1 files changed, 23 insertions, 1 deletions

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 80e0ae5534ec..2936ed17bf9e 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *fa, size_t index, size_t count)
         }
 }
 
+static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+{
+        size_t index = 0;
+
+        while (count--) {
+                if (elem == flex_array_get(fa, index))
+                        break;
+                index++;
+        }
+
+        return index;
+}
+
 /* Migrates chunks from stream queues to new stream queues if needed,
  * but not across associations. Also, removes those chunks to streams
  * higher than the new max.
@@ -131,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                 }
         }
 
-        for (i = outcnt; i < stream->outcnt; i++)
+        for (i = outcnt; i < stream->outcnt; i++) {
                 kfree(SCTP_SO(stream, i)->ext);
+                SCTP_SO(stream, i)->ext = NULL;
+        }
 }
 
 static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
@@ -147,6 +162,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
 
         if (stream->out) {
                 fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
+                if (stream->out_curr) {
+                        size_t index = fa_index(stream->out, stream->out_curr,
+                                                stream->outcnt);
+
+                        BUG_ON(index == stream->outcnt);
+                        stream->out_curr = flex_array_get(out, index);
+                }
                 fa_free(stream->out);
         }