227 lines · cpp
1//===--- llvm-opt-fuzzer.cpp - Fuzzer for instruction selection ----------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// Tool to fuzz optimization passes using libFuzzer.10//11//===----------------------------------------------------------------------===//12 13#include "llvm/Bitcode/BitcodeReader.h"14#include "llvm/Bitcode/BitcodeWriter.h"15#include "llvm/CodeGen/CommandFlags.h"16#include "llvm/FuzzMutate/FuzzerCLI.h"17#include "llvm/FuzzMutate/IRMutator.h"18#include "llvm/IR/Verifier.h"19#include "llvm/MC/TargetRegistry.h"20#include "llvm/Passes/PassBuilder.h"21#include "llvm/Support/CommandLine.h"22#include "llvm/Support/SourceMgr.h"23#include "llvm/Support/TargetSelect.h"24#include "llvm/Target/TargetMachine.h"25 26using namespace llvm;27 28static codegen::RegisterCodeGenFlags CGF;29 30static cl::opt<std::string>31 TargetTripleStr("mtriple", cl::desc("Override target triple for module"));32 33// Passes to run for this fuzzer instance. Expects new pass manager syntax.34static cl::opt<std::string> PassPipeline(35 "passes",36 cl::desc("A textual description of the pass pipeline for testing"));37 38static std::unique_ptr<IRMutator> Mutator;39static std::unique_ptr<TargetMachine> TM;40 41std::unique_ptr<IRMutator> createOptMutator() {42 std::vector<TypeGetter> Types{43 Type::getInt1Ty, Type::getInt8Ty, Type::getInt16Ty, Type::getInt32Ty,44 Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};45 46 std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;47 Strategies.push_back(std::make_unique<InjectorIRStrategy>(48 InjectorIRStrategy::getDefaultOps()));49 Strategies.push_back(std::make_unique<InstDeleterIRStrategy>());50 Strategies.push_back(std::make_unique<InstModificationIRStrategy>());51 52 return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));53}54 55extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(56 uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {57 58 assert(Mutator &&59 "IR mutator should have been created during fuzzer initialization");60 61 LLVMContext Context;62 auto M = parseAndVerify(Data, Size, Context);63 if (!M) {64 errs() << "error: mutator input module is broken!\n";65 return 0;66 }67 68 Mutator->mutateModule(*M, Seed, MaxSize);69 70 if (verifyModule(*M, &errs())) {71 errs() << "mutation result doesn't pass verification\n";72#ifndef NDEBUG73 M->dump();74#endif75 // Avoid adding incorrect test cases to the corpus.76 return 0;77 }78 79 std::string Buf;80 {81 raw_string_ostream OS(Buf);82 WriteBitcodeToFile(*M, OS);83 }84 if (Buf.size() > MaxSize)85 return 0;86 87 // There are some invariants which are not checked by the verifier in favor88 // of having them checked by the parser. They may be considered as bugs in the89 // verifier and should be fixed there. However until all of those are covered90 // we want to check for them explicitly. Otherwise we will add incorrect input91 // to the corpus and this is going to confuse the fuzzer which will start92 // exploration of the bitcode reader error handling code.93 auto NewM = parseAndVerify(reinterpret_cast<const uint8_t *>(Buf.data()),94 Buf.size(), Context);95 if (!NewM) {96 errs() << "mutator failed to re-read the module\n";97#ifndef NDEBUG98 M->dump();99#endif100 return 0;101 }102 103 memcpy(Data, Buf.data(), Buf.size());104 return Buf.size();105}106 107extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {108 assert(TM && "Should have been created during fuzzer initialization");109 110 if (Size <= 1)111 // We get bogus data given an empty corpus - ignore it.112 return 0;113 114 // Parse module115 //116 117 LLVMContext Context;118 auto M = parseAndVerify(Data, Size, Context);119 if (!M) {120 errs() << "error: input module is broken!\n";121 return 0;122 }123 124 // Set up target dependant options125 //126 127 M->setTargetTriple(TM->getTargetTriple());128 M->setDataLayout(TM->createDataLayout());129 codegen::setFunctionAttributes(TM->getTargetCPU(),130 TM->getTargetFeatureString(), *M);131 132 // Create pass pipeline133 //134 135 PassBuilder PB(TM.get());136 137 LoopAnalysisManager LAM;138 FunctionAnalysisManager FAM;139 CGSCCAnalysisManager CGAM;140 ModulePassManager MPM;141 ModuleAnalysisManager MAM;142 143 PB.registerModuleAnalyses(MAM);144 PB.registerCGSCCAnalyses(CGAM);145 PB.registerFunctionAnalyses(FAM);146 PB.registerLoopAnalyses(LAM);147 PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);148 149 auto Err = PB.parsePassPipeline(MPM, PassPipeline);150 assert(!Err && "Should have been checked during fuzzer initialization");151 // Only fail with assert above, otherwise ignore the parsing error.152 consumeError(std::move(Err));153 154 // Run passes which we need to test155 //156 157 MPM.run(*M, MAM);158 159 // Check that passes resulted in a correct code160 if (verifyModule(*M, &errs())) {161 errs() << "Transformation resulted in an invalid module\n";162 abort();163 }164 165 return 0;166}167 168static void handleLLVMFatalError(void *, const char *Message, bool) {169 // TODO: Would it be better to call into the fuzzer internals directly?170 dbgs() << "LLVM ERROR: " << Message << "\n"171 << "Aborting to trigger fuzzer exit handling.\n";172 abort();173}174 175extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(int *argc,176 char ***argv) {177 EnableDebugBuffering = true;178 StringRef ExecName = *argv[0];179 180 // Make sure we print the summary and the current unit when LLVM errors out.181 install_fatal_error_handler(handleLLVMFatalError, nullptr);182 183 // Initialize llvm184 //185 186 InitializeAllTargets();187 InitializeAllTargetMCs();188 189 // Parse input options190 //191 192 handleExecNameEncodedOptimizerOpts(ExecName);193 parseFuzzerCLOpts(*argc, *argv);194 195 // Create TargetMachine196 //197 if (TargetTripleStr.empty()) {198 errs() << ExecName << ": -mtriple must be specified\n";199 exit(1);200 }201 ExitOnError ExitOnErr(std::string(ExecName) + ": error:");202 TM = ExitOnErr(codegen::createTargetMachineForTriple(203 Triple::normalize(TargetTripleStr)));204 205 // Check that pass pipeline is specified and correct206 //207 208 if (PassPipeline.empty()) {209 errs() << ExecName << ": at least one pass should be specified\n";210 exit(1);211 }212 213 PassBuilder PB(TM.get());214 ModulePassManager MPM;215 if (auto Err = PB.parsePassPipeline(MPM, PassPipeline)) {216 errs() << ExecName << ": " << toString(std::move(Err)) << "\n";217 exit(1);218 }219 220 // Create mutator221 //222 223 Mutator = createOptMutator();224 225 return 0;226}227