From 02aa0037294ea22b2cd6eeed06e2116c688b541c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 7 Aug 2026 15:14:21 +0200
Subject: [PATCH] cloud-hypervisor: backport musl 1.2.6 fix

We recently upgraded to musl 1.2.6, and since then Cloud Hypervisor
crashes with the sandbox enabled.  Backport my fix, which has been
merged upstream.
---
 .../cl/cloud-hypervisor/musl-1.2.6.patch      | 50 +++++++++++++++++++
 pkgs/by-name/cl/cloud-hypervisor/package.nix  |  4 ++
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/by-name/cl/cloud-hypervisor/musl-1.2.6.patch

diff --git a/pkgs/by-name/cl/cloud-hypervisor/musl-1.2.6.patch b/pkgs/by-name/cl/cloud-hypervisor/musl-1.2.6.patch
new file mode 100644
index 000000000000..6cb799ff9ed9
--- /dev/null
+++ b/pkgs/by-name/cl/cloud-hypervisor/musl-1.2.6.patch
@@ -0,0 +1,50 @@
+From b28ec4cda06af1afe378783bb505e1d9d62a4e4c Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 4 Aug 2026 01:45:12 +0200
+Subject: [PATCH] seccomp: allow pwritev2
+
+Since the latest release, musl preferentially uses this syscall in its
+pwrite and pwritev implementations.
+
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+(cherry picked from commit 3e8d2dac6f83ee8e741e88ac5d4298050d17693e)
+---
+ virtio-devices/src/seccomp_filters.rs | 1 +
+ vmm/src/seccomp_filters.rs            | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs
+index 75f493448..cbde59ea3 100644
+--- a/virtio-devices/src/seccomp_filters.rs
++++ b/virtio-devices/src/seccomp_filters.rs
+@@ -128,6 +128,7 @@ fn virtio_block_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
+         (libc::SYS_pread64, vec![]),
+         (libc::SYS_preadv, vec![]),
+         (libc::SYS_pwritev, vec![]),
++        (libc::SYS_pwritev2, vec![]),
+         (libc::SYS_pwrite64, vec![]),
+         (libc::SYS_sched_getaffinity, vec![]),
+         (libc::SYS_sched_setaffinity, vec![]),
+diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs
+index 308cfa6bf..cfbde2866 100644
+--- a/vmm/src/seccomp_filters.rs
++++ b/vmm/src/seccomp_filters.rs
+@@ -725,6 +725,7 @@ fn vmm_thread_rules(
+         (libc::SYS_prlimit64, vec![]),
+         (libc::SYS_pwrite64, vec![]),
+         (libc::SYS_pwritev, vec![]),
++        (libc::SYS_pwritev2, vec![]),
+         (libc::SYS_read, vec![]),
+         (libc::SYS_readv, vec![]),
+         #[cfg(target_arch = "x86_64")]
+@@ -934,6 +935,7 @@ fn vcpu_thread_rules(
+         (libc::SYS_openat, vec![]),
+         (libc::SYS_pread64, vec![]),
+         (libc::SYS_pwrite64, vec![]),
++        (libc::SYS_pwritev2, vec![]),
+         (libc::SYS_read, vec![]),
+         #[cfg(target_arch = "x86_64")]
+         (libc::SYS_readlink, vec![]),
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/cl/cloud-hypervisor/package.nix b/pkgs/by-name/cl/cloud-hypervisor/package.nix
index 064a1c91e8b4..a68d80fd71e0 100644
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@@ -23,6 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-+RbW/9ap/69MyODUk/bHBlH6ZuqYYIyKaarYSMQ2G7w=";
 
+  patches = [
+    ./musl-1.2.6.patch
+  ];
+
   separateDebugInfo = true;
 
   nativeBuildInputs = [ pkg-config ];