[NFC][Asan] Don't use allocator Metadata

[vitalybuka]

Summary

Previously we used Metadata only with the secondary allocator.

[vitalybuka]

rebase

[vitalybuka]

rebase

compiler-rt/lib/asan/asan_allocator.cpp

 // L L L L L L H H U U U U U U R R
 //   L -- left redzone words (0 or more bytes)
 //   H -- ChunkHeader (16 bytes), which is also a part of the left redzone.
 //   U -- user memory.
 //   R -- right redzone (0 or more bytes)
 // ChunkBase consists of ChunkHeader and other bytes that overlap with user
 // memory.
 
-// If the left redzone is greater than the ChunkHeader size we store a magic
-// value in the first uptr word of the memory block and store the address of
-// ChunkBase in the next uptr.
+// If the left redzone is greater than the sizeof(ChunkHeader) + 2 *
+// sizeof(uptr) then we store a magic value in the first byte of the memory
+// block and store the address of ChunkBase in the second uptr.
 // M B L L L L L L L L L  H H U U U U U U
 //   |                    ^
 //   ---------------------|
-//   M -- magic value kAllocBegMagic
+//   M -- ChunkHeader with CHUNK_PTR
 //   B -- address of ChunkHeader pointing to the first 'H'
-static const uptr kAllocBegMagic = 0xCC6E96B9;
 
 struct ChunkHeader {
   atomic_uint8_t chunk_state;
   u8 from_memalign : 1;
   u8 alloc_type : 2;
   u8 rz_log : 3;
   u8 lsan_tag : 2;
 
enum {
   // Either just allocated by underlying allocator, but AsanChunk is not yet
   // ready, or almost returned to undelying allocator and AsanChunk is already
   // meaningless.
   CHUNK_INVALID = 0,
   // The chunk is allocated and not yet freed.
   CHUNK_ALLOCATED = 2,
   // The chunk was freed and put into quarantine zone.
   CHUNK_QUARANTINE = 3,
+  // This is not a chunk and just a placeholder for the chunk pointer.
+  CHUNK_PTR = 255,
 };
 
 struct AsanChunk: ChunkBase {
   uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; }
 
   void *AllocBeg() {
     if (from_memalign)
       return get_allocator().GetBlockBegin(reinterpret_cast<void *>(this));
     return reinterpret_cast<void*>(Beg() - RZLog2Size(rz_log));
   }
 
   bool AddrIsInside(uptr addr) {
     return (addr >= Beg()) && (addr < Beg() + UsedSize());
   }
 };
 
 struct QuarantineCallback {
   QuarantineCallback(AllocatorCache *cache, BufferedStackTrace *stack)
       : cache_(cache),
         stack_(stack) {
   }
 
   void Recycle(AsanChunk *m) {
+    AsanChunk *p = reinterpret_cast<AsanChunk *>(m->AllocBeg());
+    if (p != m) {
+      u8 old_chunk_state = CHUNK_PTR;
+      // Clear the magic value, as allocator internals may overwrite the
+      // contents of deallocated chunk, confusing GetAsanChunk lookup.
+      if (!atomic_compare_exchange_strong(&p->chunk_state, &old_chunk_state,
+                                          CHUNK_INVALID,
+                                          memory_order_acquire)) {
+        CHECK_EQ(old_chunk_state, CHUNK_PTR);
+      }
+    }
     u8 old_chunk_state = CHUNK_QUARANTINE;
     if (!atomic_compare_exchange_strong(&m->chunk_state, &old_chunk_state,
                                         CHUNK_INVALID, memory_order_acquire)) {
       CHECK_EQ(old_chunk_state, CHUNK_QUARANTINE);
     }
 
     PoisonShadow(m->Beg(),
                  RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY),
                  kAsanHeapLeftRedzoneMagic);
-    void *p = reinterpret_cast<void *>(m->AllocBeg());
-    if (p != m) {
-      uptr *alloc_magic = reinterpret_cast<uptr *>(p);
-      CHECK_EQ(alloc_magic[0], kAllocBegMagic);
-      // Clear the magic value, as allocator internals may overwrite the
-      // contents of deallocated chunk, confusing GetAsanChunk lookup.
-      alloc_magic[0] = 0;
-      CHECK_EQ(alloc_magic[1], reinterpret_cast<uptr>(m));
-    }
 
