Re: [PATCH] io_uring/cmd: fix iovec leak when the async cmd is not recycled

[Jens Axboe]

On Sun, 02 Aug 2026 14:35:18 +0700, Woraphat Khiaodaeng wrote:
> An io_async_cmd carries an iovec array in ->vec.iovec, allocated when the
> vec has to grow and kept across recycling through ctx->cmd_cache.  On two
> paths nothing frees it and io_clean_op()'s kfree(req->async_data) drops
> the io_async_cmd without it.
> 
> io_req_uring_cleanup() clears the async data flags only when
> io_alloc_cache_put() succeeds, and the cache holds IO_ALLOC_CACHE_MAX ==
> 128 entries, so once it is full the put fails and the vec is left behind.
> An NVMe passthrough workload gets there without doing anything unusual:
> nvme_uring_cmd_io() returns -EIOCBQUEUED, so the io_async_cmd stays
> attached for the lifetime of the command and the live object count tracks
> the queue depth.  Above 128 the puts start failing.
> 
> [...]

Applied, thanks!

[1/1] io_uring/cmd: fix iovec leak when the async cmd is not recycled
      commit: bb34ae5da3365699d53a756f4c96b6ea9f8ba0c1

Best regards,
-- 
Jens Axboe