more POLL... fun

[Al Viro]

On cross-builds the __poll_t annotations had caught something interesting:
void spufs_mfc_callback(struct spu *spu)
{
	....
                mask = 0;
                if (free_elements & 0xffff)
                        mask |= POLLOUT;
                if (tagstatus & ctx->tagwait)
                        mask |= POLLIN;

                kill_fasync(&ctx->mfc_fasync, SIGIO, mask);
	....
}

That's arch/powerpc/platforms/cell/spufs/file.c.  WTF is kill_fasync()
getting as the last argument here?  Valid values are
#define POLL_IN         (__SI_POLL|1)   /* data input available */
#define POLL_OUT        (__SI_POLL|2)   /* output buffers available */
#define POLL_MSG        (__SI_POLL|3)   /* input message available */
#define POLL_ERR        (__SI_POLL|4)   /* i/o error */
#define POLL_PRI        (__SI_POLL|5)   /* high priority input available */
#define POLL_HUP        (__SI_POLL|6)   /* device disconnected */

Use of POLLIN, POLLOUT, etc. here is wrong - kill_fasync() will step into
                        BUG_ON((reason & __SI_MASK) != __SI_POLL);
in send_sigio_to_task().  Other two callers of kill_fasync() in that file
are trivially fixed by switching to POLL_IN and POLL_OUT; with this one
I've no idea what had been intended.

What's more, I really wonder if it had _ever_ been tested - these kill_fasync()
calls had been introduced in
commit 8b3d6663c6217e4f50cc3720935a96da9b984117
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Tue Nov 15 15:53:52 2005 -0500

    [PATCH] spufs: cooperative scheduler support
more than 5 years after that BUG_ON() had been added - it goes back to
+                       /* Make sure we are called with one of the POLL_*
+                          reasons, otherwise we could leak kernel stack into
+                          userspace.  */
+                       if ((reason & __SI_MASK) != __SI_POLL)
+                               BUG();
in 2.3.99pre-10-3, on May 25 2000.

What the hell am I missing here?  Has that code been DOA and never used by
anyone in all the decade it had been in mainline?