aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Crosthwaite <peter.crosthwaite@xilinx.com>2014-08-04 14:41:54 +0100
committerPeter Maydell <peter.maydell@linaro.org>2014-08-04 14:41:54 +0100
commit9db11cef8c557ccc6e0a3e7eca786b197eed5f59 (patch)
tree0d0ac6b000eb5dc98338db0e990850b5914cc554
parentfab46932393366792b438c078b48c196e9d35a1a (diff)
downloadqemu-arm-9db11cef8c557ccc6e0a3e7eca786b197eed5f59.tar.gz
sd: sdhci: Fix ADMA dma_memory_read access
This dma_memory_read was giving too big a size when begin was non-zero. This could cause segfaults in some circumstances. Fix. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--hw/sd/sdhci.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index b5a9eee3e2..f9fe700add 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -702,7 +702,8 @@ static void sdhci_do_adma(SDHCIState *s)
length -= block_size - begin;
}
dma_memory_read(&address_space_memory, dscr.addr,
- &s->fifo_buffer[begin], s->data_count);
+ &s->fifo_buffer[begin],
+ s->data_count - begin);
dscr.addr += s->data_count - begin;
if (s->data_count == block_size) {
for (n = 0; n < block_size; n++) {