14 files changed, 310 insertions, 65 deletions

diff --git a/.gitignore b/.gitignore
index 8b4bec1..b5c40f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,10 @@
 *.o
+*.dSYM
+opentracker
+opentracker.debug
+opentracker.integration
+opentracker.tsan
+proxy
+proxy.debug
 tests/runner
+tests/runner.sanitize
diff --git a/Makefile b/Makefile
index 1a8912b..f79d6a6 100644
--- a/Makefile
+++ b/Makefile
@@ -73,13 +73,6 @@ HEADERS=trackerlogic.h ot_urlencoded.h ot_batch.h ot_buf.h ot_event.h ot_fdstate
 SOURCES=opentracker.c trackerlogic.c ot_urlencoded.c ot_batch.c ot_buf.c ot_event.c ot_fdstate.c ot_fmt.c ot_hex.c ot_ip.c ot_config.c ot_scan.c ot_socket.c ot_mutex.c ot_random.c ot_stats.c ot_vector.c ot_clean.c ot_udp.c ot_iovec.c ot_fullscrape.c ot_accesslist.c ot_http.c ot_livesync.c ot_rijndael.c
 SOURCES_proxy=proxy.c ot_batch.c ot_fdstate.c ot_vector.c ot_mutex.c ot_random.c ot_scan.c ot_ip.c ot_socket.c
 
-OBJECTS = $(SOURCES:%.c=%.o)
-OBJECTS_debug = $(SOURCES:%.c=%.debug.o)
-OBJECTS_proxy = $(SOURCES_proxy:%.c=%.proxy.o)
-OBJECTS_proxy_debug = $(SOURCES_proxy:%.c=%.proxy.debug.o)
-
-.SUFFIXES: .proxy.debug.o .proxy.o .debug.o .o .c
-
 all: $(BINARY) $(BINARY).debug
 
 CFLAGS_production = $(CFLAGS) $(OPTS_production) $(FEATURES)
@@ -88,32 +81,15 @@ CFLAGS_debug = $(CFLAGS) $(OPTS_debug) $(FEATURES)
 CFLAGS_proxy = $(CFLAGS_production) $(CFLAGS_libowfat) -DWANT_SYNC_LIVE
 CFLAGS_proxy_debug = $(CFLAGS_debug) $(CFLAGS_libowfat) -DWANT_SYNC_LIVE
 
-$(BINARY): $(OBJECTS)
-        $(CC) -o $@ $(OBJECTS) $(LDFLAGS)
+$(BINARY): $(SOURCES) $(HEADERS)
+        $(CC) -o $@ $(CFLAGS_production) $(SOURCES) $(LDFLAGS)
         $(STRIP) $@
-$(BINARY).debug: $(OBJECTS_debug)
-        $(CC) -o $@ $(OBJECTS_debug) $(LDFLAGS)
-proxy: $(OBJECTS_proxy)
-        $(CC) -o $@ $(OBJECTS_proxy) $(CFLAGS_production) $(LDFLAGS) $(LDFLAGS_libowfat)
-proxy.debug: $(OBJECTS_proxy_debug)
-        $(CC) -o $@ $(OBJECTS_proxy_debug) $(LDFLAGS) $(LDFLAGS_libowfat)
-
-$(OBJECTS): $(HEADERS)
-$(OBJECTS_debug): $(HEADERS)
-$(OBJECTS_proxy): $(HEADERS)
-$(OBJECTS_proxy_debug): $(HEADERS)
-
-.c.proxy.debug.o :
-        $(CC) -c -o $@ $(CFLAGS_proxy_debug) $(<:.proxy.debug.o=.c)
-
-.c.proxy.o :
-        $(CC) -c -o $@ $(CFLAGS_proxy) $(<:.proxy.o=.c)
-
-.c.debug.o :
-        $(CC) -c -o $@ $(CFLAGS_debug) $(<:.debug.o=.c)
-
-.c.o :
-        $(CC) -c -o $@ $(CFLAGS_production) $<
+$(BINARY).debug: $(SOURCES) $(HEADERS)
+        $(CC) -o $@ $(CFLAGS_debug) $(SOURCES) $(LDFLAGS)
+proxy: $(SOURCES_proxy) $(HEADERS)
+        $(CC) -o $@ $(CFLAGS_proxy) $(SOURCES_proxy) $(LDFLAGS) $(LDFLAGS_libowfat)
+proxy.debug: $(SOURCES_proxy) $(HEADERS)
+        $(CC) -o $@ $(CFLAGS_proxy_debug) $(SOURCES_proxy) $(LDFLAGS) $(LDFLAGS_libowfat)
 
