From: Yuqi Xu <redacted>

out_curr caches the outbound stream currently being dequeued. When the
stream table is replaced, the old stream entries and their ext state
are freed, so keeping out_curr leaves scheduler state pointing at
released stream storage.

Clear out_curr in sctp_stream_free(), where the backing stream entries
are torn down. This keeps the cached scheduler state aligned with the
lifetime of the stream table for stream updates and any other full
stream teardown paths.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Cc: stable@kernel.org
Reported-by: Yuan Tan <redacted>
Reported-by: Yifan Wu <redacted>
Reported-by: Juefei Pu <redacted>
Reported-by: Zhengchuan Liang <redacted>
Reported-by: Xin Liu <redacted>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Yuqi Xu <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/sctp/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index c2247793c88b..207e0a77f9af 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c

@@ -186,6 +186,7 @@ void sctp_stream_free(struct sctp_stream *stream)
 	int i;
 
 	sched->unsched_all(stream);
+	stream->out_curr = NULL;
 	for (i = 0; i < stream->outcnt; i++)
 		sctp_stream_free_ext(stream, i);
 	genradix_free(&stream->out);

-- 
2.54.0