[Asan] Don't use MetaData for size

[vitalybuka]

Summary

If size > SizeClassMap::kMaxSize we should have enough space in red zone.

This also limits max allocation size to 2^45.

[morehouse]

This patch changes how the allocator works, so I don't think it qualifies as NFC.

compiler-rt/lib/asan/asan_allocator.cpp

86–89

s/to/of

86–89

Can we document why we're storing the requested size in the redzone instead of in metadata?

125–131

Can we add a function comment that explains what to pass as unused_beg?

546

Can we now move chung_beg into meta[0]?

[vitalybuka]

comments

[vitalybuka]

In D86922#2253544, @morehouse wrote:

This patch changes how the allocator works, so I don't think it qualifies as NFC.

According https://llvm.org/docs/Lexicon.html NFC is for "is a pure refactoring/cleanup". And definition of refactoring includes "without changing external behavior". Almost ANY refactoring involves changing of internal behavior.
My understanding that "pure" here applies to both refactoring and cleanup and does no mean a special kind of refactoring. It just means do not include in that patch bugfixes and or even trivial external behavior changes.
That's how I understand NFC.
Here no external users, even other asan internal components, are going to be affected by thins change. So it's pure refactoring which just moves location of one internal field from one type to another.
E.g. D86917 is a different story as someone we may find a fixed bug, although it's very unlikely.

compiler-rt/lib/asan/asan_allocator.cpp

546

I am going to move it out from meta as well D86931

[vitalybuka]

rebase

[vitalybuka]

use headers

compiler-rt/lib/asan/asan_allocator.cpp

 //   U -- user memory.
 //   R -- right redzone (0 or more bytes)
 // ChunkBase consists of ChunkHeader and other bytes that overlap with user
 // memory.
 
 // If the left redzone is greater than the ChunkHeader size we store a magic
 // value in the first uptr word of the memory block and store the address of
 // ChunkBase in the next uptr.
-// M B L L L L L L L L L  H H U U U U U U
+// M B L L L L L L L L S  H H U U U U U U
 //   |                    ^
 //   ---------------------|
 //   M -- magic value kAllocBegMagic
 //   B -- address of ChunkHeader pointing to the first 'H'
+//   S -- Maybe user_requested_size
 static const uptr kAllocBegMagic = 0xCC6E96B9;
 
 struct ChunkHeader {
   // 1-st 8 bytes.
   atomic_uint8_t chunk_state;
   u32 alloc_tid : 24;
 
   u32 free_tid : 24;
   u32 from_memalign : 1;
   u32 alloc_type : 2;
   u32 rz_log : 3;
   u32 lsan_tag : 2;
   // 2-nd 8 bytes
   // This field is used for small sizes. For large sizes it is equal to
-  // SizeClassMap::kMaxSize and the actual size is stored in the
-  // SecondaryAllocator's metadata.
+  // SizeClassMap::kMaxSize and the actual size is stored left of the header.
+  // We can also use allocator's metadata, but it will cause inconsistency
+  // between PrimaryAllocator which never uses metadata, and secondary
+  // one which will likely handle large size requestst.
   u32 user_requested_size : 29;
   // align < 8 -> 0
   // else      -> log2(min(align, 512)) - 2
   u32 user_requested_alignment_log : 3;
   atomic_uint32_t alloc_context_id;
 };
 
 struct ChunkBase : ChunkHeader {
enum {
   // The chunk is allocated and not yet freed.
   CHUNK_ALLOCATED = 2,
   // The chunk was freed and put into quarantine zone.
   CHUNK_QUARANTINE = 3,
 };
 
 struct AsanChunk: ChunkBase {
   uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; }
-  uptr UsedSize(bool locked_version = false) {
+  uptr UsedSize() {
     if (user_requested_size != SizeClassMap::kMaxSize)
       return user_requested_size;
-    return *reinterpret_cast<uptr *>(
-        get_allocator().GetMetaData(AllocBeg(locked_version)));
+    return *(reinterpret_cast<uptr *>(this) - 1);
   }
-  void *AllocBeg(bool locked_version = false) {
-    if (from_memalign) {
-      if (locked_version)
-        return get_allocator().GetBlockBeginFastLocked(
-            reinterpret_cast<void *>(this));
-      return get_allocator().GetBlockBegin(reinterpret_cast<void *>(this));
+
+  // unused_beg is used just for sanity check and should be set to the lowest
+  // unused byte of the left redzone, not counting AsanChunk itself.
+  void SetUsedSize(uptr size, void *unused_beg) {
+    if (size < SizeClassMap::kMaxSize) {
+      user_requested_size = size;
+      return;
     }
+    CHECK_GE(reinterpret_cast<uptr *>(this),
+             reinterpret_cast<uptr *>(unused_beg) + 1);
+    *(reinterpret_cast<uptr *>(this) - 1) = size;
+    user_requested_size = SizeClassMap::kMaxSize;
+  }
+  void *AllocBeg() {
+    if (from_memalign)
+      return get_allocator().GetBlockBegin(reinterpret_cast<void *>(this));
     return reinterpret_cast<void*>(Beg() - RZLog2Size(rz_log));
   }
-  bool AddrIsInside(uptr addr, bool locked_version = false) {
-    return (addr >= Beg()) && (addr < Beg() + UsedSize(locked_version));
+  bool AddrIsInside(uptr addr) {
+    return (addr >= Beg()) && (addr < Beg() + UsedSize());
   }
 };
 