 # Unit tests. The modules under test are compiled straight into the test
 # binary, so a test may reach a static function by including the source if it
diff --git a/man4/opentracker.conf.4 b/man4/opentracker.conf.4
index 2bc1389..b28879f 100644
--- a/man4/opentracker.conf.4
+++ b/man4/opentracker.conf.4
@@ -1,5 +1,5 @@
-.Dd 2024-04-18
-.Dt opentracker.conf 5
+.Dd 2026-10-28
+.Dt opentracker.conf 4
 .Os Unix
 .Sh NAME
 .Nm opentracker.conf
@@ -25,8 +25,29 @@ Specifies the address opentracker will listen on for TCP connections. Can be add
 .It listen.udp Ar address
 Specifies the address opentracker will listen on for UDP connections. Can be added more than once.
 .Pp
+A listen statement may carry options after the address, as in
+.Dl listen.udp 10.0.0.5:6969 workers=4 shared
+where
+.Cm workers Ns = Ns Ar count
+sets the worker count for that socket alone and is ignored for TCP, and
+.Cm shared
+permits another process to bind the same address.
+.Pp
 .It listen.udp.workers Ar threads
-Specifies how many threads will be spawned to handle UDP connections. Defaults to 4.
+Specifies how many threads will be spawned to handle UDP requests, for every
+listen statement that does not carry a
+.Cm workers
+option of its own. Defaults to 1. A count of 0 serves UDP from the event loop,
+in the thread that also serves TCP. See
+.Sx TUNING
+before raising it.
+.Pp
+.It listen.shared Ar boolean
+Permits another process to bind the same address, for every listen statement
+that does not carry a
+.Cm shared
+option of its own. Defaults to 0, and is useful only where a second tracker is
+deliberately run on the same address.
 .Pp
 .It access.whitelist Ar path/to/whitelist
 Specifies the path to the whitelist file containing all torrent hashes that opentracker will serve. Use this option if opentracker runs in a non-open mode.
@@ -67,6 +88,18 @@ Specifies the user opentracker will setuid to after binding to potentially privi
 .It tracker.redirect_url Ar URL
 Specifies the URL opentracker will redirect to in response to a "GET / HTTP" request.
 .El
+.Sh TUNING
+A worker is a thread that blocks in a read until a datagram arrives. Where the
+kernel spreads arriving datagrams over a group of sockets bound to one address,
+opentracker binds one socket per worker and throughput rises with the worker
+count. Linux does so, and FreeBSD since 12.0. Where a kernel does not, every
+worker reads the same socket and they contend for its receive queue, so more
+than one worker costs throughput. opentracker asks at start up and binds a
+group only where the answer is yes.
+.Pp
+.Pa tests/udp_scaling.py
+in the source distribution sweeps the setting against a running tracker.
+Measure on the machine that will carry the traffic.
 .Sh EXAMPLES
 To specify the address opentracker will listen on for both TCP and UDP connections:
 .Dl listen.tcp_udp 0.0.0.0:6969
diff --git a/opentracker.c b/opentracker.c
index f579b92..e0f16d7 100644
--- a/opentracker.c
+++ b/opentracker.c
@@ -49,7 +49,9 @@ static void         panic(const char *routine) {
   exit(111);
 }
 
