[hwasan] Reset current thread pointer on thread exit.

[eugenis]

Summary

This is necessary to handle calls to free() after __hwasan_thread_exit,
which is possible in glibc.

Also, add a null check to GetCurrentThread, otherwise the logic in
GetThreadByBufferAddress turns it into a non-null value. This means that
all of the checks for GetCurrentThread() != nullptr do not have any
effect at all right now!

[hctim]

compiler-rt/test/hwasan/TestCases/libc_thread_freeres.c

22

nit: return 0;?

[eugenis]

fix the test

[eugenis]

compiler-rt/test/hwasan/TestCases/libc_thread_freeres.c

22

not a nit - it's actually UB in C (but not in C++).
Fixed.

compiler-rt/lib/hwasan/hwasan.cpp

 } // namespace __hwasan
 
 using namespace __hwasan;
 
 void __sanitizer::BufferedStackTrace::UnwindImpl(
     uptr pc, uptr bp, void *context, bool request_fast, u32 max_depth) {
   Thread *t = GetCurrentThread();
   if (!t) {
-    // the thread is still being created.
+    // The thread is still being created, or has already been destroyed.
     size = 0;
     return;
   }
   Unwind(max_depth, pc, bp, context, t->stack_top(), t->stack_bottom(),
          request_fast);
 }
 
 struct hwasan_global {

compiler-rt/lib/hwasan/hwasan_linux.cpp

void AndroidTestTlsSlot() {
   }
   *tls_ptr = old_value;
 }
 #else
 void AndroidTestTlsSlot() {}
 #endif
 
 Thread *GetCurrentThread() {
-  auto *R = (StackAllocationsRingBuffer *)GetCurrentThreadLongPtr();
-  return hwasanThreadList().GetThreadByBufferAddress((uptr)(R->Next()));
+  uptr *ThreadLongPtr = GetCurrentThreadLongPtr();
+  if (UNLIKELY(*ThreadLongPtr == 0))
+    return nullptr;
+  auto *R = (StackAllocationsRingBuffer *)ThreadLongPtr;
+  return hwasanThreadList().GetThreadByBufferAddress((uptr)R->Next());
 }
 
 struct AccessInfo {
   uptr addr;
   uptr size;
   bool is_store;
   bool is_load;
   bool recover;

compiler-rt/lib/hwasan/hwasan_thread.cpp

 void Thread::Destroy() {
   if (flags()->verbose_threads)
     Print("Destroying: ");
   AllocatorSwallowThreadLocalCache(allocator_cache());
   ClearShadowForThreadStackAndTLS();
   if (heap_allocations_)
     heap_allocations_->Delete();
   DTLS_Destroy();
+  // Unregister this as the current thread.
+  // Instrumented code can not run on this thread from this point onwards, but
+  // malloc/free can still be served. Glibc may call free() very late, after all
+  // TSD destructors are done.
+  CHECK_EQ(GetCurrentThread(), this);
+  *GetCurrentThreadLongPtr() = 0;
 }
 
 void Thread::Print(const char *Prefix) {
   Printf("%sT%zd %p stack: [%p,%p) sz: %zd tls: [%p,%p)\n", Prefix,
          unique_id_, this, stack_bottom(), stack_top(),
          stack_top() - stack_bottom(),
          tls_begin(), tls_end());
 }

compiler-rt/test/hwasan/TestCases/libc_thread_freeres.c

+// RUN: %clang_hwasan %s -o %t && %env_hwasan_opts=random_tags=1 %run %t
+// REQUIRES: stable-runtime
+
+#include <pthread.h>
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+void *ThreadFn(void *) {
+  strerror_l(-1, 0);
+  __hwasan_enable_allocator_tagging();
+  // This will trigger memory deallocation in __strerror_thread_freeres,
+  // at a point when HwasanThread is already gone.
+}
+
+int main() {
+  pthread_t t;
+  pthread_create(&t, NULL, ThreadFn, NULL);
+  pthread_join(t, NULL);
+  return 0;
+}