deleted file mode 100644
@@ -1,47 +0,0 @@
-From b9cb461121c8721c94a94309eb345a3c2f9ee9b4 Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Thu, 2 Apr 2026 09:00:39 +0200
-Subject: [PATCH] totemsrp: Return error if sanity check fails
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Previously, the check_memb_commit_token_sanity function correctly
-checked the minimum message length. However, if the message was too
-short, it incorrectly returned a success code (0) instead of the
-expected failure code (-1).
-
-This commit ensures the appropriate error code is returned when the
-message length sanity check fails.
-
-Fixes: CVE-2026-35091
-
-Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
-Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
-Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
-
-CVE: CVE-2026-35091
-Upstream-Status: Backport [https://github.com/corosync/corosync/commit/a16614accfdb3481264d7281843fadf439d9ab1b]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- exec/totemsrp.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/exec/totemsrp.c b/exec/totemsrp.c
-index 35bf971..94d6c21 100644
---- a/exec/totemsrp.c
-+++ b/exec/totemsrp.c
-@@ -3811,10 +3811,10 @@ static int check_memb_commit_token_sanity(
- log_printf (instance->totemsrp_log_level_security,
- "Received memb_commit_token message is too short... ignoring.");
-
-- return (0);
-+ return (-1);
- }
-
-- addr_entries= mct_msg->addr_entries;
-+ addr_entries = mct_msg->addr_entries;
- if (endian_conversion_needed) {
- addr_entries = swab32(addr_entries);
- }
deleted file mode 100644
@@ -1,57 +0,0 @@
-From 8f8a4747a0223b8897deda9a40a8a099c61fa80f Mon Sep 17 00:00:00 2001
-From: Jan Friesse <jfriesse@redhat.com>
-Date: Thu, 2 Apr 2026 09:44:06 +0200
-Subject: [PATCH] totemsrp: Fix integer overflow in memb_join_sanity
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This commit addresses an integer overflow (wraparound) vulnerability
-in the check_memb_join_sanity function.
-
-Previously, the 32-bit unsigned network values proc_list_entries and
-failed_list_entries were added together before being promoted to
-size_t. This allowed the addition to wrap around in 32-bit arithmetic
-(e.g., 0x80000000 + 0x80000000 = 0), resulting in a required_len
-calculation that was incorrectly small.
-
-The solution is to cast the list entries to size_t and verify that
-neither exceeds the maximum allowed value before the addition occurs.
-
-Fixes: CVE-2026-35092
-
-Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
-Signed-off-by: Jan Friesse <jfriesse@redhat.com>
-Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
-Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
-
-CVE: CVE-2026-35092
-Upstream-Status: Backport [https://github.com/corosync/corosync/commit/4082294f5094a7591e4e00658c5a605f05d644f1]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- exec/totemsrp.c | 12 +++++++++++-
- 1 file changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/exec/totemsrp.c b/exec/totemsrp.c
-index 94d6c21..6845cec 100644
---- a/exec/totemsrp.c
-+++ b/exec/totemsrp.c
-@@ -3786,7 +3786,17 @@ static int check_memb_join_sanity(
- failed_list_entries = swab32(failed_list_entries);
- }
-
-- required_len = sizeof(struct memb_join) + ((proc_list_entries + failed_list_entries) * sizeof(struct srp_addr));
-+ if (proc_list_entries > PROCESSOR_COUNT_MAX ||
-+ failed_list_entries > PROCESSOR_COUNT_MAX) {
-+ log_printf (instance->totemsrp_log_level_security,
-+ "Received memb_join message list_entries exceeds the maximum "
-+ "allowed value... ignoring.");
-+
-+ return (-1);
-+ }
-+
-+ required_len = sizeof(struct memb_join) +
-+ (((size_t)proc_list_entries + (size_t)failed_list_entries) * sizeof(struct srp_addr));
- if (msg_len < required_len) {
- log_printf (instance->totemsrp_log_level_security,
- "Received memb_join message is too short... ignoring.");
similarity index 93%
rename from meta-networking/recipes-extended/corosync/corosync_3.1.10.bb
rename to meta-networking/recipes-extended/corosync/corosync_3.2.0.bb
@@ -9,10 +9,8 @@ inherit autotools pkgconfig systemd github-releases
SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
file://corosync.conf \
- file://CVE-2026-35091.patch \
- file://CVE-2026-35092.patch \
"
-SRC_URI[sha256sum] = "be361c827f99b215b3bd3fa2fb071c03dac6831c2a351963d938caef62604bc8"
+SRC_URI[sha256sum] = "be92a882ec738b17528777d344f54c6784245fb7b9dec20fcd9022adaac12bfe"
UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
LICENSE = "BSD-3-Clause"
Drop CVE-2026-35091.patch and CVE-2026-35092.patch, included in this release. AI-Generated: Uses Claude Code Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> --- .../corosync/corosync/CVE-2026-35091.patch | 47 --------------- .../corosync/corosync/CVE-2026-35092.patch | 57 ------------------- .../{corosync_3.1.10.bb => corosync_3.2.0.bb} | 4 +- 3 files changed, 1 insertion(+), 107 deletions(-) delete mode 100644 meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch delete mode 100644 meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch rename meta-networking/recipes-extended/corosync/{corosync_3.1.10.bb => corosync_3.2.0.bb} (93%)