On Mon, 31 Aug 2026 16:47:44 +0200, Ahmad Fatoum wrote:
> virtqueue_add_outbuf() and virtqueue_add_inbuf() take one scatterlist
> with N entries, but pass N to virtqueue_add_sgs() as the number of
> scatterlists, which then reads sgs[1] past the single pointer on the
> stack. In virtio_net_send(), GCC happened to place the zeroed
> virtio_net_hdr there, so the bogus entry was NULL and skipped. With
> clang it's the saved frame pointer:
>
> [...]
Applied, thanks!
[1/1] virtio: fix out-of-bounds scatterlist array access in
virtqueue_add_{in,out}buf
https://git.pengutronix.de/cgit/barebox/commit/?id=24e609e61e5e (link may
not be stable)
Best regards,
--
Sascha Hauer <[email protected]>
