5 files changed, 82 insertions, 17 deletions

diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch
new file mode 100644
index 0000000000..9b36dbe3fb
--- /dev/null
+++ b/meta-networking/recipes-extended/corosync/corosync/CVE-2025-30472.patch
@@ -0,0 +1,69 @@
+From 7839990f9cdf34e55435ed90109e82709032466a Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Mon, 24 Mar 2025 12:05:08 +0100
+Subject: [PATCH] totemsrp: Check size of orf_token msg
+
+orf_token message is stored into preallocated array on endian convert
+so carefully crafted malicious message can lead to crash of corosync.
+
+Solution is to check message size beforehand.
+
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+
+CVE: CVE-2025-30472
+Upstream-Status: Backport [https://github.com/corosync/corosync/commits/7839990f9cdf34e55435ed90109e82709032466a]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ exec/totemsrp.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index 962d0e2a..364528ce 100644
+--- a/exec/totemsrp.c
++++ b/exec/totemsrp.c
+@@ -3679,12 +3679,20 @@ static int check_orf_token_sanity(
+        const struct totemsrp_instance *instance,
+        const void *msg,
+        size_t msg_len,
++       size_t max_msg_len,
+        int endian_conversion_needed)
+ {
+        int rtr_entries;
+        const struct orf_token *token = (const struct orf_token *)msg;
+        size_t required_len;
+ 
++       if (msg_len > max_msg_len) {
++               log_printf (instance->totemsrp_log_level_security,
++                   "Received orf_token message is too long...  ignoring.");
++
++               return (-1);
++       }
++
+        if (msg_len < sizeof(struct orf_token)) {
+                log_printf (instance->totemsrp_log_level_security,
+                    "Received orf_token message is too short...  ignoring.");
+@@ -3698,6 +3706,13 @@ static int check_orf_token_sanity(
+                rtr_entries = token->rtr_list_entries;
+        }
+ 
++       if (rtr_entries > RETRANSMIT_ENTRIES_MAX) {
++               log_printf (instance->totemsrp_log_level_security,
++                   "Received orf_token message rtr_entries is corrupted...  ignoring.");
++
++               return (-1);
++       }
++
+        required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
+        if (msg_len < required_len) {
+                log_printf (instance->totemsrp_log_level_security,
+@@ -3868,7 +3883,8 @@ static int message_handler_orf_token (
+            "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC);
+ #endif
+ 
+-       if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) {
++       if (check_orf_token_sanity(instance, msg, msg_len, sizeof(token_storage),
++           endian_conversion_needed) == -1) {
+                return (0);
+        }
+ 
diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb
index 8fca576614..1699701c9d 100644
--- a/meta-networking/recipes-extended/corosync/corosync_3.1.6.bb
+++ b/meta-networking/recipes-extended/corosync/corosync_3.1.9.bb
@@ -5,16 +5,17 @@ HOMEPAGE = "http://corosync.github.io/corosync/"
 
 SECTION = "base"
 
-inherit autotools pkgconfig systemd
+inherit autotools pkgconfig systemd github-releases
 
-SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/v${PV}/${BP}.tar.gz \
+SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
            file://corosync.conf \
+           file://CVE-2025-30472.patch \
           "
-SRC_URI[sha256sum] = "ca6ed32b4d7f33ed614afce8760fe58d0de92c68b575d4969ebacd892f3d1e27"
-UPSTREAM_CHECK_REGEX = "(?P<pver>\d+\.(?!99)\d+(\.\d+)+)"
+SRC_URI[sha256sum] = "203354bbddee1a97b3c50a076eae89c635f406dd674ccaefc94bb9092acd9535"
+UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
 
 LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=a85eb4ce24033adb6088dd1d6ffc5e5d"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=d9c2cca5d3448c43e52a399ad611658a"
 
 DEPENDS = "groff-native nss libqb kronosnet"
 
@@ -34,13 +35,8 @@ PACKAGECONFIG[systemd] = "--enable-systemd --with-systemddir=${systemd_system_un
 EXTRA_OECONF = "ac_cv_path_BASHPATH=${base_bindir}/bash ap_cv_cc_pie=no"
 EXTRA_OEMAKE = "tmpfilesdir_DATA="
 
-#do_configure:prepend() {
-#    ( cd ${S}
-#    ${S}/autogen.sh )
-#}
-
 do_install:append() {
-    install -D -m 0644 ${WORKDIR}/corosync.conf ${D}${sysconfdir}/corosync/corosync.conf.example
+    install -D -m 0644 ${UNPACKDIR}/corosync.conf ${D}${sysconfdir}/corosync/corosync.conf.example
     install -d ${D}${sysconfdir}/sysconfig/
     install -m 0644 ${S}/init/corosync.sysconfig.example ${D}${sysconfdir}/sysconfig/corosync
     install -m 0644 ${S}/tools/corosync-notifyd.sysconfig.example ${D}${sysconfdir}/sysconfig/corosync-notifyd
@@ -59,5 +55,6 @@ do_install:append() {
 