-/* Say we are stopping, wake the loop, and let main do the work on its own stack. */
+/* Say we are stopping, wake the loop, and let main do the work on its own
+   stack. Everything other than SIGINT falls through and does nothing, which
+   is what OT_SIGNAL_WAKE wants: returning from the read is all it is for. */
 static void signal_handler(int s) {
   if (s == SIGINT) {
     const char byte  = 0;
@@ -85,7 +87,8 @@ static void install_signal_handlers(void) {
   sa.sa_handler = signal_handler;
   sigemptyset(&sa.sa_mask);
   sa.sa_flags = 0;
-  if ((sigaction(SIGINT, &sa, NULL) == -1) || (sigaction(SIGALRM, &sa, NULL) == -1))
+  if ((sigaction(SIGINT, &sa, NULL) == -1) || (sigaction(SIGALRM, &sa, NULL) == -1) ||
+      (sigaction(OT_SIGNAL_WAKE, &sa, NULL) == -1))
     panic("install_signal_handlers");
 
   sigaddset(&signal_mask, SIGINT);
@@ -397,7 +400,6 @@ static void listen_start_udp_workers(void) {
     if (entry->proto != FLAG_UDP || entry->workers <= 0)
       continue;
 
-    socket_set_blocking((int)entry->sock, 1);
     event_del((int)entry->sock);
     udp_worker_install(entry->sock);
 
@@ -409,8 +411,7 @@ static void listen_start_udp_workers(void) {
         if (sock == -1) {
           fprintf(stderr, "Warning: could not bind another socket for udp worker %d: %s. Sharing the first instead.\n", worker, strerror(errno));
           sock = entry->sock;
-        } else
-          socket_set_blocking((int)sock, 1);
+        }
       }
       udp_worker_install(sock);
     }
@@ -548,9 +549,10 @@ int main(int argc, char **argv) {
   listen_start_udp_workers();
 
   server_mainloop(0);
+  udp_workers_deinit();
 
-  /* The loop has left, so no thread is serving any more and the teardown
-     can run where a debugger and the sanitizers can follow it */
+  /* No thread is serving any more, so the teardown can run where a debugger
+     and the sanitizers can follow it */
   trackerlogic_deinit();
 #ifdef WANT_SYSLOGS
   closelog();
diff --git a/opentracker.conf.sample b/opentracker.conf.sample
index 4adb736..1d535e8 100644
--- a/opentracker.conf.sample
+++ b/opentracker.conf.sample
@@ -23,7 +23,7 @@
 #
 #        workers=<count>  handle this udp socket in blocking reads in that
 #                         many dedicated worker threads instead of in the
-#                         event loop. Ignored for tcp.
+#                         event loop. Defaults to 1. Ignored for tcp.
 #        shared           allow another process to bind the same address and
 #                         let the kernel share the traffic. Only useful if you
 #                         deliberately run a second tracker there.
@@ -37,6 +37,18 @@
 # listen.udp.workers 4
 # listen.shared 1
 #
+#      Raising the worker count pays off where the kernel spreads arriving
+#      datagrams over a group of sockets bound to one address. Linux does so
+#      and FreeBSD has since 12.0, Darwin does not. opentracker asks at start
+#      up and binds one socket per worker only where the answer is yes. Where
+#      it is no, all workers read the one socket and contend for its receive
+#      queue, which costs more than it returns. See the TUNING section of
+#      opentracker.conf(5); tests/udp_scaling.py sweeps the setting on the
+#      machine that will carry the traffic.
+#
+#      A count of 0 answers udp from the event loop, in the thread that also
+#      serves tcp, which is what opentracker did before.
+#
 #      Note, that using 0.0.0.0 for udp sockets may yield surprising results.
 #      An answer packet sent on that socket will not necessarily have the
 #      source address that the requesting client may expect, but any address
diff --git a/ot_config.c b/ot_config.c
index ee6bc12..a0dbef1 100644
--- a/ot_config.c
+++ b/ot_config.c
@@ -32,7 +32,7 @@ const char   *g_statefile;
 static ot_listen *g_listen;
 static size_t     g_listen_count;
 static int        g_listen_shared;
-static int        g_listen_workers;
+static int        g_listen_workers = 1;
 
 static void panic(const char *routine) __attribute__((noreturn));
 static void panic(const char *routine) {
diff --git a/ot_livesync.c b/ot_livesync.c
index 45271bc..4a0ede1 100644
--- a/ot_livesync.c
+++ b/ot_livesync.c
@@ -8,6 +8,7 @@
 #include <pthread.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <sys/types.h>
 #include <unistd.h>
 
