[PATCH] virtio: fix out-of-bounds scatterlist array access in virtqueue_add_{in,out}buf

[Sascha Hauer]

On Mon, 31 Aug 2026 16:47:44 +0200, Ahmad Fatoum wrote:
> virtqueue_add_outbuf() and virtqueue_add_inbuf() take one scatterlist
> with N entries, but pass N to virtqueue_add_sgs() as the number of
> scatterlists, which then reads sgs[1] past the single pointer on the
> stack. In virtio_net_send(), GCC happened to place the zeroed
> virtio_net_hdr there, so the bogus entry was NULL and skipped. With
> clang it's the saved frame pointer:
> 
> [...]

Applied, thanks!

[1/1] virtio: fix out-of-bounds scatterlist array access in virtqueue_add_{in,out}buf
      https://git.pengutronix.de/cgit/barebox/commit/?id=24e609e61e5e (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer at pengutronix.de>