drm/ttm: Fix an invalid freeing on already freed page in error path

From Thomas Hellstrom
47bacc3c7fbbf573415c7ce1e7223bed3d691bfd in linux-6.6.y/6.6.19
40510a941d27d405a82dc3320823d875f94625df in mainline linux

diff --git a/sys/dev/pci/drm/ttm/ttm_pool.c b/sys/dev/pci/drm/ttm/ttm_pool.c
index 30dc673..8b6f538 100644 (file)
--- a/sys/dev/pci/drm/ttm/ttm_pool.c
+++ b/sys/dev/pci/drm/ttm/ttm_pool.c
@@ -528,7 +528,7 @@ static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt,
                                enum ttm_caching caching,
                                pgoff_t start_page, pgoff_t end_page)
 {
-       struct vm_page **pages = tt->pages;
+       struct vm_page **pages = &tt->pages[start_page];
        unsigned int order;
        pgoff_t i, nr;