The difference between chunk2mem and chunk2rawmem is that the latter does not get the memory tag for the returned pointer. It turns out chunk2rawmem almost always works:
The input of chunk2mem is a chunk pointer that is untagged so it can access the chunk header. All memory that is not user allocated heap memory is untagged, which in the current implementation means that it has the 0 tag, but this patch does not rely on the tag value. The patch relies on that chunk operations are either done on untagged chunks or without doing memory access to the user owned part.
Internal interface contracts:
sysmalloc: Returns untagged memory. _int_malloc: Returns untagged memory. _int_free: Takes untagged memory. _int_memalign: Returns untagged memory. _int_realloc: Takes and returns tagged memory.
So only _int_realloc and functions outside this list need care. Alignment checks do not need the right tag and tcache works with untagged memory.
tag_at was kept in realloc after an mremap, which is not strictly necessary, since the pointer is only used to retag the memory, but this way the tag is guaranteed to be different from the old tag.
4eac0ab186 malloc: Use chunk2rawmem throughout
malloc/hooks.c | 2 +-
malloc/malloc.c | 58 ++++++++++++++++++++++++++++++++-------------------------
2 files changed, 34 insertions(+), 26 deletions(-)