@@ -53,6 +54,8 @@ static sync_buffer g_v6_buf;
 static sync_buffer g_v4_buf;
 
 static pthread_t   thread_id;
+static int         thread_started;
+static _Atomic int thread_left;
 void livesync_init(void) {
   uint32_t packet_type6 = htonl(OT_SYNC_PEER6);
   uint32_t packet_type4 = htonl(OT_SYNC_PEER4);
@@ -73,16 +76,24 @@ void livesync_init(void) {
   g_v6_buf.next_packet_time = time_future_seconds(LIVESYNC_MAXDELAY);
   g_v4_buf.next_packet_time = time_future_seconds(LIVESYNC_MAXDELAY);
 
-  pthread_create(&thread_id, NULL, livesync_worker, NULL);
+  thread_started = !pthread_create(&thread_id, NULL, livesync_worker, NULL);
 }
 
 void livesync_deinit(void) {
+  if (thread_started) {
+    /* Repeats so it interrupts a read already under way */
+    while (!atomic_load(&thread_left)) {
+      pthread_kill(thread_id, OT_SIGNAL_WAKE);
+      usleep(1000);
+    }
+    pthread_join(thread_id, NULL);
+    thread_started = 0;
+  }
+
   if (g_socket_in != -1)
     close(g_socket_in);
   if (g_socket_out != -1)
     close(g_socket_out);
-
-  pthread_cancel(thread_id);
 }
 
 void livesync_bind_mcast(ot_ip6 ip, uint16_t port) {
@@ -195,7 +206,7 @@ static void *livesync_worker(void *args) {
   ws.inbuf = ws.request = malloc(LIVESYNC_INCOMING_BUFFSIZE);
   ws.outbuf = ws.reply = 0;
 
-  while (1) {
+  while (g_opentracker_running) {
     uint32_t packet_type;
 
     ws.request_size = socket_recv(g_socket_in, ws.inbuf, LIVESYNC_INCOMING_BUFFSIZE, in_ip, &in_port);
@@ -224,7 +235,8 @@ static void *livesync_worker(void *args) {
     }
   }
 
-  /* Never returns. */
+  free(ws.inbuf);
+  atomic_store(&thread_left, 1);
   return NULL;
 }
 
diff --git a/ot_udp.c b/ot_udp.c
index 87741da..1ec5148 100644
--- a/ot_udp.c
+++ b/ot_udp.c
@@ -9,6 +9,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 
 /* Opentracker */
 #include "ot_ip.h"
@@ -19,6 +20,17 @@
 #include "ot_udp.h"
 #include "trackerlogic.h"
 
+/* One of these per worker, each allocated on its own so that growing the
+   array below never moves the one a running worker holds. */
+struct udp_worker {
+  pthread_t   thread;
+  int64_t     sock;
+  _Atomic int left;
+};
+
+static struct udp_worker **g_workers;
+static size_t              g_worker_count;
+
 static uint32_t g_rijndael_round_key[44] = {0};
 static volatile uint32_t g_key_of_the_hour[2] = {0};
 static volatile ot_time  g_hour_of_the_key;
@@ -206,7 +218,7 @@ int handle_udp6(int64_t serversocket, struct ot_workstruct *ws) {
 }
 
 static void *udp_worker(void *args) {
-  int64_t sock = (int64_t)args;
+  struct udp_worker   *me = args;
   struct ot_workstruct ws;
   memset(&ws, 0, sizeof(ws));
 
@@ -218,7 +230,7 @@ static void *udp_worker(void *args) {
 #endif
 
   while (g_opentracker_running)
-    handle_udp6(sock, &ws);
+    handle_udp6(me->sock, &ws);
 
   stats_counters_retire(&ws);
 
