do_complete = true;
        }
        spin_unlock(&poll->head->lock);
+       hash_del(&req->hash_node);
        return do_complete;
 }
 
 static bool io_poll_remove_one(struct io_kiocb *req)
 {
-       struct async_poll *apoll = NULL;
        bool do_complete;
 
        if (req->opcode == IORING_OP_POLL_ADD) {
                do_complete = __io_poll_remove_one(req, &req->poll);
        } else {
-               apoll = req->apoll;
+               struct async_poll *apoll = req->apoll;
+
                /* non-poll requests have submit ref still */
-               do_complete = __io_poll_remove_one(req, &req->apoll->poll);
-               if (do_complete)
+               do_complete = __io_poll_remove_one(req, &apoll->poll);
+               if (do_complete) {
                        io_put_req(req);
-       }
-
-       hash_del(&req->hash_node);
-
-       if (do_complete && apoll) {
-               /*
-                * restore ->work because we need to call io_req_work_drop_env.
-                */
-               memcpy(&req->work, &apoll->work, sizeof(req->work));
-               kfree(apoll);
+                       /*
+                        * restore ->work because we will call
+                        * io_req_work_drop_env below when dropping the
+                        * final reference.
+                        */
+                       memcpy(&req->work, &apoll->work, sizeof(req->work));
+                       kfree(apoll);
+               }
        }
 
        if (do_complete) {