Re: [PATCH bpf v2 08/15] net: Leave sk_stream_wait_memory() once the socket is dead

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue, Nov 03, 2026 at 09:23 PM Eric Dumazet <edumazet@kernel.org> wrote:
> "A signal or SO_SNDTIMEO of the target ends it" does not look enough to
> me. tcp_sendmsg_locked() takes the timeout from sock_sndtimeo() of the
> target, a socket the sender does not own and cannot configure. With the
> default MAX_SCHEDULE_TIMEOUT, a blocking sendmsg() on the sender's own
> socket never returns, and the sender's sock_hold() pins the dead target
> until then.

Right. It's not enough.

> Since this patch makes SOCK_DEAD a reason to leave, one wakeup before
> sock_orphan(), while the socket is still owned by the closer, should be
> enough. The sender can only get the socket lock back after
> sock_orphan(), so it sees SOCK_DEAD. Nothing walks the wait queue after
> sock_orphan(), so skipping remove_wait_queue() stays safe.
>
> Something like this (untested). sk_wq can be NULL here for MPTCP
> subflows, hence skwq_has_sleeper():
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ void __tcp_close(struct sock *sk, long timeout)
>  adjudge_to_death:
>   state = sk->sk_state;
>   sock_hold(sk);
> + /* A sockmap egress redirect can sleep in sk_stream_wait_memory()
> + * without a reference on our file. Let it see SOCK_DEAD.
> + */
> + rcu_read_lock();
> + wq = rcu_dereference(sk->sk_wq);
> + if (skwq_has_sleeper(wq))
> + wake_up_interruptible_all(&wq->wait);
> + rcu_read_unlock();
>   sock_orphan(sk);
>
> This can be a follow-up and does not need to block the series.

Makes sense to me. Thx
It depends on the SOCK_DEAD test, so it goes on top of this series.
Will send it as a follow-up.