2 files changed, 20 insertions, 10 deletions

diff --git a/arch/powerpc/boot/libfdt-wrapper.c b/arch/powerpc/boot/libfdt-wrapper.c
index c541fd8a95d4..1daa73f08ba8 100644
--- a/arch/powerpc/boot/libfdt-wrapper.c
+++ b/arch/powerpc/boot/libfdt-wrapper.c
@@ -165,6 +165,7 @@ static unsigned long fdt_wrapper_finalize(void)
 void fdt_init(void *blob)
 {
         int err;
+        int bufsize;
 
         dt_ops.finddevice = fdt_wrapper_finddevice;
         dt_ops.getprop = fdt_wrapper_getprop;
@@ -178,16 +179,15 @@ void fdt_init(void *blob)
 
         /* Make sure the dt blob is the right version and so forth */
         fdt = blob;
-        err = fdt_open_into(fdt, fdt, fdt_totalsize(blob));
-        if (err == -FDT_ERR_NOSPACE) {
-                int bufsize = fdt_totalsize(fdt) + 4;
-                buf = malloc(bufsize);
-                err = fdt_open_into(fdt, buf, bufsize);
-        }
+        bufsize = fdt_totalsize(fdt) + 4;
+        buf = malloc(bufsize);
+        if(!buf)
+                fatal("malloc failed. can't relocate the device tree\n\r");
+
+        err = fdt_open_into(fdt, buf, bufsize);
 
         if (err != 0)
                 fatal("fdt_init(): %s\n\r", fdt_strerror(err));
 
-        if (buf)
-                fdt = buf;
+        fdt = buf;
 }
diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c
index 9e7f3ddd9913..ae32801ebd69 100644
--- a/arch/powerpc/boot/main.c
+++ b/arch/powerpc/boot/main.c
@@ -56,9 +56,19 @@ static struct addr_range prep_kernel(void)
         if (platform_ops.vmlinux_alloc) {
                 addr = platform_ops.vmlinux_alloc(ei.memsize);
         } else {
-                if ((unsigned long)_start < ei.memsize)
+                /*
+                 * Check if the kernel image (without bss) would overwrite the
+                 * bootwrapper. The device tree has been moved in fdt_init()
+                 * to an area allocated with malloc() (somewhere past _end).
+                 */
+                if ((unsigned long)_start < ei.loadsize)
                         fatal("Insufficient memory for kernel at address 0!"
-                               " (_start=%p)\n\r", _start);
+                               " (_start=%p, uncomressed size=%08x)\n\r",
+                               _start, ei.loadsize);
+
+                if ((unsigned long)_end < ei.memsize)
+                        fatal("The final kernel image would overwrite the "
+                                        "device tree\n\r");
         }
 
         /* Finally, gunzip the kernel */