Re: [PATCH] mshv_vtl: reject poll files with multiple waitqueues

[Naman Jain <namjain@linux.microsoft.com>]

On 10/16/2026 11:41 AM, Daehyeon Ko wrote:
> MSHV_SET_POLL_FILE invokes a file descriptor poll callback with a poll
> table backed by a single embedded wait entry. A poll callback may,
> however, register the table with more than one waitqueue. pipe_poll()
> does this naturally for an O_RDWR FIFO.
> 
> The second registration currently warns but then inserts the same list
> node into another list. The new insertion overwrites the entry links while
> the first waitqueue still points at it, corrupting the first waitqueue and
> causing an invalid callback traversal when that queue wakes.
> 
> Reject a second distinct waitqueue, remove the first registration, and
> return -EINVAL from the ioctl. Repeated registration of the same waitqueue
> is treated as a no-op. A rejected replacement leaves the CPU slot
> unregistered, consistent with the existing remove-before-register ordering.
> Single-waitqueue users such as the OpenHCL io_uring poll file keep their
> existing behavior.
> 
> Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag is no longer valid on latest linux-next tip and gives 
checkpatch error.

Code changes LGTM.

> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> ---
>   drivers/hv/mshv_vtl_main.c | 24 ++++++++++++++++++++++--
>   1 file changed, 22 insertions(+), 2 deletions(-)
> 
Regards,
Naman