[HWASan] Print short tags in tag mismatch description.

[morehouse]

Summary

I recently spent some extra time debugging a false positive because I
didn't realize the "real" tag was in the short granule. Adding the
short tag here makes it more obvious that we could be dealing with a
short granule.

[hctim]

thanks! this is exactly what I was thinking

[eugenis]

LGTM, but maybe put the short tag in () or [] to show that it is logically part of the memory tag? And I would remove the "/short" part - it's confusing if you don't know what short tags are, and unnecessary if you do.

[morehouse]

• Remove /short and put short tag in parens.

compiler-rt/lib/hwasan/hwasan_report.cpp

sptr offset =
       __hwasan_test_shadow(reinterpret_cast<void *>(tagged_addr), access_size);
   CHECK(offset >= 0 && offset < static_cast<sptr>(access_size));
   tag_t ptr_tag = GetTagFromPointer(tagged_addr);
   tag_t *tag_ptr =
       reinterpret_cast<tag_t *>(MemToShadow(untagged_addr + offset));
   tag_t mem_tag = *tag_ptr;
 
   Printf("%s", d.Access());
-  Printf("%s of size %zu at %p tags: %02x/%02x (ptr/mem) in thread T%zd\n",
-         is_store ? "WRITE" : "READ", access_size, untagged_addr, ptr_tag,
-         mem_tag, t->unique_id());
   if (mem_tag && mem_tag < kShadowAlignment) {
     tag_t *granule_ptr = reinterpret_cast<tag_t *>((untagged_addr + offset) &
                                                    ~(kShadowAlignment - 1));
     // If offset is 0, (untagged_addr + offset) is not aligned to granules.
     // This is the offset of the leftmost accessed byte within the bad granule.
     u8 in_granule_offset = (untagged_addr + offset) & (kShadowAlignment - 1);
+    tag_t short_tag = granule_ptr[kShadowAlignment - 1];
     // The first mismatch was a short granule that matched the ptr_tag.
-    if (granule_ptr[kShadowAlignment - 1] == ptr_tag) {
+    if (short_tag == ptr_tag) {
       // If the access starts after the end of the short granule, then the first
       // bad byte is the first byte of the access; otherwise it is the first
       // byte past the end of the short granule
       if (mem_tag > in_granule_offset) {
         offset += mem_tag - in_granule_offset;
       }
     }
+    Printf(
+        "%s of size %zu at %p tags: %02x/%02x(%02x) (ptr/mem) in thread T%zd\n",
+        is_store ? "WRITE" : "READ", access_size, untagged_addr, ptr_tag,
+        mem_tag, short_tag, t->unique_id());
+  } else {
+    Printf("%s of size %zu at %p tags: %02x/%02x (ptr/mem) in thread T%zd\n",
+           is_store ? "WRITE" : "READ", access_size, untagged_addr, ptr_tag,
+           mem_tag, t->unique_id());
   }
   if (offset != 0)
     Printf("Invalid access starting at offset %zu\n", offset);
   Printf("%s", d.Default());
 
   stack->Print();
 
   PrintAddressDescription(tagged_addr, access_size,

compiler-rt/test/hwasan/TestCases/heap-buffer-overflow.c

 // CHECKMm30: is a large allocated heap chunk; size: 1003520 offset: -30
 // CHECKMm30: Cause: heap-buffer-overflow
 // CHECKMm30: is located 30 bytes to the left of 1000000-byte region
 //
 // CHECKM: is a large allocated heap chunk; size: 1003520 offset: 1000000
 // CHECKM: Cause: heap-buffer-overflow
 // CHECKM: is located 0 bytes to the right of 1000000-byte region
 //
-// CHECK31: tags: [[TAG:..]]/0e (ptr/mem)
+// CHECK31: tags: [[TAG:..]]/0e([[TAG]]) (ptr/mem)
 // CHECK31-NOT: Invalid access starting at offset
 // CHECK31: Cause: heap-buffer-overflow
 // CHECK31: is located 1 bytes to the right of 30-byte region
 // CHECK31: Memory tags around the buggy address
 // CHECK31: [0e]
 // CHECK31: Tags for short granules around the buggy address
 // CHECK31: {{\[}}[[TAG]]]
 //
 // CHECK20-NOT: Invalid access starting at offset
 // CHECK20: Cause: heap-buffer-overflow
 // CHECK20: is located 10 bytes to the right of 20-byte region [0x{{.*}}0,0x{{.*}}4)
   free(x);
 }