@@ -227,6 +239,8 @@ static void *udp_worker(void *args) {
 #ifdef _DEBUG_HTTPERROR
   free(ws.debugbuf);
 #endif
+
+  atomic_store(&me->left, 1);
   return NULL;
 }
 
@@ -236,11 +250,47 @@ void udp_init(void) {
 }
 
 void udp_worker_install(int64_t sock) {
-  pthread_t thread_id;
+  struct udp_worker **grown = realloc(g_workers, (g_worker_count + 1) * sizeof(*g_workers));
+  struct udp_worker  *worker;
+
+  if (!grown || !(worker = calloc(1, sizeof(*worker)))) {
+    fprintf(stderr, "Warning: out of memory installing a udp worker, this socket stays with the workers already running.\n");
+    g_workers = grown ? grown : g_workers;
+    return;
+  }
+  g_workers    = grown;
+  worker->sock = sock;
 
 #ifdef _DEBUG
   fprintf(stderr, "Installing a worker on udp socket %ld\n", (unsigned long)sock);
 #endif
-  pthread_create(&thread_id, NULL, udp_worker, (void *)sock);
+  socket_set_blocking((int)sock, 1);
+
+  if (pthread_create(&worker->thread, NULL, udp_worker, worker))
+    free(worker);
+  else
+    g_workers[g_worker_count++] = worker;
+}
+
+void udp_workers_deinit(void) {
+  size_t i;
+
+  for (i = 0; i < g_worker_count; ++i) {
+    struct udp_worker *worker = g_workers[i];
+
+    /* Repeated because a signal only interrupts a read already under way: a
+       worker that was between two reads when the first one arrived is inside
+       the next one by now. */
+    while (!atomic_load(&worker->left)) {
+      pthread_kill(worker->thread, OT_SIGNAL_WAKE);
+      usleep(1000);
+    }
+    pthread_join(worker->thread, NULL);
+    free(worker);
+  }
+
+  free(g_workers);
+  g_workers      = NULL;
+  g_worker_count = 0;
 }
 
diff --git a/ot_udp.h b/ot_udp.h
index 7d4432f..b731aca 100644
--- a/ot_udp.h
+++ b/ot_udp.h
@@ -13,6 +13,9 @@
 void udp_init(void);
 /* One thread reading one socket. Called once per worker. */
 void udp_worker_install(int64_t sock);
+
+/* Stop every worker installed above and wait for it to be gone */
+void udp_workers_deinit(void);
 int  handle_udp6(int64_t serversocket, struct ot_workstruct *ws);
 
