Merge tag 'devicetree-for-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree updates from Rob Herring:

 - Rewrite of the unflattening code to avoid recursion and lessen the
   stack usage.

 - Rewrite of the phandle args parsing code to get rid of the fixed args
   size.  This is needed for IOMMU code.

 - Sync to latest dtc which adds more dts style checking.  These
   warnings are enabled with "W=1" compiles.

 - Tegra documentation updates related to the above warnings.

 - A bunch of spelling and other doc fixes.

 - Various vendor prefix additions.

* tag 'devicetree-for-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (52 commits)
  devicetree: Add Creative Technology vendor id
  gpio: dt-bindings: add ibm,ppc4xx-gpio binding
  of/unittest: Remove unnecessary module.h header inclusion
  drivers/of: Fix build warning in populate_node()
  drivers/of: Fix depth when unflattening devicetree
  of: dynamic: changeset prop-update revert fix
  drivers/of: Export of_detach_node()
  drivers/of: Return allocated memory from of_fdt_unflatten_tree()
  drivers/of: Specify parent node in of_fdt_unflatten_tree()
  drivers/of: Rename unflatten_dt_node()
  drivers/of: Avoid recursively calling unflatten_dt_node()
  drivers/of: Split unflatten_dt_node()
  of: include errno.h in of_graph.h
  of: document refcount incrementation of of_get_cpu_node()
  Documentation: dt: soc: fix spelling mistakes
  Documentation: dt: power: fix spelling mistake
  Documentation: dt: pinctrl: fix spelling mistake
  Documentation: dt: opp: fix spelling mistake
  Documentation: dt: net: fix spelling mistakes
  Documentation: dt: mtd: fix spelling mistake
  ...

1 files changed, 2 insertions, 2 deletions

diff --git a/scripts/dtc/flattree.c b/scripts/dtc/flattree.c
index bd99fa2d33b8..ec14954f5810 100644
--- a/scripts/dtc/flattree.c
+++ b/scripts/dtc/flattree.c
@@ -889,7 +889,7 @@ struct boot_info *dt_from_blob(const char *fname)
 
 	if (version >= 3) {
 		uint32_t size_str = fdt32_to_cpu(fdt->size_dt_strings);
-		if (off_str+size_str > totalsize)
+		if ((off_str+size_str < off_str) || (off_str+size_str > totalsize))
 			die("String table extends past total size\n");
 		inbuf_init(&strbuf, blob + off_str, blob + off_str + size_str);
 	} else {
@@ -898,7 +898,7 @@ struct boot_info *dt_from_blob(const char *fname)
 
 	if (version >= 17) {
 		size_dt = fdt32_to_cpu(fdt->size_dt_struct);
-		if (off_dt+size_dt > totalsize)
+		if ((off_dt+size_dt < off_dt) || (off_dt+size_dt > totalsize))
 			die("Structure block extends past total size\n");
 	}