From 61b434c3b2b55b35f02c44ada16b4efbe9a5b292 Mon Sep 17 00:00:00 2001
From: Chris Kennelly <ckennelly@google.com>
Date: Fri, 17 Jul 2026 18:46:26 -0700
Subject: [PATCH] Resolve race between allocations and signal handling for slot
 metadata.

We currently classify this as "unknown", but the most probable scenario is that
we reallocated the slot before we read the metadata.

PiperOrigin-RevId: 949865118
---
 tcmalloc/guarded_page_allocator.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tcmalloc/guarded_page_allocator.cc b/tcmalloc/guarded_page_allocator.cc
index 123c476d2..f53284ac4 100644
--- a/tcmalloc/guarded_page_allocator.cc
+++ b/tcmalloc/guarded_page_allocator.cc
@@ -520,7 +520,9 @@ GuardedAllocationsErrorType GuardedPageAllocator::GetErrorType(
   if (addr >= d.allocation_start + d.requested_size) {
     return GuardedAllocationsErrorType::kBufferOverflow;
   }
-  return GuardedAllocationsErrorType::kUnknown;
+  // The allocation is within range, but we have dealloc_count==0.  We likely
+  // raced with another allocation reseting it.
+  return GuardedAllocationsErrorType::kUseAfterFree;
 }
 
 uintptr_t GuardedPageAllocator::SlotToAddr(size_t slot) const {