[scudo] Fix MTE crash in storeEndMarker.

[eugenis]

Summary

The bounds check in storeEndMarker incorrectly compares tagged against
untagged address in the in-place realloc case. This can cause the tag
store to go into an unmapped page to the right of the region mapping.

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

1167

this invariant no longer relevant?

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

1169

Can we fix the caller to untag BlockEnd instead?

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

1169

...which we already did in D105261. I reckon we'll need to cherry-pick that everywhere.

[eugenis]

Remove the fix, keep the test.

compiler-rt/lib/scudo/standalone/combined.h

1169

Oh right. I hacked this on an older version of the code :(

[pcc]

LGTM

compiler-rt/lib/scudo/standalone/combined.h

#endif
   // header granule will be set to 0, so it will serve the purpose of catching
   // linear overflows in this case.
   //
   // For allocations of size 0 we do not end up storing the address tag to the
   // memory tag space, which getInlineErrorInfo() normally relies on to match
   // address tags against chunks. To allow matching in this case we store the
   // address tag in the first byte of the chunk.
   void storeEndMarker(uptr End, uptr Size, uptr BlockEnd) {
     DCHECK_EQ(BlockEnd, untagPointer(BlockEnd));
     uptr UntaggedEnd = untagPointer(End);
-    if (UntaggedEnd != BlockEnd) {
+    uptr UntaggedBlockEnd = untagPointer(BlockEnd);
+    if (UntaggedEnd != UntaggedBlockEnd) {
       storeTag(UntaggedEnd);
       if (Size == 0)
         *reinterpret_cast<u8 *>(UntaggedEnd) = extractTag(End);
     }
   }
 
   void *prepareTaggedChunk(void *Ptr, uptr Size, uptr ExcludeMask,
                            uptr BlockEnd) {

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

for (unsigned I = 0; I != Ptrs.size(); ++I) {
       Ptrs[I] = Allocator->allocate(Size, Origin, 1U << MinAlignLog, true);
       for (scudo::uptr J = 0; J < Size; ++J)
         ASSERT_EQ((reinterpret_cast<char *>(Ptrs[I]))[J], 0);
     }
   }
 
   Allocator->setOption(scudo::Option::ThreadDisableMemInit, 0);
 }
+
+SCUDO_TYPED_TEST(ScudoCombinedTest, ReallocateInPlaceStress) {
+  auto *Allocator = this->Allocator.get();
+
+  // Regression test: make realloc-in-place happen at the very right end of a
+  // mapped region.
+  constexpr int nPtrs = 10000;
+  for (int i = 1; i < 32; ++i) {
+    scudo::uptr Size = 16 * i - 1;
+    std::vector<void *> Ptrs;
+    for (int i = 0; i < nPtrs; ++i) {
+      void *P = Allocator->allocate(Size, Origin);
+      P = Allocator->reallocate(P, Size + 1);
+      Ptrs.push_back(P);
+    }
+
+    for (int i = 0; i < nPtrs; ++i)
+      Allocator->deallocate(Ptrs[i], Origin);
+  }
+}