 struct QuarantineCallback {
   QuarantineCallback(AllocatorCache *cache, BufferedStackTrace *stack)
       : cache_(cache),
         stack_(stack) {
   }
struct Allocator {
   void RePoisonChunk(uptr chunk) {
     // This could be a user-facing chunk (with redzones), or some internal
     // housekeeping chunk, like TransferBatch. Start by assuming the former.
     AsanChunk *ac = GetAsanChunk((void *)chunk);
     uptr allocated_size = allocator.GetActuallyAllocatedSize((void *)ac);
     if (atomic_load(&ac->chunk_state, memory_order_acquire) ==
         CHUNK_ALLOCATED) {
       uptr beg = ac->Beg();
-      uptr end = ac->Beg() + ac->UsedSize(true);
+      uptr end = ac->Beg() + ac->UsedSize();
       uptr chunk_end = chunk + allocated_size;
       if (chunk < beg && beg < end && end <= chunk_end) {
         // Looks like a valid AsanChunk in use, poison redzones only.
         PoisonShadow(chunk, beg - chunk, kAsanHeapLeftRedzoneMagic);
         uptr end_aligned_down = RoundDownTo(end, SHADOW_GRANULARITY);
         FastPoisonShadowPartialRightRedzone(
             end_aligned_down, end - end_aligned_down,
             chunk_end - end_aligned_down, kAsanHeapLeftRedzoneMagic);
void *Allocate(uptr size, uptr alignment, BufferedStackTrace *stack,
     CHECK_EQ(alloc_tid, m->alloc_tid);  // Does alloc_tid fit into the bitfield?
     m->free_tid = kInvalidTid;
     m->from_memalign = user_beg != beg_plus_redzone;
     if (alloc_beg != chunk_beg) {
       CHECK_LE(alloc_beg + 2 * sizeof(uptr), chunk_beg);
       reinterpret_cast<uptr *>(alloc_beg)[0] = kAllocBegMagic;
       reinterpret_cast<uptr *>(alloc_beg)[1] = chunk_beg;
     }
-    if (using_primary_allocator) {
-      CHECK(size);
-      m->user_requested_size = size;
+    if (using_primary_allocator) {
       CHECK(allocator.FromPrimary(allocated));
+      m->user_requested_size = size;
     } else {
       CHECK(!allocator.FromPrimary(allocated));
-      m->user_requested_size = SizeClassMap::kMaxSize;
+      m->SetUsedSize(
+          size, reinterpret_cast<uptr *>(alloc_beg) + 2 /* magic, chunk_beg */);
       uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(allocated));
-      meta[0] = size;
       meta[1] = chunk_beg;
     }
     m->user_requested_alignment_log = user_requested_alignment_log;
 
     atomic_store(&m->alloc_context_id, StackDepotPut(*stack),
                  memory_order_relaxed);
 
     uptr size_rounded_down_to_granularity =
         RoundDownTo(size, SHADOW_GRANULARITY);

 
 uptr PointsIntoChunk(void* p) {
   uptr addr = reinterpret_cast<uptr>(p);
   __asan::AsanChunk *m = __asan::instance.GetAsanChunkByAddrFastLocked(addr);
   if (!m || atomic_load(&m->chunk_state, memory_order_acquire) !=
                 __asan::CHUNK_ALLOCATED)
     return 0;
   uptr chunk = m->Beg();
-  if (m->AddrIsInside(addr, /*locked_version=*/true))
+  if (m->AddrIsInside(addr))
     return chunk;
-  if (IsSpecialCaseOfOperatorNew0(chunk, m->UsedSize(/*locked_version*/ true),
-                                  addr))
+  if (IsSpecialCaseOfOperatorNew0(chunk, m->UsedSize(), addr))
     return chunk;
   return 0;
 }
 
 // Debug code. Delete once issue #1193 is chased down.
 extern "C" SANITIZER_WEAK_ATTRIBUTE const char *__lsan_current_stage;
 
 void GetUserBeginDebug(uptr chunk) {

 
 void LsanMetadata::set_tag(ChunkTag value) {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
   m->lsan_tag = value;
 }
 
 uptr LsanMetadata::requested_size() const {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
-  return m->UsedSize(/*locked_version=*/true);
+  return m->UsedSize();
 }
 
 u32 LsanMetadata::stack_trace_id() const {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
   return atomic_load(&m->alloc_context_id, memory_order_relaxed);
 }
 
 void ForEachChunk(ForEachChunkCallback callback, void *arg) {