[scudo] Fix MTE crash in storeEndMarker.

[eugenis]

Summary

The bounds check in storeEndMarker incorrectly compares tagged against
untagged address in the in-place realloc case. This can cause the tag
store to go into an unmapped page to the right of the region mapping.

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

1167 ↗

(On Diff #387732)

this invariant no longer relevant?

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

1169 ↗

(On Diff #387732)

Can we fix the caller to untag BlockEnd instead?

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

1169 ↗

(On Diff #387732)

...which we already did in D105261. I reckon we'll need to cherry-pick that everywhere.

[eugenis]

Remove the fix, keep the test.

compiler-rt/lib/scudo/standalone/combined.h

1169 ↗

(On Diff #387732)

Oh right. I hacked this on an older version of the code :(

[pcc]

LGTM

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

for (unsigned I = 0; I != Ptrs.size(); ++I) {
       Ptrs[I] = Allocator->allocate(Size, Origin, 1U << MinAlignLog, true);
       for (scudo::uptr J = 0; J < Size; ++J)
         ASSERT_EQ((reinterpret_cast<char *>(Ptrs[I]))[J], 0);
     }
   }
 
   Allocator->setOption(scudo::Option::ThreadDisableMemInit, 0);
 }
+
+SCUDO_TYPED_TEST(ScudoCombinedTest, ReallocateInPlaceStress) {
+  auto *Allocator = this->Allocator.get();
+
+  // Regression test: make realloc-in-place happen at the very right end of a
+  // mapped region.
+  constexpr int nPtrs = 10000;
+  for (int i = 1; i < 32; ++i) {
+    scudo::uptr Size = 16 * i - 1;
+    std::vector<void *> Ptrs;
+    for (int i = 0; i < nPtrs; ++i) {
+      void *P = Allocator->allocate(Size, Origin);
+      P = Allocator->reallocate(P, Size + 1);
+      Ptrs.push_back(P);
+    }
+
+    for (int i = 0; i < nPtrs; ++i)
+      Allocator->deallocate(Ptrs[i], Origin);
+  }
+}