summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTomasz Moń <desowin@gmail.com>2021-06-05 19:47:41 +0200
committerSolomon Peachy <pizza@shaftnet.org>2021-06-05 18:41:02 +0000
commit77603c344dd4946d0319688c3b58bf9e1507d9aa (patch)
tree33d4301748565482ff4053adf336b5ad17986a15
parent62098a0cc9300e3aa7192615d05d52b92484972c (diff)
downloadrockbox-77603c344d.tar.gz
rockbox-77603c344d.zip
DM320: Fix buffer overrun in sdmmc driver
Modify count, buffer and start address only after successful transfer. This makes the retry operation to use the same address and buffer as the just failed transfer. Change-Id: I4f49bbdc861d634e33ea5e939a9693474411d24d
-rw-r--r--firmware/target/arm/tms320dm320/sdmmc-dm320.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/firmware/target/arm/tms320dm320/sdmmc-dm320.c b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
index 8818d645d8..f479b54a91 100644
--- a/firmware/target/arm/tms320dm320/sdmmc-dm320.c
+++ b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
@@ -713,8 +713,6 @@ sd_transfer_retry:
goto sd_transfer_error;
}
- count -= count_per_dma;
-
if (write == false)
{
discard_dcache_range(use_direct_dma ? buffer : aligned_buffer,
@@ -726,9 +724,6 @@ sd_transfer_retry:
}
}
- buffer += count_per_dma*SD_BLOCK_SIZE;
- start_addr += count_per_dma;
-
last_disk_activity = current_tick;
ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL);
@@ -742,6 +737,10 @@ sd_transfer_retry:
{
goto sd_transfer_error;
}
+
+ count -= count_per_dma;
+ buffer += count_per_dma*SD_BLOCK_SIZE;
+ start_addr += count_per_dma;
} while (count > 0);
while (1)