[SCSI] sg: fix oops in the error path in sg_build_indirect()

When the allocation fails in sg_build_indirect(), an oops happens in
the error path. It's caused by an obvious typo.

Signed-off-by: Michal Schmidt <[email protected]>
Reported-by: Bob Tracy <[email protected]>
Acked-by: Douglas Gilbert <[email protected]>
Cc: Stable Tree <[email protected]>
Signed-off-by: James Bottomley <[email protected]>

drivers/scsi/sg.c

@@ -1811,7 +1811,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
 	return 0;
 out:
 	for (i = 0; i < k; i++)
-		__free_pages(schp->pages[k], order);
+		__free_pages(schp->pages[i], order);
 
 	if (--order >= 0)
 		goto retry;