Handle libhwasan system allocator fallback during thread initialisation

[mmalcomson]

Summary

The system allocator fallback added in https://reviews.llvm.org/D55986
(llvm-svn: 350427) introduces the assumption that all allocations with a zero
tag have been allocated by the system allocator.

During thread initialisation this assumption no longer holds.
Thread::Init disables tagging using the ScopedTaggingDisabler, until its
internal data structures have been initialised so that
Thread::GenerateRandomTag can generate a random tag.

While libhwasan finds the stack bounds using pthread attributes, libc allocates
and frees an object at the time that stack tagging is disabled. Hence the
allocation is handled by libhwasan and the free is given to the system
allocator.

I have attached a patch here that makes the hwasan allocation routine pass
allocation off to the system allocator if tagging is disabled in the current
thread.

Another approach I considered was to make GenerateRandomTag return a known
non-zero tag when tagging is disabled for the current thread.
I decided against this since the tags of other pointers seem to be zero when
tagging is disabled (e.g. for flags->disable_allocator_tagging).

Testing done manually on an AArch64 VM using both GCC and clang.

This patch makes GenerateRandomTag return a known non-zero tag when tagging
is disabled, which essentially marks whatever pointer is being created as
coming from the internal allocator.

[mmalcomson]

Remove some superfluous semicolons that were causing warnings.

[eugenis]

Another approach I considered was to make GenerateRandomTag return a known
non-zero tag when tagging is disabled for the current thread.

I think this is not a bad idea. Could we use a fixed non-zero tag in the allocator under the same condition, i.e.

(t->TaggingIsDisabled() && !flags()->disable_allocator_tagging)

@pcc WDYT?

compiler-rt/lib/hwasan/hwasan_allocator.cpp

130

Wrong indentation here makes it look like REAL(malloc) is called outside of both if-s.
Please use clang-format, and also add {} braces for the outer if block.

[pcc]

In D69051#1713765, @eugenis wrote:

Another approach I considered was to make GenerateRandomTag return a known
non-zero tag when tagging is disabled for the current thread.

I think this is not a bad idea. Could we use a fixed non-zero tag in the allocator under the same condition, i.e.

(t->TaggingIsDisabled() && !flags()->disable_allocator_tagging)

@pcc WDYT?

SGTM.

[mmalcomson]

Now avoid returning a zero tag when tagging is disabled.

I've avoided that by returning a fixed non-zero tag from Thread::GenerateRandomTag.

NOTE: There's the same basic problem of tagging with zero going to the system allocator free when setting HWASAN_OPTIONS tag_in_malloc=false. I intend to fix that in a separate patch.

[eugenis]

In fact, we are not going to pursue this malloc fallback feature any more, and I doubt anyone else is interested.
Let's simply remove it: D69199.

[mmalcomson]

Closing given the allocator fallback feature is not being pursued any more.

compiler-rt/lib/hwasan/hwasan_allocator.h

 
 #if !defined(__aarch64__) && !defined(__x86_64__)
 #error Unsupported platform
 #endif
 
 #if HWASAN_WITH_INTERCEPTORS
 DECLARE_REAL(void *, realloc, void *ptr, uptr size)
 DECLARE_REAL(void, free, void *ptr)
+DECLARE_REAL(void *, malloc, SIZE_T size);
+DECLARE_REAL(void *, calloc, SIZE_T nmemb, SIZE_T size);
 #endif
 
 namespace __hwasan {
 
 struct Metadata {
   u32 requested_size : 31;  // sizes are < 2G.
   u32 right_aligned  : 1;
   u32 alloc_context_id;

compiler-rt/lib/hwasan/hwasan_allocator.cpp

 #include "hwasan_mapping.h"
 #include "hwasan_malloc_bisect.h"
 #include "hwasan_thread.h"
 #include "hwasan_report.h"
 
 #if HWASAN_WITH_INTERCEPTORS
 DEFINE_REAL(void *, realloc, void *ptr, uptr size)
 DEFINE_REAL(void, free, void *ptr)
+DEFINE_REAL(void *, malloc, SIZE_T size);
+DEFINE_REAL(void *, calloc, SIZE_T nmemb, SIZE_T size);
 #endif
 
 namespace __hwasan {
 
 static Allocator allocator;
 static AllocatorCache fallback_allocator_cache;
 static SpinMutex fallback_mutex;
 static atomic_uint8_t hwasan_allocator_tagging_enabled;
if (orig_size > kMaxAllowedMallocSize) {
     ReportAllocationSizeTooBig(orig_size, kMaxAllowedMallocSize, stack);
   }
 
   alignment = Max(alignment, kShadowAlignment);
   uptr size = TaggedSize(orig_size);
   Thread *t = GetCurrentThread();
   void *allocated;
   if (t) {
+#if HWASAN_WITH_INTERCEPTORS
+    if (t->TaggingIsDisabled() && !flags()->disable_allocator_tagging)
+      if (zeroise)
+        return REAL(calloc)(1, orig_size);
+      else
+  return REAL(malloc)(orig_size);
+#endif
     allocated = allocator.Allocate(t->allocator_cache(), size, alignment);
   } else {
     SpinMutexLock l(&fallback_mutex);
     AllocatorCache *cache = &fallback_allocator_cache;
     allocated = allocator.Allocate(cache, size, alignment);
   }
   if (UNLIKELY(!allocated)) {
     SetAllocatorOutOfMemory();

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

#if !defined(__aarch64__)
   INTERCEPT_FUNCTION(pthread_create);
 #else
   INTERCEPT_FUNCTION(longjmp);
   INTERCEPT_FUNCTION(__libc_longjmp);
   INTERCEPT_FUNCTION(siglongjmp);
 #endif  // __aarch64__
   INTERCEPT_FUNCTION(realloc);
   INTERCEPT_FUNCTION(free);
+  INTERCEPT_FUNCTION(malloc);
+  INTERCEPT_FUNCTION(calloc);
 #endif
 
   inited = 1;
 }
 } // namespace __hwasan