temporary workarounds for Pixel 3

h_malloc.c

@@ -82,6 +82,9 @@ static union {
         int metadata_pkey;
         bool pkey_state_preserved_on_fork;
 #endif
+        bool zero_on_free;
+        bool purge_slabs;
+        bool region_quarantine_protect;
     };
     char padding[PAGE_SIZE];
 } ro __attribute__((aligned(PAGE_SIZE)));
@@ -434,7 +437,7 @@ static void *slot_pointer(size_t size, void *slab, size_t slot) {
 }
 
 static void write_after_free_check(const char *p, size_t size) {
-    if (!WRITE_AFTER_FREE_CHECK) {
+    if (!WRITE_AFTER_FREE_CHECK || !ro.zero_on_free) {
         return;
     }
 
@@ -676,7 +679,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
             }
         }
 
-        if (ZERO_ON_FREE) {
+        if (ro.zero_on_free) {
             memset(p, 0, size - canary_size);
         }
     }
@@ -753,7 +756,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
         metadata->prev = NULL;
 
         if (c->empty_slabs_total + slab_size > max_empty_slabs_total) {
-            if (!memory_map_fixed(slab, slab_size)) {
+            if (ro.purge_slabs && !memory_map_fixed(slab, slab_size)) {
                 label_slab(slab, slab_size, class);
                 stats_slab_deallocate(c, slab_size);
                 enqueue_free_slab(c, metadata);
@@ -833,10 +836,14 @@ static void regions_quarantine_deallocate_pages(void *p, size_t size, size_t gua
         return;
     }
 
+    if (ro.region_quarantine_protect) {
         if (unlikely(memory_map_fixed(p, size))) {
             deallocate_pages(p, size, guard_size);
             return;
         }
+    } else {
+        madvise(p, size, MADV_DONTNEED);
+    }
     memory_set_name(p, size, "malloc large");
 
     struct quarantine_info a =
@@ -1054,6 +1061,19 @@ static inline void enforce_init(void) {
     }
 }
 
+COLD static void handle_hal_bugs(void) {
+    char path[256];
+    if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
+        return;
+    }
+    const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
+    if (strcmp(camera_provider, path) == 0) {
+        ro.zero_on_free = false;
+        ro.purge_slabs = false;
+        ro.region_quarantine_protect = false;
+    }
+}
+
 COLD static void init_slow_path(void) {
     static struct mutex lock = MUTEX_INITIALIZER;
 
@@ -1077,6 +1097,11 @@ COLD static void init_slow_path(void) {
     }
 #endif
 
+    ro.purge_slabs = true;
+    ro.zero_on_free = ZERO_ON_FREE;
+    ro.region_quarantine_protect = true;
+    handle_hal_bugs();
+
     if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) {
         fatal_error("page size mismatch");
     }
@@ -1348,7 +1373,7 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
     total_size = adjust_size_for_canaries(total_size);
     void *p = allocate(arena, total_size);
     thread_seal_metadata();
-    if (!ZERO_ON_FREE && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
+    if (!ro.zero_on_free && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
         memset(p, 0, total_size - canary_size);
     }
     return p;