Correct malloc_limit value for pre-relocation malloc()

The limit is measured from the start of the malloc() area and is not an
absolute address. Correct this.

Signed-off-by: Simon Glass <sjg@chromium.org>

common/spl/spl.c

@@ -158,7 +158,7 @@ void board_init_r(gd_t *dummy1, ulong dummy2)
 			CONFIG_SYS_SPL_MALLOC_SIZE);
 	gd->flags |= GD_FLG_FULL_MALLOC_INIT;
 #elif defined(CONFIG_SYS_MALLOC_F_LEN)
-	gd->malloc_limit = gd->malloc_base + CONFIG_SYS_MALLOC_F_LEN;
+	gd->malloc_limit = CONFIG_SYS_MALLOC_F_LEN;
 	gd->malloc_ptr = 0;
 #endif
 #ifdef CONFIG_SPL_DM