vllm - 💡(How to fix) Fix [Bug]: [LMCache] `_cleanup_request_tracker` leaks lookup state and server read locks when request is aborted before allocation

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Root Cause

Root cause: update_state_after_alloc correctly calls both on the normal path. _cleanup_request_tracker calls neither.

Fix Action

Fix / Workaround

============================== CPU Info

Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 52 bits physical, 57 bits virtual Byte Order: Little Endian CPU(s): 8 On-line CPU(s) list: 0-7 Vendor ID: GenuineIntel Model name: Intel(R) Xeon(R) Gold 6462C CPU family: 6 Model: 143 Thread(s) per core: 2 Core(s) per socket: 4 Socket(s): 1 Stepping: 8 CPU(s) scaling MHz: 100% CPU max MHz: 3900.0000 CPU min MHz: 800.0000 BogoMIPS: 6600.00 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq monitor ssse3 fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single ibrs_enhanced fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx_vnni avx512_bf16 wbnoinvd ida arat hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req avx512vbmi umip pku ospke waitpkg avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid bus_lock_detect cldemote movdiri movdir64b enqcmd fsrm uintr md_clear serialize tsxldtrk amx_bf16 avx512_fp16 amx_tile amx_int8 arch_capabilities Hypervisor vendor: KVM Virtualization type: full L1d cache: 192 KiB (4 instances) L1i cache: 128 KiB (4 instances) L2 cache: 8 MiB (4 instances) L3 cache: 60 MiB (1 instance) NUMA node(s): 1 NUMA node0 CPU(s): 0-7 Vulnerability Itlb multihit: Not affected Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Not affected Vulnerability Retbleed: Not affected Vulnerability Spec rstack overflow: Not affected Vulnerability Spec store bypass: Vulnerable Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS, RSB filling, PBRSB-eIBRS SW sequence Vulnerability Srbds: Not affected Vulnerability Tsx async abort: Not affected

Code Example

Your output of `python collect_env.py` here

---

from unittest.mock import MagicMock
from vllm.distributed.kv_transfer.kv_connector.v1.lmcache_mp_connector import (
    LMCacheMPConnectorUpstream as LMCacheMPConnector,
    LMCacheMPRequestTracker,
)

connector = object.__new__(LMCacheMPConnector)
connector.vllm_block_size = 16
connector.scheduler_adapter = MagicMock()
connector.scheduler_adapter._pending_lookups = {"req-1"}
connector.scheduler_adapter._finished_lookup_results = {"req-1": 32}

req = MagicMock()
req.request_id, req.all_token_ids, req.block_hashes, req.cache_salt = "req-1", list(range(32)), [], ""
req.kv_transfer_params = None

tracker = LMCacheMPRequestTracker(req)
tracker.num_lmcache_hit_blocks = 2
connector.request_trackers = {"req-1": tracker}

# Simulate the full abort path: request_finished calls both
# _cleanup_request_tracker and end_session
connector.request_finished(req, block_ids=[])

# end_session is called but only removes session-level state,
# it does NOT send FREE_LOOKUP_LOCKS to the server
print("end_session called    :", connector.scheduler_adapter.end_session.called)

print("=" * 60)
# True = fixed, False = bug
print("free_lookup_locks called:", connector.scheduler_adapter.free_lookup_locks.called)
RAW_BUFFERClick to expand / collapse

Your current environment

<details> <summary>The output of <code>python collect_env.py</code></summary> Collecting environment information... ============================== System Info ============================== OS : Ubuntu 24.04.3 LTS (x86_64) GCC version : (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0 Clang version : Could not collect CMake version : version 3.31.6 Libc version : glibc-2.39

============================== PyTorch Info

PyTorch version : 2.10.0a0+b558c986e8.nv25.11 Is debug build : False CUDA used to build PyTorch : 13.0 ROCM used to build PyTorch : N/A XPU used to build PyTorch : N/A

============================== Python Environment

Python version : 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (64-bit runtime) Python platform : Linux-5.10.134-18.0.10.lifsea8.x86_64-x86_64-with-glibc2.39

============================== CUDA / GPU Info

Is CUDA available : True CUDA runtime version : 13.0.88 CUDA_MODULE_LOADING set to : LAZY GPU models and configuration : GPU 0: NVIDIA L20 Nvidia driver version : 550.163.01 cuDNN version : Probably one of the following: /usr/lib/x86_64-linux-gnu/libcudnn.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_adv.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_cnn.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_engines_precompiled.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_engines_runtime_compiled.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_graph.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_heuristic.so.9.15.0 /usr/lib/x86_64-linux-gnu/libcudnn_ops.so.9.15.0 HIP runtime version : N/A MIOpen runtime version : N/A Is XNNPACK available : True

