From 77603c344dd4946d0319688c3b58bf9e1507d9aa Mon Sep 17 00:00:00 2001 From: Tomasz Moń Date: Sat, 5 Jun 2021 19:47:41 +0200 Subject: DM320: Fix buffer overrun in sdmmc driver Modify count, buffer and start address only after successful transfer. This makes the retry operation to use the same address and buffer as the just failed transfer. Change-Id: I4f49bbdc861d634e33ea5e939a9693474411d24d --- firmware/target/arm/tms320dm320/sdmmc-dm320.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'firmware') diff --git a/firmware/target/arm/tms320dm320/sdmmc-dm320.c b/firmware/target/arm/tms320dm320/sdmmc-dm320.c index 8818d645d8..f479b54a91 100644 --- a/firmware/target/arm/tms320dm320/sdmmc-dm320.c +++ b/firmware/target/arm/tms320dm320/sdmmc-dm320.c @@ -713,8 +713,6 @@ sd_transfer_retry: goto sd_transfer_error; } - count -= count_per_dma; - if (write == false) { discard_dcache_range(use_direct_dma ? buffer : aligned_buffer, @@ -726,9 +724,6 @@ sd_transfer_retry: } } - buffer += count_per_dma*SD_BLOCK_SIZE; - start_addr += count_per_dma; - last_disk_activity = current_tick; ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL); @@ -742,6 +737,10 @@ sd_transfer_retry: { goto sd_transfer_error; } + + count -= count_per_dma; + buffer += count_per_dma*SD_BLOCK_SIZE; + start_addr += count_per_dma; } while (count > 0); while (1) -- cgit v1.2.3