scudo: Fix quarantine allocation when MTE enabled.

[pcc]

Summary

Quarantines have always been broken when MTE is enabled because the
quarantine batch allocator fails to reset tags that may have been
left behind by a user allocation.

This was only noticed when running the Scudo unit tests with Scudo
as the system allocator because quarantines are turned off by
default on Android and the test binary turns them on by defining
__scudo_default_options, which affects the system allocator as well.

Depends on D92880

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

103

Are we sticking UNLIKELY around any memtag branches at this point? I feel like this might be a pain to undo when we actually have production devices that ship with this branch. Does it provide us a significant benefit?

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

103

Yes, I'm just being consistent with the other places where we are doing this. I don't remember if we ever measured the perf impact of UNLIKELY on non-MTE devices so maybe if we don't see a significant perf impact we could just remove them now.

compiler-rt/lib/scudo/standalone/combined.h

void *allocate(UNUSED uptr Size) {
       Ptr = reinterpret_cast<void *>(reinterpret_cast<uptr>(Ptr) +
                                      Chunk::getHeaderSize());
       Chunk::UnpackedHeader Header = {};
       Header.ClassId = QuarantineClassId & Chunk::ClassIdMask;
       Header.SizeOrUnusedBytes = sizeof(QuarantineBatch);
       Header.State = Chunk::State::Allocated;
       Chunk::storeHeader(Allocator.Cookie, Ptr, &Header);
 
+      // Reset tag to 0 as this chunk may have been previously used for a tagged
+      // user allocation.
+      if (UNLIKELY(Allocator.useMemoryTagging()))
+        storeTags(reinterpret_cast<uptr>(Ptr),
+                  reinterpret_cast<uptr>(Ptr) + sizeof(QuarantineBatch));
+
       return Ptr;
     }
 
     void deallocate(void *Ptr) {
       const uptr QuarantineClassId = SizeClassMap::getClassIdBySize(
           sizeof(QuarantineBatch) + Chunk::getHeaderSize());
       Chunk::UnpackedHeader Header;
       Chunk::loadHeader(Allocator.Cookie, Ptr, &Header);