diff options
author | Tomasz Moń <desowin@gmail.com> | 2021-06-05 19:47:41 +0200 |
---|---|---|
committer | Solomon Peachy <pizza@shaftnet.org> | 2021-06-05 18:41:02 +0000 |
commit | 77603c344dd4946d0319688c3b58bf9e1507d9aa (patch) | |
tree | 33d4301748565482ff4053adf336b5ad17986a15 | |
parent | 62098a0cc9300e3aa7192615d05d52b92484972c (diff) | |
download | rockbox-77603c344dd4946d0319688c3b58bf9e1507d9aa.tar.gz rockbox-77603c344dd4946d0319688c3b58bf9e1507d9aa.zip |
DM320: Fix buffer overrun in sdmmc driver
Modify count, buffer and start address only after successful transfer.
This makes the retry operation to use the same address and buffer as the
just failed transfer.
Change-Id: I4f49bbdc861d634e33ea5e939a9693474411d24d
-rw-r--r-- | firmware/target/arm/tms320dm320/sdmmc-dm320.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/firmware/target/arm/tms320dm320/sdmmc-dm320.c b/firmware/target/arm/tms320dm320/sdmmc-dm320.c index 8818d645d8..f479b54a91 100644 --- a/firmware/target/arm/tms320dm320/sdmmc-dm320.c +++ b/firmware/target/arm/tms320dm320/sdmmc-dm320.c | |||
@@ -713,8 +713,6 @@ sd_transfer_retry: | |||
713 | goto sd_transfer_error; | 713 | goto sd_transfer_error; |
714 | } | 714 | } |
715 | 715 | ||
716 | count -= count_per_dma; | ||
717 | |||
718 | if (write == false) | 716 | if (write == false) |
719 | { | 717 | { |
720 | discard_dcache_range(use_direct_dma ? buffer : aligned_buffer, | 718 | discard_dcache_range(use_direct_dma ? buffer : aligned_buffer, |
@@ -726,9 +724,6 @@ sd_transfer_retry: | |||
726 | } | 724 | } |
727 | } | 725 | } |
728 | 726 | ||
729 | buffer += count_per_dma*SD_BLOCK_SIZE; | ||
730 | start_addr += count_per_dma; | ||
731 | |||
732 | last_disk_activity = current_tick; | 727 | last_disk_activity = current_tick; |
733 | 728 | ||
734 | ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL); | 729 | ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL); |
@@ -742,6 +737,10 @@ sd_transfer_retry: | |||
742 | { | 737 | { |
743 | goto sd_transfer_error; | 738 | goto sd_transfer_error; |
744 | } | 739 | } |
740 | |||
741 | count -= count_per_dma; | ||
742 | buffer += count_per_dma*SD_BLOCK_SIZE; | ||
743 | start_addr += count_per_dma; | ||
745 | } while (count > 0); | 744 | } while (count > 0); |
746 | 745 | ||
747 | while (1) | 746 | while (1) |