Re: [PATCH net 1/1] net: sctp: clear current outbound stream on stream teardown

On Wed, May 27, 2026 at 1:43 AM Ren Wei <[email protected]> wrote:
>
> From: Yuqi Xu <[email protected]>
>
> out_curr caches the outbound stream selected for continuing a
> fragmented message. That pointer refers directly to an entry in the
> stream->out table.
>
> When the stream table is torn down, such as during stream updates for
> association restart handling, the old outbound stream entries are freed
> before a new table is installed. Clear out_curr as part of
> sctp_stream_free() so later dequeue paths never keep following a stale
> stream pointer after the teardown.
>
> This keeps the lifetime rule local to the stream teardown helper and
> covers every current caller that frees the outbound stream table.
>
> Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
> Cc: [email protected]
> Reported-by: Yuan Tan <[email protected]>
> Reported-by: Yifan Wu <[email protected]>
> Reported-by: Juefei Pu <[email protected]>
> Reported-by: Zhengchuan Liang <[email protected]>
> Reported-by: Xin Liu <[email protected]>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Yuqi Xu <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---
>  net/sctp/stream.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/sctp/stream.c b/net/sctp/stream.c
> index c2247793c88b..207e0a77f9af 100644
> --- a/net/sctp/stream.c
> +++ b/net/sctp/stream.c
> @@ -186,6 +186,7 @@ void sctp_stream_free(struct sctp_stream *stream)
>         int i;
>
>         sched->unsched_all(stream);
> +       stream->out_curr = NULL;
>         for (i = 0; i < stream->outcnt; i++)
>                 sctp_stream_free_ext(stream, i);
>         genradix_free(&stream->out);

As commented on another patch, purging outqueue will also clear
stream->out_curr for the corner case via:

sctp_outq_teardown() -> sctp_sched_dequeue_done(last_chunk).

so there's no need to do it here.

Thanks.