The system allocator fallback added in https://reviews.llvm.org/D55986
(llvm-svn: 350427) introduces the assumption that all allocations with a zero
tag have been allocated by the system allocator.
During thread initialisation this assumption no longer holds.
Thread::Init disables tagging using the ScopedTaggingDisabler, until its
internal data structures have been initialised so that
Thread::GenerateRandomTag can generate a random tag.
While libhwasan finds the stack bounds using pthread attributes, libc allocates
and frees an object at the time that stack tagging is disabled. Hence the
allocation is handled by libhwasan and the free is given to the system
I have attached a patch here that makes the hwasan allocation routine pass
allocation off to the system allocator if tagging is disabled in the current
Another approach I considered was to make GenerateRandomTag return a known
non-zero tag when tagging is disabled for the current thread.
I decided against this since the tags of other pointers seem to be zero when
tagging is disabled (e.g. for flags->disable_allocator_tagging).
Testing done manually on an AArch64 VM using both GCC and clang.
This patch makes GenerateRandomTag return a known non-zero tag when tagging
is disabled, which essentially marks whatever pointer is being created as
coming from the internal allocator.