[scudo] Untag pointer in iterateOverChunks

[vitalybuka]

Summary

Pointer comparison in Lambda will not work on tagged pointers.

[vitalybuka]

fix test for non-MTE

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

736

Can this just use archSupportsMemoryTagging()?

[vitalybuka]

use archSupportsMemoryTagging

[pcc]

LGTM

compiler-rt/lib/scudo/standalone/combined.h

736–737

You don't need to move these two lines around now.

[vitalybuka]

undo accidental line move

compiler-rt/lib/scudo/standalone/combined.h

#endif
   }
 
   // Iterate over all chunks and call a callback for all busy chunks located
   // within the provided memory range. Said callback must not use this allocator
   // or a deadlock can ensue. This fits Android's malloc_iterate() needs.
   void iterateOverChunks(uptr Base, uptr Size, iterate_callback Callback,
                          void *Arg) {
     initThreadMaybe();
+    if (archSupportsMemoryTagging())
+      Base = untagPointer(Base);
     const uptr From = Base;
     const uptr To = Base + Size;
     bool MayHaveTaggedPrimary = allocatorSupportsMemoryTagging<Params>() &&
                                 systemSupportsMemoryTagging();
     auto Lambda = [this, From, To, MayHaveTaggedPrimary, Callback,
                    Arg](uptr Block) {
       if (Block < From || Block >= To)
         return;
       uptr Chunk;
       Chunk::UnpackedHeader Header;
       if (MayHaveTaggedPrimary) {
         // A chunk header can either have a zero tag (tagged primary) or the
         // header tag (secondary, or untagged primary). We don't know which so
         // try both.

compiler-rt/lib/scudo/standalone/tests/wrappers_c_test.cpp

 //===-- wrappers_c_test.cpp -------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
+#include "memtag.h"
 #include "scudo/interface.h"
 #include "tests/scudo_unit_test.h"
 
 #include <errno.h>
 #include <limits.h>
 #include <malloc.h>
 #include <stdlib.h>
 #include <unistd.h>
TEST(ScudoWrappersCTest, MallInfo) {
   EXPECT_GE(static_cast<size_t>(MI.fordblks), Free + BypassQuarantineSize);
 }
 #endif
 
 static uintptr_t BoundaryP;
 static size_t Count;
 
 static void callback(uintptr_t Base, size_t Size, void *Arg) {
+  if (scudo::archSupportsMemoryTagging()) {
+    Base = scudo::untagPointer(Base);
+    BoundaryP = scudo::untagPointer(BoundaryP);
+  }
   if (Base == BoundaryP)
     Count++;
 }
 
 // Verify that a block located on an iteration boundary is not mis-accounted.
 // To achieve this, we allocate a chunk for which the backing block will be
 // aligned on a page, then run the malloc_iterate on both the pages that the
 // block is a boundary for. It must only be seen once by the callback function.