[PATCH net 1/1] net: sctp: clear current outbound stream on stream teardown

From: Yuqi Xu <[email protected]>

out_curr caches the outbound stream selected for continuing a
fragmented message. That pointer refers directly to an entry in the
stream->out table.

When the stream table is torn down, such as during stream updates for
association restart handling, the old outbound stream entries are freed
before a new table is installed. Clear out_curr as part of
sctp_stream_free() so later dequeue paths never keep following a stale
stream pointer after the teardown.

This keeps the lifetime rule local to the stream teardown helper and
covers every current caller that frees the outbound stream table.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Cc: [email protected]
Reported-by: Yuan Tan <[email protected]>
Reported-by: Yifan Wu <[email protected]>
Reported-by: Juefei Pu <[email protected]>
Reported-by: Zhengchuan Liang <[email protected]>
Reported-by: Xin Liu <[email protected]>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Yuqi Xu <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
 net/sctp/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index c2247793c88b..207e0a77f9af 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -186,6 +186,7 @@ void sctp_stream_free(struct sctp_stream *stream)
 	int i;
 
 	sched->unsched_all(stream);
+	stream->out_curr = NULL;
 	for (i = 0; i < stream->outcnt; i++)
 		sctp_stream_free_ext(stream, i);
 	genradix_free(&stream->out);
-- 
2.54.0