Hi Jean,

> > I had the attached patch in mind. Please check if this also works for
> > you, because it should produce less code execution. I think we can also
> > remove the list_empty() check from bt_sock_listen_poll(), because the
> > list_for_each_safe() gives us the same result.
> 
> 	This should produce the same result. I'll try.

attached is a slight modified version of my patch.

> > I already checked the IPV4 code and they also work with an accept queue,
> > but at the moment I don't understand when they put the new socket on it
> > and how they keep track of it.
> 
> 	Actually, I will double check, because I belive that it may be
> normal behavior. More later.

The TCP code uses its own open_request structure for the accept queue,
but I think the problem of non-blocking listen() will be the same as in
Bluetooth.

However the fix for the sendmsg() race is correct and must be applied.

Regards

Marcel