llvm/tools/llvm-opt-fuzzer/llvm-opt-fuzzer.cpp

   1 //===--- llvm-opt-fuzzer.cpp - Fuzzer for instruction selection ----------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // Tool to fuzz optimization passes using libFuzzer.
  10 //
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "llvm/Analysis/AliasAnalysis.h"
  14 #include "llvm/Bitcode/BitcodeReader.h"
  15 #include "llvm/Bitcode/BitcodeWriter.h"
  16 #include "llvm/CodeGen/CommandFlags.h"
  17 #include "llvm/FuzzMutate/FuzzerCLI.h"
  18 #include "llvm/FuzzMutate/IRMutator.h"
  19 #include "llvm/IR/Verifier.h"
  20 #include "llvm/InitializePasses.h"
  21 #include "llvm/Passes/PassBuilder.h"
  22 #include "llvm/Support/CommandLine.h"
  23 #include "llvm/Support/SourceMgr.h"
  24 #include "llvm/Support/TargetRegistry.h"
  25 #include "llvm/Support/TargetSelect.h"
  26 #include "llvm/Target/TargetMachine.h"
  27
  28 using namespace llvm;
  29
  30 static codegen::RegisterCodeGenFlags CGF;
  31
  32 static cl::opt<std::string>
  33     TargetTripleStr("mtriple", cl::desc("Override target triple for module"));
  34
  35 // Passes to run for this fuzzer instance. Expects new pass manager syntax.
  36 static cl::opt<std::string> PassPipeline(
  37     "passes",
  38     cl::desc("A textual description of the pass pipeline for testing"));
  39
  40 static std::unique_ptr<IRMutator> Mutator;
  41 static std::unique_ptr<TargetMachine> TM;
  42
  43 std::unique_ptr<IRMutator> createOptMutator() {
  44   std::vector<TypeGetter> Types{
  45       Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
  46       Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
  47
  48   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
  49   Strategies.push_back(
  50       std::make_unique<InjectorIRStrategy>(
  51           InjectorIRStrategy::getDefaultOps()));
  52   Strategies.push_back(
  53       std::make_unique<InstDeleterIRStrategy>());
  54
  55   return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
  56 }
  57
  58 extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(
  59     uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {
  60
  61   assert(Mutator &&
  62       "IR mutator should have been created during fuzzer initialization");
  63
  64   LLVMContext Context;
  65   auto M = parseAndVerify(Data, Size, Context);
  66   if (!M) {
  67     errs() << "error: mutator input module is broken!\n";
  68     return 0;
  69   }
  70
  71   Mutator->mutateModule(*M, Seed, Size, MaxSize);
  72
  73   if (verifyModule(*M, &errs())) {
  74     errs() << "mutation result doesn't pass verification\n";
  75 #ifndef NDEBUG
  76     M->dump();
  77 #endif
  78     // Avoid adding incorrect test cases to the corpus.
  79     return 0;
  80   }
  81
  82   std::string Buf;
  83   {
  84     raw_string_ostream OS(Buf);
  85     WriteBitcodeToFile(*M, OS);
  86   }
  87   if (Buf.size() > MaxSize)
  88     return 0;
  89
  90   // There are some invariants which are not checked by the verifier in favor
  91   // of having them checked by the parser. They may be considered as bugs in the
  92   // verifier and should be fixed there. However until all of those are covered
  93   // we want to check for them explicitly. Otherwise we will add incorrect input
  94   // to the corpus and this is going to confuse the fuzzer which will start
  95   // exploration of the bitcode reader error handling code.
  96   auto NewM = parseAndVerify(
  97       reinterpret_cast<const uint8_t*>(Buf.data()), Buf.size(), Context);
  98   if (!NewM) {
  99     errs() << "mutator failed to re-read the module\n";
 100 #ifndef NDEBUG
 101     M->dump();
 102 #endif
 103     return 0;
 104   }
 105
 106   memcpy(Data, Buf.data(), Buf.size());
 107   return Buf.size();
 108 }
 109
 110 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 111   assert(TM && "Should have been created during fuzzer initialization");
 112
 113   if (Size <= 1)
 114     // We get bogus data given an empty corpus - ignore it.