 #endif
diff --git a/tests/integration/test_shutdown.py b/tests/integration/test_shutdown.py
new file mode 100644
index 0000000..063d779
--- /dev/null
+++ b/tests/integration/test_shutdown.py
@@ -0,0 +1,58 @@
+"""That every thread the tracker starts also ends when it is asked to stop.
+
+The rest of the suite stops a tracker too, so a thread left behind already
+shows up in teardown as the complaint that the tracker had to be killed.
+These ask for the arrangements that park a thread in a blocking read in the
+first place, and they time the exit, because a reader woken only by its own
+receive timeout passes a correctness check while taking a second over it.
+"""
+
+import time
+import unittest
+
+from harness import Tracker, TrackerTestCase
+
+# Generous enough for a platform where shutting the socket down does not wake
+# the reader and the receive timeout has to expire, tight enough that a reader
+# which is never woken at all fails instead of hanging the suite
+PATIENCE = 3.0
+
+
+def time_the_exit(extra_config):
+    tracker = Tracker(extra_config)
+    try:
+        # Serve one request of each kind first, so the threads that are about
+        # to be joined have actually run
+        tracker.announce(b"shutdown-probe\0\0\0\0\0\0")
+        sock, connection_id = tracker.udp_connect()
+        tracker.udp_announce(sock, connection_id, b"shutdown-probe\0\0\0\0\0\0")
+        sock.close()
+        started = time.time()
+        complaints = tracker.stop()
+        return time.time() - started, complaints
+    finally:
+        tracker._cleanup()
+
+
+class UdpWorkers(TrackerTestCase):
+    config = "listen.udp.workers 8\n"
+
+    def test_announce_reaches_one_of_eight_workers(self):
+        """Keeps the workers from being merely started and never used."""
+        sock, connection_id = self.tracker.udp_connect()
+        answer = self.tracker.udp_announce(sock, connection_id, self.hash_for("eight-workers"))
+        sock.close()
+        self.assertEqual(answer["seeders"], 1)
+
+
+class ShutdownEndsEveryThread(unittest.TestCase):
+    def test_eight_udp_workers_are_joined(self):
+        took, complaints = time_the_exit("listen.udp.workers 8\n")
+        self.assertEqual(complaints, [], "the tracker reported:\n" + "\n".join(complaints))
+        self.assertLess(took, PATIENCE, "stopping eight udp workers took %.1f s" % took)
+
+    def test_udp_in_the_event_loop_still_stops(self):
+        """Worker count zero leaves no thread to join, which must also work."""
+        took, complaints = time_the_exit("listen.udp.workers 0\n")
+        self.assertEqual(complaints, [], "the tracker reported:\n" + "\n".join(complaints))
+        self.assertLess(took, PATIENCE, "stopping without workers took %.1f s" % took)
diff --git a/tests/t_fdstate.c b/tests/t_fdstate.c
index bf8724a..421f076 100644
--- a/tests/t_fdstate.c
+++ b/tests/t_fdstate.c
@@ -101,6 +101,8 @@ static void case_out_of_range(void) {
 #define RECYCLE_AFTER  32
 #define STRESS_CLAIMS  200000
 #define STRESS_GIVEUP  (STRESS_CLAIMS * 100)
+/* What the run has to reach for its result to mean anything */
+#define STRESS_CYCLES  (STRESS_CLAIMS / (RECYCLE_AFTER * 4))
 
 static _Atomic long     stress_claims, stress_recycles, stress_violations, stress_attempts;
 static _Atomic int      stress_lives[STRESS_SLOTS];
@@ -116,8 +118,14 @@ static _Atomic uint64_t stress_next_cookie;
 #define STRESS_CONN_COOKIE(w)    ((void *)(uintptr_t)((w) >> 32))
 #define STRESS_CONN_GEN(w)       ((uint32_t)(w))
 
+/* The workers reach their claim target on their own, but the recycles that
+   make the run worth anything are the keeper's, and on a loaded machine the
+   keeper is the thread that loses. So the run goes on until both targets are
+   met rather than until the faster of the two is. */
 static int stress_running(void) {
-  return atomic_load(&stress_claims) < STRESS_CLAIMS && atomic_load(&stress_attempts) < STRESS_GIVEUP;
+  if (atomic_load(&stress_attempts) >= STRESS_GIVEUP)
+    return 0;
+  return atomic_load(&stress_claims) < STRESS_CLAIMS || atomic_load(&stress_recycles) <= STRESS_CYCLES;
 }
 
 static void *stress_worker(void *arg) {
@@ -203,7 +211,7 @@ static void case_recycling_under_load(void) {
 
   test_case("and the run actually recycled descriptors, or it proved nothing");
   CHECK(atomic_load(&stress_claims) >= STRESS_CLAIMS);
-  CHECK(atomic_load(&stress_recycles) > STRESS_CLAIMS / (RECYCLE_AFTER * 4));
+  CHECK(atomic_load(&stress_recycles) > STRESS_CYCLES);
 
   for (i = 0; i < STRESS_SLOTS; ++i)
     fdstate_close((int)i);
diff --git a/tests/t_socket.c b/tests/t_socket.c
index 8eef7fd..ab4b785 100644
--- a/tests/t_socket.c
+++ b/tests/t_socket.c
@@ -8,13 +8,18 @@
 #include <fcntl.h>
 #include <netinet/in.h>
 #include <poll.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdatomic.h>
 #include <string.h>
 #include <sys/socket.h>
+#include <sys/time.h>
 #include <unistd.h>
 
