-of-bounds memory read of the
+phs->active_events array would occur, which could lead to undefined
+behavior.
+
+- If the CLEAR_VALUE flag is set, the corresponding fixed counter will
+be reset, which could be considered unexpected behavior.
+
+- If the AUTO_START flag is set, pmu_ctr_start_hw will silently start
+the fixed counter, even though it has already started. From the
+supervisor's perspective, nothing has changed, which could be confusing.
+The supervisor will not see the SBI_ERR_ALREADY_STARTED error code since
+sbi_pmu_ctr_cfg_match does not return the error code of
+pmu_ctr_start_hw.
+
+The only way to detect these issues is to check the ctr_idx return value
+of sbi_pmu_ctr_cfg_match and compare it with cidx_base.
+
+Fix these issues by returning the SBI_ERR_INVALID_PARAM error code if
+the cidx_mask parameter value being passed in is 0 since an invalid
+parameter should not lead to a successful sbi_pmu_ctr_cfg_match but with
+unexpected side effects.
+
+Following a similar rationale, add the validation check to
+sbi_pmu_ctr_start and sbi_pmu_ctr_stop as well since sbi_fls is
+undefined when the mask is 0.
+
+This also aligns OpenSBI's behavior with KVM's.
+
+Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20250520132533.30974-1-jamestiotio@gmail.com
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://github.com/riscv-software-src/opensbi/commit/69a0f0245f39ea3af4685cab4cb2dda90acd17cd.patch
+---
+ roms/opensbi/lib/sbi/sbi_pmu.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/roms/opensbi/lib/sbi/sbi_pmu.c b/roms/opensbi/lib/sbi/sbi_pmu.c
+index b9e8454..ae6a01c 100644
+--- a/roms/opensbi/lib/sbi/sbi_pmu.c
++++ b/roms/opensbi/lib/sbi/sbi_pmu.c
+@@ -204,6 +204,12 @@ static int pmu_ctr_validate(struct sbi_pmu_hart_state *phs,
+ 	return event_idx_type;
+ }
+
++static bool pmu_ctr_idx_validate(unsigned long cbase, unsigned long cmask)
++{
++	/* Do a basic sanity check of counter base & mask */
++	return cmask && cbase + sbi_fls(cmask) < total_ctrs;
++}
++
+ int sbi_pmu_ctr_fw_read(uint32_t cidx, uint64_t *cval)
+ {
+ 	int event_idx_type;
+@@ -459,7 +465,7 @@ int sbi_pmu_ctr_start(unsigned long cbase, unsigned long cmask,
+ 	int i, cidx;
+ 	uint64_t edata;
+
+-	if ((cbase + sbi_fls(cmask)) >= total_ctrs)
++	if (!pmu_ctr_idx_validate(cbase, cmask))
+ 		return ret;
+
+ 	if (flags & SBI_PMU_STOP_FLAG_TAKE_SNAPSHOT)
+@@ -564,8 +570,8 @@ int sbi_pmu_ctr_stop(unsigned long cbase, unsigned long cmask,
+ 	uint32_t event_code;
+ 	int i, cidx;
+
+-	if ((cbase + sbi_fls(cmask)) >= total_ctrs)
+-		return SBI_EINVAL;
++	if (!pmu_ctr_idx_validate(cbase, cmask))
++		return ret;
+
+ 	if (flag & SBI_PMU_STOP_FLAG_TAKE_SNAPSHOT)
+ 		return SBI_ENO_SHMEM;
+@@ -829,8 +835,7 @@ int sbi_pmu_ctr_cfg_match(unsigned long cidx_base, unsigned long cidx_mask,
+ 	int ret, event_type, ctr_idx = SBI_ENOTSUPP;
+ 	u32 event_code;
+
+-	/* Do a basic sanity check of counter base & mask */
+-	if ((cidx_base + sbi_fls(cidx_mask)) >= total_ctrs)
++	if (!pmu_ctr_idx_validate(cidx_base, cidx_mask))
+ 		return SBI_EINVAL;
+
+ 	event_type = pmu_event_validate(phs, event_idx, event_data);
+-- 
+2.45.4
+

SPECS/qemu/qemu.spec

@@ -432,7 +432,7 @@ Obsoletes: sgabios-bin <= 1:0.20180715git-10.fc38
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 9.1.0
-Release: 11%{?dist}
+Release: 12%{?dist}
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND FSFAP AND GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-2.0-or-later WITH GCC-exception-2.0 AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND MIT AND LicenseRef-Fedora-Public-Domain AND CC-BY-3.0
 URL: http://www.qemu.org/
 
@@ -474,6 +474,7 @@ Patch31:  CVE-2026-3195.patch
 Patch32:  CVE-2026-48914.patch
 Patch33:  CVE-2026-3196.patch
 Patch34:  CVE-2026-3842.patch
+Patch35:  CVE-2025-63913.patch
 
 Source10: qemu-guest-agent.service
 Source11: 99-qemu-guest-agent.rules
@@ -3523,6 +3524,9 @@ fi
 # endif !tools_only
 %endif
 %changelog
+* Fri Jul 31 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 9.1.0-12
+- Patch for CVE-2025-63913
+
 * Mon Jul 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 9.1.0-11
 - Patch for CVE-2026-3842