[hwasan] Make sure we retag with a new tag on free.

[eugenis]

LGTM

compiler-rt/lib/hwasan/hwasan_allocator.cpp

static void HwasanDeallocate(StackTrace *stack, void *tagged_ptr) {
   if (!PointerAndMemoryTagsMatch(tagged_ptr))
     ReportInvalidFree(stack, reinterpret_cast<uptr>(tagged_ptr));
 
   void *untagged_ptr = InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr))
                            ? UntagPtr(tagged_ptr)
                            : tagged_ptr;
   void *aligned_ptr = reinterpret_cast<void *>(
       RoundDownTo(reinterpret_cast<uptr>(untagged_ptr), kShadowAlignment));
+  tag_t pointer_tag = GetTagFromPointer(reinterpret_cast<uptr>(tagged_ptr));
   Metadata *meta =
       reinterpret_cast<Metadata *>(allocator.GetMetaData(aligned_ptr));
   uptr orig_size = meta->get_requested_size();
   u32 free_context_id = StackDepotPut(*stack);
   u32 alloc_context_id = meta->alloc_context_id;
 
   // Check tail magic.
   uptr tagged_size = TaggedSize(orig_size);
if (InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr)) &&
     // Always store full 8-bit tags on free to maximize UAF detection.
     tag_t tag;
     if (t) {
       // Make sure we are not using a short granule tag as a poison tag. This
       // would make us attempt to read the memory on a UaF.
       // The tag can be zero if tagging is disabled on this thread.
       do {
         tag = t->GenerateRandomTag(/*num_bits=*/8);
-      } while (UNLIKELY(tag < kShadowAlignment && tag != 0));
+      } while (
+          UNLIKELY((tag < kShadowAlignment || tag == pointer_tag) && tag != 0));
     } else {
       static_assert(kFallbackFreeTag >= kShadowAlignment,
                     "fallback tag must not be a short granule tag.");
       tag = kFallbackFreeTag;
     }
     TagMemoryAligned(reinterpret_cast<uptr>(aligned_ptr), TaggedSize(orig_size),
                      tag);
   }