summaryrefslogtreecommitdiffstats
path: root/firmware/target/arm
diff options
context:
space:
mode:
authorTomasz Moń <desowin@gmail.com>2021-06-05 19:47:41 +0200
committerSolomon Peachy <pizza@shaftnet.org>2021-06-05 18:41:02 +0000
commit77603c344dd4946d0319688c3b58bf9e1507d9aa (patch)
tree33d4301748565482ff4053adf336b5ad17986a15 /firmware/target/arm
parent62098a0cc9300e3aa7192615d05d52b92484972c (diff)
downloadrockbox-77603c344dd4946d0319688c3b58bf9e1507d9aa.tar.gz
rockbox-77603c344dd4946d0319688c3b58bf9e1507d9aa.tar.bz2
rockbox-77603c344dd4946d0319688c3b58bf9e1507d9aa.zip
DM320: Fix buffer overrun in sdmmc driver
Modify count, buffer and start address only after successful transfer. This makes the retry operation to use the same address and buffer as the just failed transfer. Change-Id: I4f49bbdc861d634e33ea5e939a9693474411d24d
Diffstat (limited to 'firmware/target/arm')
-rw-r--r--firmware/target/arm/tms320dm320/sdmmc-dm320.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/firmware/target/arm/tms320dm320/sdmmc-dm320.c b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
index 8818d645d8..f479b54a91 100644
--- a/firmware/target/arm/tms320dm320/sdmmc-dm320.c
+++ b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
@@ -713,8 +713,6 @@ sd_transfer_retry:
goto sd_transfer_error;
}
- count -= count_per_dma;
-
if (write == false)
{
discard_dcache_range(use_direct_dma ? buffer : aligned_buffer,
@@ -726,9 +724,6 @@ sd_transfer_retry:
}
}
- buffer += count_per_dma*SD_BLOCK_SIZE;
- start_addr += count_per_dma;
-
last_disk_activity = current_tick;
ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL);
@@ -742,6 +737,10 @@ sd_transfer_retry:
{
goto sd_transfer_error;
}
+
+ count -= count_per_dma;
+ buffer += count_per_dma*SD_BLOCK_SIZE;
+ start_addr += count_per_dma;
} while (count > 0);
while (1)