[PATCH stable] io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE

[Kai Aizen <kai.aizen.dev@gmail.com>]

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit 1967f0b1cafdde37aa9e08e6021c14bcc484b7a5 ]

Commit aacf2f9f382c ("io_uring: fix req->apoll_events") addressed
synchronization issues between poll->events and req->apoll_events.
However, a subsequent commit failed to maintain this consistency in the
EPOLL_URING_WAKE code path.

The patch ensures that when EPOLLONESHOT is set during regular
EPOLL_URING_WAKE handling, it's applied to both poll->events and
req->apoll_events. This prevents a condition where "IORING_CQE_F_MORE
is set in the previous CQE, while no more CQEs will be generated for
this request."

Backport notes:
  This patch applies cleanly and identically to linux-6.18.y,
  linux-6.12.y, linux-6.6.y, and linux-6.1.y.  The io_poll_wake()
  EPOLL_URING_WAKE branch is byte-identical to the upstream pre-patch
  state across all four trees.

Cc: stable@vger.kernel.org # 6.1+
Link: https://lore.kernel.org/io-uring/CAM0zi7yQzF3eKncgHo4iVM5yFLAjsiob_ucqyWKs=hyd_GqiMg@mail.gmail.com/
Reported-by: Azizcan Daştan <azizcan.d@mileniumsec.com>
Fixes: 4464853277d0 ("io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[backport for linux-6.18.y / 6.12.y / 6.6.y / 6.1.y, verified 2026-05-01]
---
 io_uring/poll.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/poll.c b/io_uring/poll.c
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -417,8 +417,10 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
 		 * disable multishot as there is a circular dependency between
 		 * CQ posting and triggering the event.
 		 */
-		if (mask & EPOLL_URING_WAKE)
+		if (mask & EPOLL_URING_WAKE) {
 			poll->events |= EPOLLONESHOT;
+			req->apoll_events |= EPOLLONESHOT;
+		}

 		/* optional, saves extra locking for removal in tw handler */
 		if (mask && poll->events & EPOLLONESHOT) {
--
2.43.0