diff --git a/fs/io_uring.c b/fs/io_uring.c
index 4345aa3d377808d12f189c8a4cd49b7e43857fdb..5a45da2b87e958ea2dafea2e6a28d9e6edabe3b9 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7333,7 +7333,17 @@ static void io_ring_exit_work(struct work_struct *work)
 	if (ctx->rings)
 		io_cqring_overflow_flush(ctx, true);
 
-	wait_for_completion(&ctx->ref_comp);
+	/*
+	 * If we're doing polled IO and end up having requests being
+	 * submitted async (out-of-line), then completions can come in while
+	 * we're waiting for refs to drop. We need to reap these manually,
+	 * as nobody else will be looking for them.
+	 */
+	while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20)) {
+		io_iopoll_reap_events(ctx);
+		if (ctx->rings)
+			io_cqring_overflow_flush(ctx, true);
+	}
 	io_ring_ctx_free(ctx);
 }