@@ -21,6 +21,11 @@
/* The list ends with an ATAG_NONE node. */
#define ATAG_NONE 0x00000000
+/* Some sanity checks are needed */
+#define ATAG_MAX_SZ PAGE_SIZE
+#define atag_valid(tag) \
+ ((tag)->hdr.size && ((tag)->hdr.size <= ATAG_MAX_SZ))
+
struct tag_header {
__u32 size;
__u32 tag;
@@ -173,9 +178,10 @@ struct tagtable {
int (*parse)(const struct tag *);
};
-#define tag_member_present(tag,member) \
- ((unsigned long)(&((struct tag *)0L)->member + 1) \
- <= (tag)->hdr.size * 4)
+#define tag_member_present(tag,member) \
+ (atag_valid(tag) && \
+ (((unsigned long)(&((struct tag *)0L)->member + 1) \
+ <= (tag)->hdr.size * 4))
#define tag_next(t) ((struct tag *)((__u32 *)(t) + (t)->hdr.size))
#define tag_size(type) ((sizeof(struct tag_header) + sizeof(struct type)) >> 2)
@@ -51,7 +51,7 @@ static int __init init_atags_procfs(void)
return -EINVAL;
}
- for (; tag->hdr.size; tag = tag_next(tag))
+ for (; atag_valid(tag); tag = tag_next(tag))
;
/* include the terminating ATAG_NONE */
@@ -220,7 +220,7 @@ void __init convert_to_tag_list(struct tag *tags)
void __init squash_mem_tags(struct tag *tag)
{
- for (; tag->hdr.size; tag = tag_next(tag))
+ for (; atag_valid(tag); tag = tag_next(tag))
if (tag->hdr.tag == ATAG_MEM)
tag->hdr.tag = ATAG_NONE;
}
@@ -556,7 +556,7 @@ request_standard_resources(struct meminfo *mi, struct machine_desc *mdesc)
*/
static int __init parse_tag_core(const struct tag *tag)
{
- if (tag->hdr.size > 2) {
+ if ((atag_valid(tag) && (tag->hdr.size > 2))) {
if ((tag->u.core.flags & 1) == 0)
root_mountflags &= ~MS_RDONLY;
ROOT_DEV = old_decode_dev(tag->u.core.rootdev);
@@ -660,7 +660,7 @@ static int __init parse_tag(const struct tag *tag)
*/
static void __init parse_tags(const struct tag *t)
{
- for (; t->hdr.size; t = tag_next(t))
+ for (; atag_valid(t); t = tag_next(t))
if (!parse_tag(t))
printk(KERN_WARNING
"Ignoring unrecognised tag 0x%08x\n",
@@ -717,7 +717,7 @@ void __init orion5x_init(void)
void __init tag_fixup_mem32(struct machine_desc *mdesc, struct tag *t,
char **from, struct meminfo *meminfo)
{
- for (; t->hdr.size; t = tag_next(t))
+ for (; atag_valid(t); t = tag_next(t))
if (t->hdr.tag == ATAG_MEM &&
(!t->u.mem.size || t->u.mem.size & ~PAGE_MASK ||
t->u.mem.start & ~PAGE_MASK)) {