On Tue, Nov 03, 2026 at 07:17:34PM +0800, Guanglei Zhu wrote: > You are right, the impact statement does not hold up: the reused > buffer still contains a previously valid control message,
Not always, the buffers are allocated with GFP_KERNEL on the 1st pass. > so a short > packet makes the driver parse stale - not attacker-controlled - data, Who is the attacker here the device? it is absolutely controlling all of virtio_console_control. > and that is not worth carrying an extra check for. Please drop this > patch. > > Sorry for the noise, and thanks for the review. I ask that you please think critically not just go back and forth on it like an LLM. -- MST
