[PATCH net 1/1] sctp: stream: clear current stream on stream teardown

Ren Wei <[email protected]> Thu, 28 May 2026 16:58:49 +0800
Newsgroups org.kernel.vger.linux-sctp,org.kernel.vger.netdev
Message-ID <ad9d7027579442c6c9498e7af84f836747a7620e.1779644468.git.xuyq21@lenovo.com>
From: Yuqi Xu <[email protected]>

out_curr caches the outbound stream currently being dequeued. When the
stream table is replaced, the old stream entries and their ext state
are freed, so keeping out_curr leaves scheduler state pointing at
released stream storage.

Clear out_curr in sctp_stream_free(), where the backing stream entries
are torn down. This keeps the cached scheduler state aligned with the
lifetime of the stream table for stream updates and any other full
stream teardown paths.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Cc: [email protected]
Reported-by: Yuan Tan <[email protected]>
Reported-by: Yifan Wu <[email protected]>
Reported-by: Juefei Pu <[email protected]>
Reported-by: Zhengchuan Liang <[email protected]>
Reported-by: Xin Liu <[email protected]>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Yuqi Xu <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
 net/sctp/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index c2247793c88b..207e0a77f9af 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -186,6 +186,7 @@ void sctp_stream_free(struct sctp_stream *stream)
 	int i;
 
 	sched->unsched_all(stream);
+	stream->out_curr = NULL;
 	for (i = 0; i < stream->outcnt; i++)
 		sctp_stream_free_ext(stream, i);
 	genradix_free(&stream->out);
-- 
2.54.0