     // Statistics.
     AsanStats &thread_stats = GetCurrentThreadStats();
     thread_stats.real_frees++;
     thread_stats.really_freed += m->UsedSize();
 
     get_allocator().Deallocate(cache_, p);
   }
void *Allocate(uptr size, uptr alignment, BufferedStackTrace *stack,
     }
     CHECK(IsPowerOfTwo(alignment));
     uptr rz_log = ComputeRZLog(size);
     uptr rz_size = RZLog2Size(rz_log);
     uptr rounded_size = RoundUpTo(Max(size, kChunkHeader2Size), alignment);
     uptr needed_size = rounded_size + rz_size;
     if (alignment > min_alignment)
       needed_size += alignment;
-    bool using_primary_allocator = true;
     // If we are allocating from the secondary allocator, there will be no
     // automatic right redzone, so add the right redzone manually.
-    if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) {
+    if (!PrimaryAllocator::CanAllocate(needed_size, alignment))
       needed_size += rz_size;
-      using_primary_allocator = false;
-    }
     CHECK(IsAligned(needed_size, min_alignment));
     if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize ||
         size > max_user_defined_malloc_size) {
       if (AllocatorMayReturnNull()) {
         Report("WARNING: AddressSanitizer failed to allocate 0x%zx bytes\n",
                (void*)size);
         return nullptr;
       }
if (!IsAligned(user_beg, alignment))
       user_beg = RoundUpTo(user_beg, alignment);
     uptr user_end = user_beg + size;
     CHECK_LE(user_end, alloc_end);
     uptr chunk_beg = user_beg - kChunkHeaderSize;
     AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg);
     m->alloc_type = alloc_type;
     m->rz_log = rz_log;
     m->from_memalign = user_beg != beg_plus_redzone;
-    if (alloc_beg != chunk_beg) {
-      CHECK_LE(alloc_beg + 2 * sizeof(uptr), chunk_beg);
-      reinterpret_cast<uptr *>(alloc_beg)[0] = kAllocBegMagic;
-      reinterpret_cast<uptr *>(alloc_beg)[1] = chunk_beg;
-    }
     CHECK(size);
     m->SetUsedSize(size);
-    if (using_primary_allocator) {
-      CHECK(allocator.FromPrimary(allocated));
-    } else {
-      CHECK(!allocator.FromPrimary(allocated));
-      uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(allocated));
-      meta[1] = chunk_beg;
-    }
     m->user_requested_alignment_log = user_requested_alignment_log;
 
     m->SetAllocContext(t ? t->tid() : 0, StackDepotPut(*stack));
 
     uptr size_rounded_down_to_granularity =
         RoundDownTo(size, SHADOW_GRANULARITY);
     // Unpoison the bulk of the memory region.
     if (size_rounded_down_to_granularity)
if (can_fill && fl.max_malloc_fill_size) {
       REAL(memset)(res, fl.malloc_fill_byte, fill_size);
     }
 #if CAN_SANITIZE_LEAKS
     m->lsan_tag = __lsan::DisabledInThisThread() ? __lsan::kIgnored
                                                  : __lsan::kDirectlyLeaked;
 #endif
     // Must be the last mutation of metadata in this function.
     atomic_store(&m->chunk_state, CHUNK_ALLOCATED, memory_order_release);
+    if (alloc_beg != chunk_beg) {
+      reinterpret_cast<uptr *>(alloc_beg)[1] = chunk_beg;
+      // Up to this point only LSan can inspect this chunk, and the only
+      // information LSan needs is where AsanChunk ends. Without CHUNK_PTR LSan
+      // assumes chunk_beg == alloc_beg but it was not important for leak
+      // checking on just allocated block.
+      atomic_store(&reinterpret_cast<AsanChunk *>(alloc_beg)->chunk_state,
+                   CHUNK_PTR, memory_order_release);
+    }
     ASAN_MALLOC_HOOK(res, size);
     return res;
   }
 
   // Set quarantine flag if chunk is allocated, issue ASan error report on
   // available and quarantined chunks. Return true on success, false otherwise.
   bool AtomicallySetQuarantineFlagIfAllocated(AsanChunk *m, void *ptr,
                                               BufferedStackTrace *stack) {
#endif
 
   // Assumes alloc_beg == allocator.GetBlockBegin(alloc_beg).
   // Returns nullptr if AsanChunk is not yet initialized just after
   // get_allocator().Allocate(), or is being destroyed just before
   // get_allocator().Deallocate().
   AsanChunk *GetAsanChunk(void *alloc_beg) {
     if (!alloc_beg)
       return nullptr;
-    AsanChunk *p = nullptr;
-    if (!allocator.FromPrimary(alloc_beg)) {
-      uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(alloc_beg));
-      p = reinterpret_cast<AsanChunk *>(meta[1]);
-    } else {
-      uptr *alloc_magic = reinterpret_cast<uptr *>(alloc_beg);
-      if (alloc_magic[0] == kAllocBegMagic)
-        p = reinterpret_cast<AsanChunk *>(alloc_magic[1]);
-      else
-        p = reinterpret_cast<AsanChunk *>(alloc_beg);
-    }
+    AsanChunk *p = reinterpret_cast<AsanChunk *>(alloc_beg);
+    if (atomic_load(&p->chunk_state, memory_order_acquire) == CHUNK_PTR)
+      p = reinterpret_cast<AsanChunk *>(reinterpret_cast<uptr *>(alloc_beg)[1]);
     if (!p)
       return nullptr;
     if (atomic_load(&p->chunk_state, memory_order_relaxed) == CHUNK_INVALID)
       return nullptr;
     return p;
   }
 
   AsanChunk *GetAsanChunkByAddr(uptr p) {