1 //===--- llvm-opt-fuzzer.cpp - Fuzzer for instruction selection ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Tool to fuzz optimization passes using libFuzzer.
10 //
11 //===----------------------------------------------------------------------===//
12
13 #include "llvm/Analysis/AliasAnalysis.h"
14 #include "llvm/Bitcode/BitcodeReader.h"
15 #include "llvm/Bitcode/BitcodeWriter.h"
16 #include "llvm/CodeGen/CommandFlags.h"
17 #include "llvm/FuzzMutate/FuzzerCLI.h"
18 #include "llvm/FuzzMutate/IRMutator.h"
19 #include "llvm/IR/Verifier.h"
20 #include "llvm/InitializePasses.h"
21 #include "llvm/Passes/PassBuilder.h"
22 #include "llvm/Support/CommandLine.h"
23 #include "llvm/Support/SourceMgr.h"
24 #include "llvm/Support/TargetRegistry.h"
25 #include "llvm/Support/TargetSelect.h"
26 #include "llvm/Target/TargetMachine.h"
27
28 using namespace llvm;
29
30 static codegen::RegisterCodeGenFlags CGF;
31
32 static cl::opt<std::string>
33 TargetTripleStr("mtriple", cl::desc("Override target triple for module"));
34
35 // Passes to run for this fuzzer instance. Expects new pass manager syntax.
36 static cl::opt<std::string> PassPipeline(
37 "passes",
38 cl::desc("A textual description of the pass pipeline for testing"));
39
40 static std::unique_ptr<IRMutator> Mutator;
41 static std::unique_ptr<TargetMachine> TM;
42
createOptMutator()43 std::unique_ptr<IRMutator> createOptMutator() {
44 std::vector<TypeGetter> Types{
45 Type::getInt1Ty, Type::getInt8Ty, Type::getInt16Ty, Type::getInt32Ty,
46 Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
47
48 std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
49 Strategies.push_back(
50 std::make_unique<InjectorIRStrategy>(
51 InjectorIRStrategy::getDefaultOps()));
52 Strategies.push_back(
53 std::make_unique<InstDeleterIRStrategy>());
54 Strategies.push_back(std::make_unique<InstModificationIRStrategy>());
55
56 return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
57 }
58
LLVMFuzzerCustomMutator(uint8_t * Data,size_t Size,size_t MaxSize,unsigned int Seed)59 extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(
60 uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {
61
62 assert(Mutator &&
63 "IR mutator should have been created during fuzzer initialization");
64
65 LLVMContext Context;
66 auto M = parseAndVerify(Data, Size, Context);
67 if (!M) {
68 errs() << "error: mutator input module is broken!\n";
69 return 0;
70 }
71
72 Mutator->mutateModule(*M, Seed, Size, MaxSize);
73
74 if (verifyModule(*M, &errs())) {
75 errs() << "mutation result doesn't pass verification\n";
76 #ifndef NDEBUG
77 M->dump();
78 #endif
79 // Avoid adding incorrect test cases to the corpus.
80 return 0;
81 }
82
83 std::string Buf;
84 {
85 raw_string_ostream OS(Buf);
86 WriteBitcodeToFile(*M, OS);
87 }
88 if (Buf.size() > MaxSize)
89 return 0;
90
91 // There are some invariants which are not checked by the verifier in favor
92 // of having them checked by the parser. They may be considered as bugs in the
93 // verifier and should be fixed there. However until all of those are covered
94 // we want to check for them explicitly. Otherwise we will add incorrect input
95 // to the corpus and this is going to confuse the fuzzer which will start
96 // exploration of the bitcode reader error handling code.
97 auto NewM = parseAndVerify(
98 reinterpret_cast<const uint8_t*>(Buf.data()), Buf.size(), Context);
99 if (!NewM) {
100 errs() << "mutator failed to re-read the module\n";
101 #ifndef NDEBUG
102 M->dump();
103 #endif
104 return 0;
105 }
106
107 memcpy(Data, Buf.data(), Buf.size());
108 return Buf.size();
109 }
110
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)111 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
112 assert(TM && "Should have been created during fuzzer initialization");
113
114 if (Size <= 1)
115 // We get bogus data given an empty corpus - ignore it.
