--- y/net/tls/tls_sw.c
+++ t/net/tls/tls_sw.c
@@ -1818,10 +1818,14 @@ static long tls_rx_reader_lock(struct so
 			      !READ_ONCE(ctx->reader_present), &wait);
 		remove_wait_queue(&ctx->wq, &wait);
 
-		if (!timeo)
+		if (!timeo) {
+			release_sock(sk);
 			return -EAGAIN;
-		if (signal_pending(current))
+		}
+		if (signal_pending(current)) {
+			release_sock(sk);
 			return sock_intr_errno(timeo);
+		}
 	}
 
 	WRITE_ONCE(ctx->reader_present, 1);
@@ -1874,8 +1878,11 @@ int tls_sw_recvmsg(struct sock *sk,
 
 	psock = sk_psock_get(sk);
 	timeo = tls_rx_reader_lock(sk, ctx, flags & MSG_DONTWAIT);
-	if (timeo < 0)
+	if (timeo < 0) {
+		if (psock)
+			sk_psock_put(sk, psock);
 		return timeo;
+	}
 	bpf_strp_enabled = sk_psock_strp_enabled(psock);
 
 	/* If crypto failed the connection is broken */