 115     return 0;
 116
 117   // Parse module
 118   //
 119
 120   LLVMContext Context;
 121   auto M = parseAndVerify(Data, Size, Context);
 122   if (!M) {
 123     errs() << "error: input module is broken!\n";
 124     return 0;
 125   }
 126
 127   // Set up target dependant options
 128   //
 129
 130   M->setTargetTriple(TM->getTargetTriple().normalize());
 131   M->setDataLayout(TM->createDataLayout());
 132   codegen::setFunctionAttributes(TM->getTargetCPU(),
 133                                  TM->getTargetFeatureString(), *M);
 134
 135   // Create pass pipeline
 136   //
 137
 138   PassBuilder PB(false, TM.get());
 139
 140   LoopAnalysisManager LAM;
 141   FunctionAnalysisManager FAM;
 142   CGSCCAnalysisManager CGAM;
 143   ModulePassManager MPM;
 144   ModuleAnalysisManager MAM;
 145
 146   FAM.registerPass([&] { return PB.buildDefaultAAPipeline(); });
 147   PB.registerModuleAnalyses(MAM);
 148   PB.registerCGSCCAnalyses(CGAM);
 149   PB.registerFunctionAnalyses(FAM);
 150   PB.registerLoopAnalyses(LAM);
 151   PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
 152
 153   auto Err = PB.parsePassPipeline(MPM, PassPipeline);
 154   assert(!Err && "Should have been checked during fuzzer initialization");
 155   // Only fail with assert above, otherwise ignore the parsing error.
 156   consumeError(std::move(Err));
 157
 158   // Run passes which we need to test
 159   //
 160
 161   MPM.run(*M, MAM);
 162
 163   // Check that passes resulted in a correct code
 164   if (verifyModule(*M, &errs())) {
 165     errs() << "Transformation resulted in an invalid module\n";
 166     abort();
 167   }
 168
 169   return 0;
 170 }
 171
 172 static void handleLLVMFatalError(void *, const std::string &Message, bool) {
 173   // TODO: Would it be better to call into the fuzzer internals directly?
 174   dbgs() << "LLVM ERROR: " << Message << "\n"
 175          << "Aborting to trigger fuzzer exit handling.\n";
 176   abort();
 177 }
 178
 179 extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(
 180     int *argc, char ***argv) {
 181   EnableDebugBuffering = true;
 182
 183   // Make sure we print the summary and the current unit when LLVM errors out.
 184   install_fatal_error_handler(handleLLVMFatalError, nullptr);
 185
 186   // Initialize llvm
 187   //
 188
 189   InitializeAllTargets();
 190   InitializeAllTargetMCs();
 191
 192   PassRegistry &Registry = *PassRegistry::getPassRegistry();
 193   initializeCore(Registry);
 194   initializeCoroutines(Registry);
 195   initializeScalarOpts(Registry);
 196   initializeObjCARCOpts(Registry);
 197   initializeVectorization(Registry);
 198   initializeIPO(Registry);
 199   initializeAnalysis(Registry);
 200   initializeTransformUtils(Registry);
 201   initializeInstCombine(Registry);
 202   initializeAggressiveInstCombine(Registry);
 203   initializeInstrumentation(Registry);
 204   initializeTarget(Registry);
 205
 206   // Parse input options
 207   //
 208
 209   handleExecNameEncodedOptimizerOpts(*argv[0]);
 210   parseFuzzerCLOpts(*argc, *argv);
 211
 212   // Create TargetMachine
 213   //
 214
 215   if (TargetTripleStr.empty()) {
 216     errs() << *argv[0] << ": -mtriple must be specified\n";
 217     exit(1);
 218   }
 219   Triple TargetTriple = Triple(Triple::normalize(TargetTripleStr));
 220
 221   std::string Error;
 222   const Target *TheTarget =
 223       TargetRegistry::lookupTarget(codegen::getMArch(), TargetTriple, Error);
 224   if (!TheTarget) {
 225     errs() << *argv[0] << ": " << Error;
 226     exit(1);
 227   }
 228
 229   TargetOptions Options =
 230       codegen::InitTargetOptionsFromCodeGenFlags(TargetTriple);
 231   TM.reset(TheTarget->createTargetMachine(
 232       TargetTriple.getTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
 233       Options, codegen::getExplicitRelocModel(),
 234       codegen::getExplicitCodeModel(), CodeGenOpt::Default));
 235   assert(TM && "Could not allocate target machine!");
 236
 237   // Check that pass pipeline is specified and correct
 238   //
 239
 240   if (PassPipeline.empty()) {
 241     errs() << *argv[0] << ": at least one pass should be specified\n";
 242     exit(1);
 243   }
 244
 245   PassBuilder PB(false, TM.get());
 246   ModulePassManager MPM;
 247   if (auto Err = PB.parsePassPipeline(MPM, PassPipeline)) {
 248     errs() << *argv[0] << ": " << toString(std::move(Err)) << "\n";
 249     exit(1);
 250   }
 251
 252   // Create mutator
 253   //
 254
 255   Mutator = createOptMutator();
 256
 257   return 0;
 258 }