[hwasan] Always untag short granule in shadow.

[hctim]

Summary

Fixes a regression when the allocator is disabled, and a dirty
allocation is re-used. This only occurs when the allocator is disabled,
so a test-only fix, but still necessary.

[eugenis]

LGTM

compiler-rt/lib/hwasan/hwasan_allocator.cpp

static void *HwasanAllocate(StackTrace *stack, uptr orig_size, uptr alignment,
   meta->right_aligned = false;
   if (zeroise) {
     internal_memset(allocated, 0, size);
   } else if (flags()->max_malloc_fill_size > 0) {
     uptr fill_size = Min(size, (uptr)flags()->max_malloc_fill_size);
     internal_memset(allocated, flags()->malloc_fill_byte, fill_size);
   }
   if (size != orig_size) {
-    internal_memcpy(reinterpret_cast<u8 *>(allocated) + orig_size, tail_magic,
-                    size - orig_size - 1);
+    u8 *tail = reinterpret_cast<u8 *>(allocated) + orig_size;
+    uptr tail_length = size - orig_size;
+    internal_memcpy(tail, tail_magic, tail_length - 1);
+    // Short granule is excluded from magic tail, so we explicitly untag.
+    tail[tail_length - 1] = 0;
   }
 
   void *user_ptr = allocated;
   // Tagging can only be skipped when both tag_in_malloc and tag_in_free are
   // false. When tag_in_malloc = false and tag_in_free = true malloc needs to
   // retag to 0.
   if (InTaggableRegion(reinterpret_cast<uptr>(user_ptr)) &&
       (flags()->tag_in_malloc || flags()->tag_in_free) &&

compiler-rt/test/hwasan/TestCases/short-granule-disabled.cpp

+// RUN: %clangxx_hwasan %s -o %t && %run %t 2>&1
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// Regression test for https://reviews.llvm.org/D107938#2961070, where, on
+// reusing an allocation, we forgot to reset the short granule tag if the
+// allocator was disabled. This lead to a false positive magic-string mismatch.
+
+int main() {
+  void *p = malloc(16);
+  memset(p, 0xff, 16);
+  free(p);
+
+  // Relies on the LRU cache immediately recycling the allocation above.
+  p = malloc(8);
+  free(p); // Regression was here, in the magic-string check in the runtime.
+  return 0;
+}