============================== CPU Info

Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 52 bits physical, 57 bits virtual Byte Order: Little Endian CPU(s): 8 On-line CPU(s) list: 0-7 Vendor ID: GenuineIntel Model name: Intel(R) Xeon(R) Gold 6462C CPU family: 6 Model: 143 Thread(s) per core: 2 Core(s) per socket: 4 Socket(s): 1 Stepping: 8 CPU(s) scaling MHz: 100% CPU max MHz: 3900.0000 CPU min MHz: 800.0000 BogoMIPS: 6600.00 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq monitor ssse3 fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single ibrs_enhanced fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx_vnni avx512_bf16 wbnoinvd ida arat hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req avx512vbmi umip pku ospke waitpkg avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid bus_lock_detect cldemote movdiri movdir64b enqcmd fsrm uintr md_clear serialize tsxldtrk amx_bf16 avx512_fp16 amx_tile amx_int8 arch_capabilities Hypervisor vendor: KVM Virtualization type: full L1d cache: 192 KiB (4 instances) L1i cache: 128 KiB (4 instances) L2 cache: 8 MiB (4 instances) L3 cache: 60 MiB (1 instance) NUMA node(s): 1 NUMA node0 CPU(s): 0-7 Vulnerability Itlb multihit: Not affected Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Not affected Vulnerability Retbleed: Not affected Vulnerability Spec rstack overflow: Not affected Vulnerability Spec store bypass: Vulnerable Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS, RSB filling, PBRSB-eIBRS SW sequence Vulnerability Srbds: Not affected Vulnerability Tsx async abort: Not affected

============================== Versions of relevant libraries

[pip3] mypy_extensions==1.1.0 [pip3] numpy==1.26.4 [pip3] nvidia-cudnn-frontend==1.15.0 [pip3] nvidia-dali-cuda130==1.52.0 [pip3] nvidia-ml-py==13.580.82 [pip3] nvidia-modelopt==0.37.0 [pip3] nvidia-nvcomp-cu13==5.0.0.6 [pip3] nvidia-nvimgcodec-cu13==0.6.1.37 [pip3] nvidia-nvjpeg==13.0.1.86 [pip3] nvidia-nvjpeg2k-cu13==0.9.0.43 [pip3] nvidia-nvtiff-cu13==0.6.0.78 [pip3] nvidia-resiliency-ext==0.4.1+cuda13 [pip3] onnx==1.18.0 [pip3] onnx-ir==0.1.12 [pip3] onnxscript==0.5.6 [pip3] optree==0.17.0 [pip3] pytorch-triton==3.5.0+gitde3506d2 [pip3] pyzmq==27.1.0 [pip3] torch==2.10.0a0+b558c986e8.nv25.11 [pip3] torch_tensorrt==2.10.0a0 [pip3] torchao==0.14.0+git [pip3] torchdata==0.11.0 [pip3] torchprofile==0.0.4 [pip3] torchtitan==0.1.0 [pip3] torchvision==0.25.0a0+7a13ad0f [pip3] triton_kernels==1.0.0+nv25.11 [conda] Could not collect

============================== vLLM Info

ROCM Version : Could not collect vLLM Version : 0.1.dev16489+g9efdddca2.d20260525 (git sha: 9efdddca2, date: 20260525) vLLM Build Flags: CUDA Archs: 7.5 8.0 8.6 9.0 10.0 12.0+PTX; ROCm: Disabled; XPU: Disabled GPU Topology: GPU0 CPU Affinity NUMA Affinity GPU NUMA ID GPU0 X 0-7 0 N/A

Legend:

X = Self SYS = Connection traversing PCIe as well as the SMP interconnect between NUMA nodes (e.g., QPI/UPI) NODE = Connection traversing PCIe as well as the interconnect between PCIe Host Bridges within a NUMA node PHB = Connection traversing PCIe as well as a PCIe Host Bridge (typically the CPU) PXB = Connection traversing multiple PCIe bridges (without traversing the PCIe Host Bridge) PIX = Connection traversing at most a single PCIe bridge NV# = Connection traversing a bonded set of # NVLinks

