From 733eb24d392399d05d2986644e5fc4db95ceadd9 Mon Sep 17 00:00:00 2001 From: jsg Date: Mon, 4 Mar 2024 02:26:20 +0000 Subject: [PATCH] drm/ttm: Fix an invalid freeing on already freed page in error path From Thomas Hellstrom 47bacc3c7fbbf573415c7ce1e7223bed3d691bfd in linux-6.6.y/6.6.19 40510a941d27d405a82dc3320823d875f94625df in mainline linux --- sys/dev/pci/drm/ttm/ttm_pool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/pci/drm/ttm/ttm_pool.c b/sys/dev/pci/drm/ttm/ttm_pool.c index 30dc673c065..8b6f53856dd 100644 --- a/sys/dev/pci/drm/ttm/ttm_pool.c +++ b/sys/dev/pci/drm/ttm/ttm_pool.c @@ -528,7 +528,7 @@ static void ttm_pool_free_range(struct ttm_pool *pool, struct ttm_tt *tt, enum ttm_caching caching, pgoff_t start_page, pgoff_t end_page) { - struct vm_page **pages = tt->pages; + struct vm_page **pages = &tt->pages[start_page]; unsigned int order; pgoff_t i, nr; -- 2.20.1