From: jsg <jsg@openbsd.org>
Date: Mon, 4 Mar 2024 02:26:20 +0000 (+0000)
Subject: drm/ttm: Fix an invalid freeing on already freed page in error path
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=733eb24d392399d05d2986644e5fc4db95ceadd9;p=openbsd

drm/ttm: Fix an invalid freeing on already freed page in error path

From Thomas Hellstrom
47bacc3c7fbbf573415c7ce1e7223bed3d691bfd in linux-6.6.y/6.6.19
40510a941d27d405a82dc3320823d875f94625df in mainline linux
---

diff --git a/sys/dev/pci/drm/ttm/ttm_pool.c b/sys/dev/pci/drm/ttm/ttm_pool.c
index 30dc673c065..8b6f53856dd 100644
--- a/sys/dev/pci/drm/ttm/ttm_pool.c
+++ b/sys/dev/pci/drm/ttm/ttm_pool.c
@@ -528,7 +528,7 @@ static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt,
 				enum ttm_caching caching,
 				pgoff_t start_page, pgoff_t end_page)
 {
-	struct vm_page **pages = tt->pages;
+	struct vm_page **pages = &tt->pages[start_page];
 	unsigned int order;
 	pgoff_t i, nr;