Correct malloc_limit value for pre-relocation malloc()

The limit is measured from the start of the malloc() area and is not an
absolute address. Correct this.

Signed-off-by: Simon Glass <sjg@chromium.org>
diff --git a/common/spl/spl.c b/common/spl/spl.c
index 8e1fb40..af1336c 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -158,7 +158,7 @@
 			CONFIG_SYS_SPL_MALLOC_SIZE);
 	gd->flags |= GD_FLG_FULL_MALLOC_INIT;
 #elif defined(CONFIG_SYS_MALLOC_F_LEN)
-	gd->malloc_limit = gd->malloc_base + CONFIG_SYS_MALLOC_F_LEN;
+	gd->malloc_limit = CONFIG_SYS_MALLOC_F_LEN;
 	gd->malloc_ptr = 0;
 #endif
 #ifdef CONFIG_SPL_DM