[all-commits] [llvm/llvm-project] 180707: [hwasan] Do not use short granule tags as poison t...

[Florian Mayer via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 18070723ef5cfd7d58bc296fedb67b5e3a88908f
      https://github.com/llvm/llvm-project/commit/18070723ef5cfd7d58bc296fedb67b5e3a88908f
  Author: Florian Mayer <fmayer at google.com>
  Date:   2021-06-17 (Thu, 17 Jun 2021)

  Changed paths:
    M compiler-rt/lib/hwasan/hwasan_allocator.cpp

  Log Message:
  -----------
  [hwasan] Do not use short granule tags as poison tags.

Short granule tags as poison cause a UaF to read the referenced
memory to retrieve the tag, and means we do not detect the UaF
if the last granule's tag is still around.

This only increases the change of not catching a UaF from
0.39 % (1 / 256) to 0.42 % (1 / (256 - 17)).

Reviewed By: eugenis

Differential Revision: https://reviews.llvm.org/D104304