>         /* Calculate the new allocated total */
> -       new_alloced = data_start + ALIGN(size, 1U << align_log2);
> +       new_alloced = data_start - map_to_sysmem(hdr) +
> +               ALIGN(size, 1U << align_log2);

I think this is incorrect. There's no requirement that the size of an
entry must also be aligned as strictly as its start offset. So if
someone calls this code as bloblist_addrec(tag, 16, 8, ptr), then it
will try to create a blob at a 256 byte boundary with only 16 bytes of
data size, which is perfectly legal, but this code here will set
new_alloced as if the data size was also 256. That's not correct and
would likely throw off calculations elsewhere later. The alignment to
the start of the next entry is always just 8 bytes, so this line
should use BLOBLIST_BLOB_ALIGN_LOG2 (or sizeof(*rec)) instead of
align_log2.

>         if (new_alloced > hdr->size) {
>                 log_err("Failed to allocate %x bytes size=%x, need size=%x\n",
> @@ -153,7 +168,7 @@ static int bloblist_addrec(uint tag, int size, int 
> align_log2,
>         rec = (void *)hdr + hdr->alloced;
>
>         rec->tag = tag;
> -       rec->hdr_size = data_start - hdr->alloced;
> +       rec->hdr_size = sizeof(struct bloblist_rec);
>         rec->size = size;

You also need to update the TL header alignment field if the requested
alignment here is greater, e.g. something like

if (hdr->alignment < align_log2)
  hdr->alignment = align_log2;

Reply via email to