#define IO_REQ_ALLOC_BATCH             8
 
 struct io_comp_state {
-       unsigned int            nr;
        struct io_kiocb         *reqs[IO_COMPL_BATCH];
+       unsigned int            nr;
+       struct list_head        free_list;
 };
 
 struct io_submit_state {
        INIT_LIST_HEAD(&ctx->rsrc_ref_list);
        INIT_DELAYED_WORK(&ctx->rsrc_put_work, io_rsrc_put_work);
        init_llist_head(&ctx->rsrc_put_llist);
+       INIT_LIST_HEAD(&ctx->submit_state.comp.free_list);
        return ctx;
 err:
        kfree(ctx->cancel_hash);
 
        BUILD_BUG_ON(IO_REQ_ALLOC_BATCH > ARRAY_SIZE(state->reqs));
 
+       if (!list_empty(&state->comp.free_list)) {
+               struct io_kiocb *req;
+
+               req = list_first_entry(&state->comp.free_list, struct io_kiocb,
+                                       compl.list);
+               list_del(&req->compl.list);
+               return req;
+       }
+
        if (!state->free_reqs) {
                gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
                int ret;
 }
 
 struct req_batch {
-       void *reqs[IO_IOPOLL_BATCH];
-       int to_free;
-       int ctx_refs;
-
        struct task_struct      *task;
        int                     task_refs;
+       int                     ctx_refs;
 };
 
 static inline void io_init_req_batch(struct req_batch *rb)
 {
-       rb->to_free = 0;
        rb->task_refs = 0;
        rb->ctx_refs = 0;
        rb->task = NULL;
 }
 
-static void __io_req_free_batch_flush(struct io_ring_ctx *ctx,
-                                     struct req_batch *rb)
-{
-       kmem_cache_free_bulk(req_cachep, rb->to_free, rb->reqs);
-       rb->to_free = 0;
-}
-
 static void io_req_free_batch_finish(struct io_ring_ctx *ctx,
                                     struct req_batch *rb)
 {
-       if (rb->to_free)
-               __io_req_free_batch_flush(ctx, rb);
        if (rb->task) {
                io_put_task(rb->task, rb->task_refs);
                rb->task = NULL;
        if (state->free_reqs != ARRAY_SIZE(state->reqs)) {
                state->reqs[state->free_reqs++] = req;
        } else {
-               rb->reqs[rb->to_free++] = req;
-               if (unlikely(rb->to_free == ARRAY_SIZE(rb->reqs)))
-                       __io_req_free_batch_flush(req->ctx, rb);
+               struct io_comp_state *cs = &req->ctx->submit_state.comp;
+
+               list_add(&req->compl.list, &cs->free_list);
        }
 }
 
        idr_destroy(&ctx->io_buffer_idr);
 }
 
+static void io_req_cache_free(struct io_ring_ctx *ctx)
+{
+       struct io_comp_state *cs = &ctx->submit_state.comp;
+
+       while (!list_empty(&cs->free_list)) {
+               struct io_kiocb *req;
+
+               req = list_first_entry(&cs->free_list, struct io_kiocb, compl.list);
+               list_del(&req->compl.list);
+               kmem_cache_free(req_cachep, req);
+       }
+}
+
 static void io_ring_ctx_free(struct io_ring_ctx *ctx)
 {
        struct io_submit_state *submit_state = &ctx->submit_state;
        free_uid(ctx->user);
        put_cred(ctx->creds);
        kfree(ctx->cancel_hash);
+       io_req_cache_free(ctx);
        kfree(ctx);
 }