116 return 0;
117
118 // Parse module
119 //
120
121 LLVMContext Context;
122 auto M = parseAndVerify(Data, Size, Context);
123 if (!M) {
124 errs() << "error: input module is broken!\n";
125 return 0;
126 }
127
128 // Set up target dependant options
129 //
130
131 M->setTargetTriple(TM->getTargetTriple().normalize());
132 M->setDataLayout(TM->createDataLayout());
133 codegen::setFunctionAttributes(TM->getTargetCPU(),
134 TM->getTargetFeatureString(), *M);
135
136 // Create pass pipeline
137 //
138
139 PassBuilder PB(false, TM.get());
140
141 LoopAnalysisManager LAM;
142 FunctionAnalysisManager FAM;
143 CGSCCAnalysisManager CGAM;
144 ModulePassManager MPM;
145 ModuleAnalysisManager MAM;
146
147 FAM.registerPass([&] { return PB.buildDefaultAAPipeline(); });
148 PB.registerModuleAnalyses(MAM);
149 PB.registerCGSCCAnalyses(CGAM);
150 PB.registerFunctionAnalyses(FAM);
151 PB.registerLoopAnalyses(LAM);
152 PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
153
154 auto Err = PB.parsePassPipeline(MPM, PassPipeline);
155 assert(!Err && "Should have been checked during fuzzer initialization");
156 // Only fail with assert above, otherwise ignore the parsing error.
157 consumeError(std::move(Err));
158
159 // Run passes which we need to test
160 //
161
162 MPM.run(*M, MAM);
163
164 // Check that passes resulted in a correct code
165 if (verifyModule(*M, &errs())) {
166 errs() << "Transformation resulted in an invalid module\n";
167 abort();
168 }
169
170 return 0;
171 }
172
handleLLVMFatalError(void *,const std::string & Message,bool)173 static void handleLLVMFatalError(void *, const std::string &Message, bool) {
174 // TODO: Would it be better to call into the fuzzer internals directly?
175 dbgs() << "LLVM ERROR: " << Message << "\n"
176 << "Aborting to trigger fuzzer exit handling.\n";
177 abort();
178 }
179
LLVMFuzzerInitialize(int * argc,char *** argv)180 extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(
181 int *argc, char ***argv) {
182 EnableDebugBuffering = true;
183
184 // Make sure we print the summary and the current unit when LLVM errors out.
185 install_fatal_error_handler(handleLLVMFatalError, nullptr);
186
187 // Initialize llvm
188 //
189
190 InitializeAllTargets();
191 InitializeAllTargetMCs();
192
193 PassRegistry &Registry = *PassRegistry::getPassRegistry();
194 initializeCore(Registry);
195 initializeCoroutines(Registry);
196 initializeScalarOpts(Registry);
197 initializeObjCARCOpts(Registry);
198 initializeVectorization(Registry);
199 initializeIPO(Registry);
200 initializeAnalysis(Registry);
201 initializeTransformUtils(Registry);
202 initializeInstCombine(Registry);
203 initializeAggressiveInstCombine(Registry);
204 initializeInstrumentation(Registry);
205 initializeTarget(Registry);
206
207 // Parse input options
208 //
209
210 handleExecNameEncodedOptimizerOpts(*argv[0]);
211 parseFuzzerCLOpts(*argc, *argv);
212
213 // Create TargetMachine
214 //
215
216 if (TargetTripleStr.empty()) {
217 errs() << *argv[0] << ": -mtriple must be specified\n";
218 exit(1);
219 }
220 Triple TargetTriple = Triple(Triple::normalize(TargetTripleStr));
221
222 std::string Error;
223 const Target *TheTarget =
224 TargetRegistry::lookupTarget(codegen::getMArch(), TargetTriple, Error);
225 if (!TheTarget) {
226 errs() << *argv[0] << ": " << Error;
227 exit(1);
228 }
229
230 TargetOptions Options =
231 codegen::InitTargetOptionsFromCodeGenFlags(TargetTriple);
232 TM.reset(TheTarget->createTargetMachine(
233 TargetTriple.getTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
234 Options, codegen::getExplicitRelocModel(),
235 codegen::getExplicitCodeModel(), CodeGenOpt::Default));
236 assert(TM && "Could not allocate target machine!");
237
238 // Check that pass pipeline is specified and correct
239 //
240
241 if (PassPipeline.empty()) {
242 errs() << *argv[0] << ": at least one pass should be specified\n";
243 exit(1);
244 }
245
246 PassBuilder PB(false, TM.get());
247 ModulePassManager MPM;
248 if (auto Err = PB.parsePassPipeline(MPM, PassPipeline)) {
249 errs() << *argv[0] << ": " << toString(std::move(Err)) << "\n";
250 exit(1);
251 }
252
253 // Create mutator
254 //
255
256 Mutator = createOptMutator();
257
258 return 0;
259 }
260