 /* Opentracker */
 #include "ot_ip.h"
 #include "ot_socket.h"
+#include "trackerlogic.h"
 #include "test.h"
 
 /* These cases talk to the loopback interface rather than to a mock, because
@@ -144,6 +149,57 @@ static void case_udp_roundtrip(void) {
   close(s);
 }
 
+/* udp_workers_deinit and livesync_deinit end a read another thread is parked
+   in by signalling that thread. Which mechanisms wake a blocked reader
+   differs between kernels -- shutting the socket down does so on Linux and
+   FreeBSD but not on Darwin, closing it does so on Darwin but not on Linux --
+   so the one the tracker relies on is checked rather than assumed. The
+   watchdog is the test's own: where a reader is not woken this fails with a
+   figure to look at instead of hanging the suite. */
+static _Atomic int reader_returned;
+static int         reader_socket;
+
+static void        reader_wake(int s) { (void)s; }
+
+static void       *blocked_reader(void *args) {
+  char     buf[32], ip[16];
+  uint16_t port = 0;
+
+  (void)args;
+  socket_recv(reader_socket, buf, sizeof(buf), ip, &port);
+  atomic_store(&reader_returned, 1);
+  return NULL;
+}
+
+static void case_a_signal_ends_a_blocking_read(void) {
+  struct sigaction sa;
+  struct timeval   watchdog = {2, 0};
+  pthread_t        thread;
+  int              waited;
+
+  test_case("a signal ends a read another thread is parked in");
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_handler = reader_wake;
+  sa.sa_flags   = 0; /* SA_RESTART would resume the read instead of ending it */
+  CHECK_INT(sigaction(OT_SIGNAL_WAKE, &sa, NULL), 0);
+
+  atomic_store(&reader_returned, 0);
+  reader_socket = socket_udp_bind(ip_loopback, 0, SOCKET_EXCLUSIVE);
+  CHECK(reader_socket != -1);
+  CHECK_INT(socket_set_blocking(reader_socket, 1), 0);
+  CHECK_INT(setsockopt(reader_socket, SOL_SOCKET, SO_RCVTIMEO, &watchdog, sizeof(watchdog)), 0);
+
+  CHECK_INT(pthread_create(&thread, NULL, blocked_reader, NULL), 0);
+  usleep(100000); /* long enough to be sure it reached the read */
+  CHECK_INT(pthread_kill(thread, OT_SIGNAL_WAKE), 0);
+
+  for (waited = 0; waited < 1000 && !atomic_load(&reader_returned); ++waited)
+    usleep(1000);
+  CHECK(waited < 1000);
+  pthread_join(thread, NULL);
+  close(reader_socket);
+}
+
 /* An IPv4 peer must arrive in the v4 mapped form opentracker stores, however
    the kernel chose to report it. Linux fills a v4 mapped sockaddr_in6 here
    and the BSDs fill a plain sockaddr_in, so this is the case that tells the
@@ -293,6 +349,7 @@ void test_socket(void) {
   case_sharing_is_opt_in();
 #endif
   case_udp_roundtrip();
+  case_a_signal_ends_a_blocking_read();
   case_udp_v4mapped();
   case_tcp_roundtrip();
   case_connect_refused();
diff --git a/tests/udp_wake_probe.c b/tests/udp_wake_probe.c
index 8a0f7a8..e948c34 100644
--- a/tests/udp_wake_probe.c
+++ b/tests/udp_wake_probe.c
@@ -1,13 +1,17 @@
-/* Three ways to get a thread out of a blocking recvfrom, tested rather than
-   assumed: close the socket, shut it down, or give it a receive timeout.
+/* Four ways to get a thread out of a blocking recvfrom, tested rather than
+   assumed: close the socket, shut it down, give it a receive timeout, or
+   send it a signal.
 
