[tsan] Check for pvalloc overlow

[cryptoad]

Summary

CheckForPvallocOverflow was introduced with D35818 to detect when pvalloc
would wrap when rounding up to the next multiple of the page size.

Add this check to TSan's pvalloc implementation.

lib/tsan/rtl/tsan_mman.cc

 }
 
 void *user_valloc(ThreadState *thr, uptr pc, uptr sz) {
   return SetErrnoOnNull(user_alloc_internal(thr, pc, sz, GetPageSizeCached()));
 }
 
 void *user_pvalloc(ThreadState *thr, uptr pc, uptr sz) {
   uptr PageSize = GetPageSizeCached();
+  if (UNLIKELY(CheckForPvallocOverflow(sz, PageSize))) {
+    errno = errno_ENOMEM;
+    return Allocator::FailureHandler::OnBadRequest();
+  }
   // pvalloc(0) should allocate one page.
   sz = sz ? RoundUpTo(sz, PageSize) : PageSize;
   return SetErrnoOnNull(user_alloc_internal(thr, pc, sz, PageSize));
 }
 
 uptr user_alloc_usable_size(const void *p) {
   if (p == 0)
     return 0;

lib/tsan/tests/unit/tsan_mman_test.cc

TEST(Mman, Stats) {
   EXPECT_EQ(alloc0, __sanitizer_get_current_allocated_bytes());
   EXPECT_GE(__sanitizer_get_heap_size(), heap0);
   EXPECT_EQ(free0, __sanitizer_get_free_bytes());
   EXPECT_EQ(unmapped0, __sanitizer_get_unmapped_bytes());
 }
 
 TEST(Mman, Valloc) {
   ThreadState *thr = cur_thread();
+  uptr page_size = GetPageSizeCached();
 
   void *p = user_valloc(thr, 0, 100);
   EXPECT_NE(p, (void*)0);
   user_free(thr, 0, p);
 
   p = user_pvalloc(thr, 0, 100);
   EXPECT_NE(p, (void*)0);
   user_free(thr, 0, p);
 
   p = user_pvalloc(thr, 0, 0);
   EXPECT_NE(p, (void*)0);
-  EXPECT_EQ(GetPageSizeCached(), __sanitizer_get_allocated_size(p));
+  EXPECT_EQ(page_size, __sanitizer_get_allocated_size(p));
   user_free(thr, 0, p);
+
+  EXPECT_DEATH(p = user_pvalloc(thr, 0, (uptr)-(page_size - 1)),
+               "allocator is terminating the process instead of returning 0");
+  EXPECT_DEATH(p = user_pvalloc(thr, 0, (uptr)-1),
+               "allocator is terminating the process instead of returning 0");
 }
 
 #if !SANITIZER_DEBUG
 // EXPECT_DEATH clones a thread with 4K stack,
 // which is overflown by tsan memory accesses functions in debug mode.
 
 TEST(Mman, CallocOverflow) {
   ThreadState *thr = cur_thread();