Re: [BUG] net: tcp: SO_LINGER with l_linger=0 leaks memory when closing sockets with pending send data

On Fri, Aug 7, 2026 at 8:42 PM Ahmed, Aaron <[email protected]> wrote:
>
> Hi,
>
> Following up since it's been a while. I've tested on 6.18.39 (latest
> 6.18.y LTS) and the issue is still present.
>
> Baseline (55,542 connections, one client SIGSTOP'd):
>   TCP: inuse 55542 orphan 0 tw 1 alloc 55543 mem 8236
>   Mem: 94504 total, 693 used
>
> After ~1 minute:
>   TCP: inuse 47394 orphan 1 tw 2 alloc 47395 mem 1404546
>   Mem: 94504 total, 9023 used
>
> Updated repo with new results and .config:
>   https://github.com/aahmed71/tcp-linger-memleak-reproducer

I ran the repro, but I didn't see the behaviour described in the
README.md; unbound growth of "mem" on the server side after
client SIGSTOP.

Before SIGSTOP, each socket on the server side has quite small
send buffer, and it grows after SIGSTOP on the client side.

A few minutes later, # of sockets decreased, and "mem" was
263705 (~= 1GiB) and the total send buffer was 700 MiB.
Given 1.5k MTU and skb overhead (552 bytes), it roughly matches
the "mem" value.

Also, after killing the server process, the value went down to
almost zero, and I didn't see the leak.



server side (before SIGSTOP on the client side):

---8<---
# cat /proc/sys/net/ipv4/tcp_mem ; echo; cat /proc/net/sockstat; echo; free -h;

191220  254961  382440

sockets: used 45715
TCP: inuse 45577 orphan 0 tw 0 alloc 45579 mem 231374
...
               total        used        free  shared  buff/cache   available
Mem:            15Gi   2.3Gi        13Gi   332Ki       159Mi        13Gi
Swap:             0B          0B          0B
---8<---

---8<---
ESTAB    0      1912     192.168.0.1:6666  192.168.0.2:24543
ESTAB    0      3100     192.168.0.1:6666  192.168.0.2:10770
ESTAB    0      9640     192.168.0.1:6666  192.168.0.2:47995
ESTAB    0      2160     192.168.0.1:6666  192.168.0.2:27574
---8<---


server side (after SIGSTOP on the client side):

---8<---
191220  254961  382440

sockets: used 753
TCP: inuse 606 orphan 0 tw 0 alloc 608 mem 263705
...
               total        used        free  shared  buff/cache   available
Mem:            15Gi   4.4Gi        11Gi   332Ki       156Mi        11Gi
Swap:             0B          0B          0B
---8<---

---8<---
ESTAB  0      217341   192.168.0.1:6666  192.168.0.2:25684
ESTAB  0      120004   192.168.0.1:6666  192.168.0.2:23340
ESTAB  0      128672   192.168.0.1:6666  192.168.0.2:48728
ESTAB  0      141194   192.168.0.1:6666  192.168.0.2:41513
ESTAB  0      121421   192.168.0.1:6666  192.168.0.2:33507
---8<---

---8<---
# ss -tn | awk 'NR>1 { count++; sum += $3 } END { printf "Sockets: %d
| Send-Q Total: %.2f MiB (%d bytes)\n", count, sum/1024/1024, sum }'
Sockets: 601 | Send-Q Total: 722.04 MiB (757118970 bytes)
---8<---

---8<---
$ pahole -C sk_buff
...
 /* size: 232, cachelines: 4, members: 28 */
...
$ pahole -C skb_shared_info
...
 /* size: 320, cachelines: 5, members: 13 */
---8<---