[HWASan] Ignore shortgranules for global tag selection
Tag selection for global variables is sequential, starting at a pseduo-ish seed that's based on the hash of the file name. Previously, it was possible for a global to be assigned a tag in the range [1,15]. If the global's size was not a multiple of granules (i.e. `size % 16 != 0`), then the last granule of the global would be assigned a short granule tag as well. If the real memory tag of the global (e.g. '04') happened to collide with the short granule tag (e.g. '04'), then __hwasan_check would see that the memory tag matched the short granule tag, and dutifully assume (in this fast check) that everthing is okay. Unfortunately, if you tried to access the [5,15]th byte, you never get to the short granule check. This means you miss intra-granule overflows on the last granule of a global, if said global was assigned a real memory tag in the range [1,15]. This causes flakiness in certain global tests, if the SHA of the filename changes between runs. ...
parent
9854cddf
Please register or sign in to comment