Fix rfe instruction

The rfe instruction has been broken since patch
5a839c0d because of a typo.
Signed-off-by: NPeter Chubb <peter.chubb@nicta.com.au>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

target-arm/translate.c

@@ -6752,7 +6752,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
             tcg_gen_qemu_ld32u(tmp, addr, 0);
             tcg_gen_addi_i32(addr, addr, 4);
             tmp2 = tcg_temp_new_i32();
-            tcg_gen_qemu_ld32u(tmp, addr, 0);
+            tcg_gen_qemu_ld32u(tmp2, addr, 0);
             if (insn & (1 << 21)) {
                 /* Base writeback.  */
                 switch (i) {