drm/amdkcl: fix NULL pointer dereference during module unload

The free_xcp_dev() function incorrectly uses the global pdev_num variable
to index into the xcp_dev array. Since pdev_num is decremented during
the loop, it can lead to accessing an incorrect index during concurrent
unloads or error conditions, resulting in a NULL pointer dereference.

Signed-off-by: Chengjun Yao <Chengjun.Yao@amd.com>
Reviewed-by: Bob Zhou <Bob.Zhou@amd.com>

Author: Chengjun Yao

drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c

@@ -112,8 +112,8 @@ static void free_xcp_dev(int8_t index)
 		devres_release_group(&pdev->dev, NULL);
 		platform_device_unregister(pdev);
 #ifndef HAVE_DRM_DRM_MANAGED_H
-		drm_dev_fini(&(xcp_dev[pdev_num]->drm));
-		kfree(xcp_dev[pdev_num]);
+		drm_dev_fini(&(xcp_dev[index]->drm));
+		kfree(xcp_dev[index]);
 #endif
 		xcp_dev[index] = NULL;
 		pdev_num--;