 RDEPENDS:${PN} += "bash ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'sysvinit-pidof', 'procps', d)}"
 
+FILES:${PN} += "${datadir}/dbus-1"
 FILES:${PN}-dbg += "${libexecdir}/lcrso/.debug"
 FILES:${PN}-doc += "${datadir}/snmp/mibs/COROSYNC-MIB.txt"
diff --git a/meta-networking/recipes-extended/dlm/dlm_4.2.0.bb b/meta-networking/recipes-extended/dlm/dlm_4.2.0.bb
index ee006efe28..b7966d7f12 100644
--- a/meta-networking/recipes-extended/dlm/dlm_4.2.0.bb
+++ b/meta-networking/recipes-extended/dlm/dlm_4.2.0.bb
@@ -21,7 +21,7 @@ UPSTREAM_CHECK_REGEX = "dlm-(?P<pver>\d+(\.\d+)+)"
 LICENSE = "LGPL-2.0-or-later & GPL-2.0-only & GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://README.license;md5=8f0bbcdd678df1bce9863492b6c8832d"
 
-S = "${WORKDIR}/dlm-dlm-${PV}"
+S = "${UNPACKDIR}/dlm-dlm-${PV}"
 
 DEPENDS += "corosync"
 
@@ -37,6 +37,7 @@ SYSTEMD_AUTO_ENABLE = "enable"
 export EXTRA_OEMAKE = ""
 
 CFPROTECTION ?= "-fcf-protection=full"
+CFPROTECTION:riscv32 = ""
 CFPROTECTION:riscv64 = ""
 CFPROTECTION:arm = ""
 CFPROTECTION:aarch64 = ""
diff --git a/meta-networking/recipes-extended/kronosnet/kronosnet_1.24.bb b/meta-networking/recipes-extended/kronosnet/kronosnet_1.24.bb
index cbd5e7a0fd..06b2fa4d2d 100644
--- a/meta-networking/recipes-extended/kronosnet/kronosnet_1.24.bb
+++ b/meta-networking/recipes-extended/kronosnet/kronosnet_1.24.bb
@@ -20,7 +20,6 @@ UPSTREAM_CHECK_URI = "https://github.com/kronosnet/kronosnet/releases"
 
 inherit autotools pkgconfig
 
-S = "${WORKDIR}/git"
 
 # libknet/transport_udp.c:326:48: error: comparison of integers of different signs: 'unsigned long' and 'int' [-Werror,-Wsign-compare]
 # for (cmsg = CMSG_FIRSTHDR(&msg);cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
diff --git a/meta-networking/recipes-extended/tgt/tgt_1.0.90.bb b/meta-networking/recipes-extended/tgt/tgt_1.0.90.bb
index 35995f7876..a110d556a3 100644
--- a/meta-networking/recipes-extended/tgt/tgt_1.0.90.bb
+++ b/meta-networking/recipes-extended/tgt/tgt_1.0.90.bb
@@ -17,7 +17,6 @@ SRC_URI += "file://tgtd.init \
             file://tgtd \
 "
 
-S = "${WORKDIR}/git"
 
 CONFFILES:${PN} += "${sysconfdir}/tgt/targets.conf"
 
@@ -39,12 +38,12 @@ do_install() {
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
         install -d ${D}${sysconfdir}/init.d
-        install -m 0755 ${WORKDIR}/tgtd.init ${D}${sysconfdir}/init.d/tgtd
+        install -m 0755 ${UNPACKDIR}/tgtd.init ${D}${sysconfdir}/init.d/tgtd
     elif ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 0644 ${WORKDIR}/tgtd.service ${D}${systemd_unitdir}/system/tgtd.service
+        install -m 0644 ${UNPACKDIR}/tgtd.service ${D}${systemd_unitdir}/system/tgtd.service
         install -d ${D}${sysconfdir}/sysconfig
-        install -m 0644 ${WORKDIR}/tgtd ${D}${sysconfdir}/sysconfig/tgtd
+        install -m 0644 ${UNPACKDIR}/tgtd ${D}${sysconfdir}/sysconfig/tgtd
         sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/tgtd.service
         sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' ${D}${systemd_unitdir}/system/tgtd.service
         sed -i -e 's,@SYSCONFDIR@,${sysconfdir},g' ${D}${systemd_unitdir}/system/tgtd.service