-   This decides how udp workers can be stopped. They sit in recvfrom and are
-   never joined today, and the sockets of a SO_REUSEPORT group all share one
-   address, so a worker cannot be singled out by sending it a datagram.
+   This decides how udp workers are stopped. The sockets of a SO_REUSEPORT
+   group all share one address, so a worker cannot be singled out by sending
+   it a datagram, and the two mechanisms differ in what they cost while the
+   tracker is running: a receive timeout wakes every worker on every tick
+   forever, a signal and a shutdown cost nothing until the one moment they
+   are used.
 
      cc -O2 -pthread -o /tmp/wake tests/udp_wake_probe.c && /tmp/wake
 
-   On Linux 6.1: close does not wake it, shutdown does, SO_RCVTIMEO does. */
+   On Linux 6.1: close does not wake it, the other three do. */
 #include <errno.h>
 #include <netinet/in.h>
 #include <pthread.h>
@@ -15,9 +19,12 @@
 #include <stdio.h>
 #include <string.h>
 #include <sys/socket.h>
+#include <signal.h>
 #include <sys/time.h>
 #include <unistd.h>
 
+#define WAKE_SIGNAL SIGUSR1
+
 static _Atomic int returned;
 static _Atomic int saved_errno;
 static int         sock;
@@ -31,6 +38,11 @@ static void       *reader(void *args) {
   return NULL;
 }
 
+/* A handler that does nothing is all it takes: the point is the return from
+   recvfrom with EINTR, not anything the handler does. SA_RESTART must stay
+   off or the kernel resumes the call instead of reporting it. */
+static void noop(int s) { (void)s; }
+
 static int bind_udp(int timeout_ms) {
   struct sockaddr_in address;
   int                s = socket(AF_INET, SOCK_DGRAM, 0);
@@ -50,7 +62,7 @@ static int bind_udp(int timeout_ms) {
   return s;
 }
 
-static void try_it(const char *name, int timeout_ms, int do_close, int do_shutdown) {
+static void try_it(const char *name, int timeout_ms, int do_close, int do_shutdown, int do_signal) {
   pthread_t thread;
   int       waited;
 
@@ -62,6 +74,8 @@ static void try_it(const char *name, int timeout_ms, int do_close, int do_shutdo
 
   if (do_shutdown)
     shutdown(sock, SHUT_RD);
+  if (do_signal)
+    pthread_kill(thread, WAKE_SIGNAL);
   if (do_close)
     close(sock);
 
@@ -92,8 +106,16 @@ static void try_it(const char *name, int timeout_ms, int do_close, int do_shutdo
 }
 
 int main(void) {
-  try_it("close() the socket", 0, 1, 0);
-  try_it("shutdown(SHUT_RD)", 0, 0, 1);
-  try_it("SO_RCVTIMEO 500 ms", 500, 0, 0);
+  struct sigaction sa;
+
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_handler = noop;
+  sa.sa_flags   = 0;
+  sigaction(WAKE_SIGNAL, &sa, NULL);
+
+  try_it("close() the socket", 0, 1, 0, 0);
+  try_it("shutdown(SHUT_RD)", 0, 0, 1, 0);
+  try_it("SO_RCVTIMEO 500 ms", 500, 0, 0, 0);
+  try_it("pthread_kill(SIGUSR1)", 0, 0, 0, 1);
   return 0;
 }
diff --git a/trackerlogic.h b/trackerlogic.h
index ad6c911..7d0693a 100644
--- a/trackerlogic.h
+++ b/trackerlogic.h
@@ -6,6 +6,7 @@
 #ifndef OT_TRACKERLOGIC_H__
 #define OT_TRACKERLOGIC_H__
 
+#include <signal.h>
 #include <stdatomic.h>
 #include <stdint.h>
 #include <stdlib.h>
@@ -90,6 +91,9 @@ static inline ot_time time_future_seconds(int span) { return time_now_seconds()
 /* Cleared from the interrupt handler and read by every worker */
 extern _Atomic int    g_opentracker_running;
 
+/* Sent to a thread parked in a blocking read */
+#define OT_SIGNAL_WAKE SIGUSR1
+
 
 extern uint32_t g_tracker_id;
 typedef enum { FLAG_TCP, FLAG_UDP, FLAG_MCA, FLAG_SELFPIPE } PROTO_FLAG;