============================== Environment Variables

PYTORCH_BUILD_NUMBER=0 PYTORCH_HOME=/opt/pytorch/pytorch CUDA_ARCH_LIST=7.5 8.0 8.6 9.0 10.0 12.0 LD_LIBRARY_PATH=/usr/local/cuda/compat/lib.real:/usr/local/lib/python3.12/dist-packages/torch/lib:/usr/local/lib/python3.12/dist-packages/torch_tensorrt/lib:/usr/local/cuda/compat/lib:/usr/local/nvidia/lib:/usr/local/nvidia/lib64 TORCH_NCCL_USE_COMM_NONBLOCKING=0 NVIDIA_BUILD_ID=231036167 CUDA_VERSION=13.0.2.006 TORCH_ALLOW_TF32_CUBLAS_OVERRIDE=1 CUBLAS_VERSION=13.1.0.3 TORCH_CUDA_ARCH_LIST=7.5 8.0 8.6 9.0 10.0 12.0+PTX CUBLASMP_VERSION=0.6.0.84 CUDA_MODULE_LOADING=LAZY NVIDIA_REQUIRE_CUDA=cuda>=9.0 PYTORCH_BUILD_VERSION=2.10.0a0+b558c98 NVIDIA_DRIVER_CAPABILITIES=compute,utility,video CUDA_COMPONENT_LIST=cccl crt nvrtc driver-dev culibos-dev cudart cudart-dev nvcc NVIDIA_PYTORCH_VERSION=25.11 PYTORCH_VERSION=2.10.0a0+b558c98 CUDA_DRIVER_VERSION=580.95.05 NVIDIA_PRODUCT_NAME=PyTorch CUDNN_VERSION=9.15.0.58 CUDNN_FRONTEND_VERSION=1.15.0 NVIDIA_REQUIRE_JETPACK_HOST_MOUNTS= TORCHINDUCTOR_LOOP_ORDERING_AFTER_FUSION=0 CUDA_HOME=/usr/local/cuda CUDA_HOME=/usr/local/cuda NVIDIA_VISIBLE_DEVICES=0 NCCL_VERSION=2.28.8 PYTORCH_NVML_BASED_CUDA_CHECK=1 TORCHINDUCTOR_COMPILE_THREADS=1

Your output of `python collect_env.py` here
</details>

🐛 Describe the bug

Problem

When a request is aborted after get_num_new_matched_tokens submits a lookup but before update_state_after_alloc is called, _cleanup_request_tracker is the only cleanup path. It only pops the tracker — it never calls cleanup_lookup_result or free_lookup_locks. _pending_lookups retains the request_id and read locks on matched KV chunks are never released until TTL expiry, blocking eviction.

Root cause: update_state_after_alloc correctly calls both on the normal path. _cleanup_request_tracker calls neither.

Trigger condition

Request submitted a lookup (maybe_submit_lookup_request → enters _pending_lookups), then aborted before update_state_after_alloc — client disconnect, request timeout.

Reproduction

from unittest.mock import MagicMock
from vllm.distributed.kv_transfer.kv_connector.v1.lmcache_mp_connector import (
    LMCacheMPConnectorUpstream as LMCacheMPConnector,
    LMCacheMPRequestTracker,
)

connector = object.__new__(LMCacheMPConnector)
connector.vllm_block_size = 16
connector.scheduler_adapter = MagicMock()
connector.scheduler_adapter._pending_lookups = {"req-1"}
connector.scheduler_adapter._finished_lookup_results = {"req-1": 32}

req = MagicMock()
req.request_id, req.all_token_ids, req.block_hashes, req.cache_salt = "req-1", list(range(32)), [], ""
req.kv_transfer_params = None

tracker = LMCacheMPRequestTracker(req)
tracker.num_lmcache_hit_blocks = 2
connector.request_trackers = {"req-1": tracker}

# Simulate the full abort path: request_finished calls both
# _cleanup_request_tracker and end_session
connector.request_finished(req, block_ids=[])

# end_session is called but only removes session-level state,
# it does NOT send FREE_LOOKUP_LOCKS to the server
print("end_session called    :", connector.scheduler_adapter.end_session.called)

print("=" * 60)
# True = fixed, False = bug
print("free_lookup_locks called:", connector.scheduler_adapter.free_lookup_locks.called)

Fix

In _cleanup_request_tracker, when the tracker is still in PREFETCHING state, call cleanup_lookup_result and free_lookup_locks — mirroring what update_state_after_alloc already does on the normal path. The PREFETCHING guard is necessary: update_state_after_alloc already handles cleanup for WAITING_FOR_LOAD and READY states, and calling free_lookup_locks again there would release locks on chunks still being retrieved.

Before submitting a new issue...

  • Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

vllm - 💡(How to fix) Fix [Bug]: [LMCache] `_cleanup_request_tracker` leaks lookup state and server read locks when request is aborted before allocation