--- /dev/null
+From 7a61c38c4d6ae3d5cbe6efa06885b1ca821a129c Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 21 Apr 2026 16:44:06 -0600
+Subject: io_uring/poll: fix backport of io_poll_add() changes
+
+From: Jens Axboe <axboe@kernel.dk>
+
+The 5.15/5.10 backport of 84230ad2d2af had a few issues, due to the
+older poll base. Notably return value handling __io_arm_poll_handler()
+and in return __io_poll_add() as well. Fix them up.
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Fixes: 349ef5d2e7bf ("io_uring/poll: correctly handle io_poll_add() return value on update")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -5991,19 +5991,15 @@ static int __io_poll_add(struct io_kiocb
+ if (!ret && ipt.error)
+ req_set_fail(req);
+ ret = ret ?: ipt.error;
+- if (ret > 0) {
++ if (ret)
+ __io_req_complete(req, issue_flags, ret, 0);
+- return ret;
+- }
+- return 0;
++ return ret;
+ }
+
+ static int io_poll_add(struct io_kiocb *req, unsigned int issue_flags)
+ {
+- int ret;
+-
+- ret = __io_poll_add(req, issue_flags);
+- return ret < 0 ? ret : 0;
++ __io_poll_add(req, issue_flags);
++ return 0;
+ }
+
+ static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags)
--- /dev/null
+From 7fdfffce508f38d89338e8bbed421dd91ddfcb3f Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 21 Apr 2026 16:41:32 -0600
+Subject: io_uring/poll: fix EPOLL_URING_WAKE sometimes not being masked in
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Rather than do it only when we jump straight to execution, mark it
+regardless. This ensures it doesn't get lost.
+
+Fixes: ccf06b5a981c ("io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -5647,17 +5647,16 @@ static int io_poll_wake(struct wait_queu
+ if (mask && !(mask & poll->events))
+ return 0;
+
+- if (io_poll_get_ownership(req)) {
+- /*
+- * If we trigger a multishot poll off our own wakeup path,
+- * disable multishot as there is a circular dependency between
+- * CQ posting and triggering the event.
+- */
+- if (mask & EPOLL_URING_WAKE)
+- poll->events |= EPOLLONESHOT;
++ /*
++ * If we trigger a multishot poll off our own wakeup path,
++ * disable multishot as there is a circular dependency between
++ * CQ posting and triggering the event.
++ */
++ if (mask & EPOLL_URING_WAKE)
++ poll->events |= EPOLLONESHOT;
+
++ if (io_poll_get_ownership(req))
+ __io_poll_execute(req, mask);
+- }
+ return 1;
+ }
+
timers-update-the-documentation-to-reflect-on-the-new-timer_shutdown-api.patch
bluetooth-hci_qca-fix-the-teardown-problem-for-real.patch
timers-fix-null-function-pointer-race-in-timer_shutdown_sync.patch
+io_uring-poll-fix-epoll_uring_wake-sometimes-not-being-masked-in.patch
+io_uring-poll-fix-backport-of-io_poll_add-changes.patch